{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.8895337, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T09:56:07Z" }, "path": "527355", "raw": { "v": "4", "fs": [ { "f": "KO₁₀(Al₃Er₉I₃As₁₂C₄CaCo₂P₂SXe)H₉(CrF₄HfOs₇Po₃UCmDb₂Ds)Md₄(Bi₆SiPt)", "x": 131, "id": 0, "is": [ "GetStdHandle", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "Sleep", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "SetHandleCount", "GetFileType", "QueryPerformanceCounter", "GetSystemTimeAsFileTime", "GetACP", "SetConsoleCtrlHandler", "GetTimeZoneInformation", "GetConsoleCP", "HeapCreate", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetTimeFormatA", "GetDateFormatA", "GetUserDefaultLCID", "EnumSystemLocalesA", "IsValidLocale", "IsValidCodePage", "GetLocaleInfoW", "SetStdHandle", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "SetEnvironmentVariableA", "HeapDestroy", "VirtualFree", "InterlockedExchange", "FatalAppExitA", "HeapSize", "CreateThread", "ExitThread", "ExitProcess", "GetStartupInfoA", "GetProcessHeap", "GetCommandLineA", "RaiseException", "RtlUnwind", "VirtualQuery", "GetSystemInfo", "VirtualAlloc", "VirtualProtect", "HeapReAlloc", "HeapFree", "HeapAlloc", "GetProfileIntA", "GetTickCount", "GetOEMCP", "GetCPInfo", "GetCurrentDirectoryA", "GetPrivateProfileStringA", "WritePrivateProfileStringA", "GetPrivateProfileIntA", "SetErrorMode", "GetAtomNameA", "SetFileAttributesA", "SystemTimeToFileTime", "LocalFileTimeToFileTime", "FileTimeToLocalFileTime", "FileTimeToSystemTime", "GlobalFlags", "InterlockedIncrement", "TlsFree", "DeleteCriticalSection", "LocalReAlloc", "TlsSetValue", "TlsAlloc", "InitializeCriticalSection", "GlobalHandle", "GlobalReAlloc", "EnterCriticalSection", "TlsGetValue", "LeaveCriticalSection", "LocalAlloc", "InterlockedDecrement", "GetModuleFileNameW", "GlobalGetAtomNameA", "GlobalFindAtomA", "lstrcmpW", "GetVersionExA", "FreeResource", "GetCurrentProcessId", "GlobalAddAtomA", "CreateEventA", "SuspendThread", "SetEvent", "WaitForSingleObject", "ResumeThread", "SetThreadPriority", "GetCurrentThread", "GetCurrentThreadId", "ConvertDefaultLocale", "EnumResourceLanguagesA", "GetLocaleInfoA", "lstrcmpA", "FreeLibrary", "GlobalDeleteAtom", "CreateFileA", "GetModuleFileNameA", "GetShortPathNameA", "GetVolumeInformationA", "FindFirstFileA", "FindClose", "GetCurrentProcess", "DuplicateHandle", "CloseHandle", "GetThreadLocale", "GetFileSize", "SetEndOfFile", "UnlockFile", "LockFile", "FlushFileBuffers", "SetFilePointer", "WriteFile", "ReadFile", "LoadLibraryA", "DeleteFileA", "MoveFileA", "GetDiskFreeSpaceA", "GetFullPathNameA", "GetTempFileNameA", "GetFileTime", "SetFileTime", "GetFileAttributesA", "GetModuleHandleA", "GetProcAddress", "CopyFileA", "FormatMessageA", "LocalFree", "MulDiv", "SetLastError", "FindResourceA", "LoadResource", "LockResource", "SizeofResource", "GetStringTypeExW", "GetStringTypeExA", "GetEnvironmentVariableW", "GetEnvironmentVariableA", "lstrlenA", "lstrcmpiW", "lstrcmpiA", "CompareStringW", "CompareStringA", "lstrlenW", "GlobalFree", "GlobalSize", "GlobalAlloc", "GlobalLock", "GlobalUnlock", "GetVersion", "GetLastError", "WideCharToMultiByte", "MultiByteToWideChar", "GetConsoleMode", "PostThreadMessageA", "GetTabbedTextExtentA", "WindowFromPoint", "GetKeyNameTextA", "MapVirtualKeyA", "GetSystemMenu", "UnionRect", "WaitMessage", "GetDCEx", "LockWindowUpdate", "SendNotifyMessageA", "RegisterClipboardFormatA", "IsZoomed", "UnpackDDElParam", "ReuseDDElParam", "InsertMenuItemA", "CreatePopupMenu", "SetMenu", "SetRectEmpty", "DestroyCursor", "SetRect", "ReleaseCapture", "LoadCursorA", "SetCapture", "KillTimer", "SetTimer", "InvalidateRect", "SetWindowRgn", "DrawIcon", "IsRectEmpty", "FindWindowA", "RegisterWindowMessageA", "LoadIconA", "WinHelpA", "IsChild", "GetCapture", "GetClassLongA", "GetClassNameA", "SetPropA", "GetPropA", "RemovePropA", "GetForegroundWindow", "BeginDeferWindowPos", "EndDeferWindowPos", "GetTopWindow", "UnhookWindowsHookEx", "GetMessageTime", "GetMessagePos", "MapWindowPoints", "ScrollWindow", "TrackPopupMenuEx", "TrackPopupMenu", "SetScrollRange", "GetScrollRange", "SetScrollPos", "GetScrollPos", "SetForegroundWindow", "ShowScrollBar", "GetClassInfoExA", "GetClassInfoA", "RegisterClassA", "EqualRect", "DeferWindowPos", "CopyRect", "GetScrollInfo", "SetScrollInfo", "PtInRect", "SetWindowPlacement", "DefWindowProcA", "CallWindowProcA", "OffsetRect", "IntersectRect", "SystemParametersInfoA", "CreateMenu", "GetWindowPlacement", "GetWindowRect", "SetActiveWindow", "CreateDialogIndirectParamA", "DestroyWindow", "GetNextDlgTabItem", "EndDialog", "AdjustWindowRectEx", "RedrawWindow", "GetClientRect", "TranslateAcceleratorA", "TranslateMDISysAccel", "BringWindowToTop", "DrawMenuBar", "CreateWindowExA", "DefMDIChildProcA", "GetMenu", "DefFrameProcA", "LoadMenuA", "LoadAcceleratorsA", "DestroyMenu", "GetWindowTextLengthA", "GetWindowTextA", "SetWindowPos", "ScrollWindowEx", "SetFocus", "ShowWindow", "MoveWindow", "SetWindowLongA", "GetDlgCtrlID", "IsWindow", "SetWindowTextA", "IsDialogMessageA", "IsDlgButtonChecked", "SetDlgItemTextA", "SetDlgItemInt", "SendDlgItemMessageA", "GetDlgItemTextA", "GetDlgItemInt", "GetDlgItem", "CheckRadioButton", "CheckDlgButton", "GetWindow", "GetWindowThreadProcessId", "GetWindowLongA", "GetLastActivePopup", "IsWindowEnabled", "ShowOwnedPopups", "SetCursor", "SetWindowsHookExA", "CallNextHookEx", "GetMessageA", "TranslateMessage", "DispatchMessageA", "GetActiveWindow", "GetKeyState", "PeekMessageA", "GetCursorPos", "ValidateRect", "PostMessageA", "PostQuitMessage", "GetSystemMetrics", "SetMenuItemBitmaps", "GetMenuCheckMarkDimensions", "LoadBitmapA", "GetFocus", "GetParent", "ModifyMenuA", "EnableMenuItem", "CheckMenuItem", "IsWindowVisible", "GetSysColor", "EndPaint", "BeginPaint", "GetWindowDC", "CopyAcceleratorTableA", "SetParent", "WindowFromDC", "InSendMessage", "UnregisterClassA", "GetDialogBaseUnits", "GetMenuItemInfoA", "DestroyIcon", "DeleteMenu", "InflateRect", "IsIconic", "GetSysColorBrush", "ReleaseDC", "GetDC", "ClientToScreen", "ScreenToClient", "GrayStringA", "DrawTextExA", "DrawTextA", "TabbedTextOutA", "FillRect", "GetMenuState", "GetMenuStringA", "AppendMenuA", "GetMenuItemID", "InsertMenuA", "GetMenuItemCount", "GetSubMenu", "RemoveMenu", "LoadStringW", "SendMessageA", "IsClipboardFormatAvailable", "GetClipboardData", "EmptyClipboard", "SetClipboardData", "CloseClipboard", "OpenClipboard", "EnableWindow", "UpdateWindow", "MessageBoxA", "CharUpperW", "CharUpperA", "CharLowerW", "CharLowerA", "GetDesktopWindow", "ScaleWindowExtEx", "GetCurrentPositionEx", "ArcTo", "PolyDraw", "PolylineTo", "PolyBezierTo", "ExtSelectClipRgn", "DeleteDC", "GetWindowExtEx", "CreateDIBPatternBrushPt", "CreatePatternBrush", "CreateBitmap", "CreateCompatibleDC", "GetStockObject", "PlayMetaFileRecord", "GetObjectType", "EnumMetaFile", "PlayMetaFile", "CreatePen", "ExtCreatePen", "CreateSolidBrush", "CreateHatchBrush", "GetDCOrgEx", "CreateEllipticRgn", "DPtoLP", "LPtoDP", "Ellipse", "StartPage", "EndPage", "SetAbortProc", "AbortDoc", "EndDoc", "SetWindowExtEx", "Rectangle", "PatBlt", "GetCharWidthA", "CreateFontA", "CreateCompatibleBitmap", "GetTextMetricsA", "GetTextExtentPoint32A", "CreateFontIndirectA", "CreateRectRgnIndirect", "SetRectRgn", "CombineRgn", "GetMapMode", "GetNearestColor", "GetBkColor", "GetBkMode", "GetPolyFillMode", "GetROP2", "GetStretchBltMode", "GetTextColor", "GetTextAlign", "GetTextFaceA", "GetWindowOrgEx", "CreateMetaFileA", "CloseMetaFile", "DeleteMetaFile", "GetViewportExtEx", "GetObjectA", "SelectClipPath", "CreateRectRgn", "GetClipRgn", "SelectClipRgn", "DeleteObject", "OffsetWindowOrgEx", "SetWindowOrgEx", "ScaleViewportExtEx", "SetViewportExtEx", "OffsetViewportOrgEx", "SetViewportOrgEx", "SelectObject", "Escape", "ExtTextOutA", "TextOutA", "RectVisible", "PtVisible", "StartDocA", "GetPixel", "GetViewportOrgEx", "CreatePalette", "SetColorAdjustment", "SetArcDirection", "SetMapperFlags", "SetTextCharacterExtra", "SetTextJustification", "SetTextAlign", "MoveToEx", "LineTo", "OffsetClipRgn", "IntersectClipRect", "ExcludeClipRect", "GetClipBox", "SetMapMode", "ModifyWorldTransform", "SetWorldTransform", "SetGraphicsMode", "SetTextColor", "SetROP2", "SetPolyFillMode", "SetBkMode", "SetBkColor", "RestoreDC", "SaveDC", "CreateDCA", "CopyMetaFileA", "RealizePalette", "GetDeviceCaps", "SelectPalette", "SetStretchBltMode", "SetDIBitsToDevice", "StretchDIBits", "BitBlt", "GetFileTitleA", "ClosePrinter", "DocumentPropertiesA", "OpenPrinterA", "GetJobA", "RegDeleteValueA", "RegSetValueExA", "RegCreateKeyExA", "RegQueryValueA", "RegEnumKeyA", "RegDeleteKeyA", "RegOpenKeyExA", "RegQueryValueExA", "GetFileSecurityA", "SetFileSecurityA", "RegOpenKeyA", "RegSetValueA", "RegCloseKey", "SetFileSecurityW", "RegCreateKeyA", "SHGetFileInfoA", "DragFinish", "DragQueryFileA", "ExtractIconA", "DragAcceptFiles", "PathIsUNCA", "PathFindExtensionA", "PathRemoveExtensionA", "PathStripToRootA", "PathFindFileNameA", "OleGetIconOfClass", "CreateItemMoniker", "CreateGenericComposite", "OleIsRunning", "GetRunningObjectTable", "CoLockObjectExternal", "OleRun", "CreateFileMoniker", "CoGetMalloc", "StgCreateDocfile", "StgOpenStorage", "StgIsStorageFile", "CreateOleAdviseHolder", "CreateDataAdviseHolder", "OleGetClipboard", "OleSetClipboard", "OleIsCurrentClipboard", "OleFlushClipboard", "OleSetMenuDescriptor", "OleQueryCreateFromData", "OleQueryLinkFromData", "DoDragDrop", "OleUninitialize", "CoFreeUnusedLibraries", "OleInitialize", "CoGetClassObject", "CoRegisterClassObject", "CoRevokeClassObject", "CoRegisterMessageFilter", "CLSIDFromProgID", "OleCreateLinkToFile", "OleCreateLinkFromData", "OleCreateFromData", "OleLockRunning", "CreateStreamOnHGlobal", "OleSaveToStream", "WriteClassStm", "OleSave", "CreateILockBytesOnHGlobal", "StgCreateDocfileOnILockBytes", "OleDestroyMenuDescriptor", "OleCreateMenuDescriptor", "IsAccelerator", "OleTranslateAccelerator", "OleRegGetMiscStatus", "OleRegEnumVerbs", "CLSIDFromString", "StringFromGUID2", "CoCreateInstance", "CoDisconnectObject", "OleDuplicateData", "CoTaskMemAlloc", "ReleaseStgMedium", "CreateBindCtx", "CoTreatAsClass", "StringFromCLSID", "ReadClassStg", "ReadFmtUserTypeStg", "OleRegGetUserType", "WriteClassStg", "WriteFmtUserTypeStg", "SetConvertStg", "CoTaskMemFree", "OleCreateFromFile", "OleSetContainedObject", "GetHGlobalFromILockBytes", "StgOpenStorageOnILockBytes", "OleLoad", "OleCreateStaticFromData", "OleCreate", "ORDINAL 7", "ORDINAL 161", "ORDINAL 2", "ORDINAL 114", "ORDINAL 104", "ORDINAL 197", "ORDINAL 232", "ORDINAL 113", "ORDINAL 94", "ORDINAL 5", "ORDINAL 184", "ORDINAL 185", "ORDINAL 38", "ORDINAL 39", "ORDINAL 16", "ORDINAL 22", "ORDINAL 21", "ORDINAL 26", "ORDINAL 148", "ORDINAL 25", "ORDINAL 27", "ORDINAL 36", "ORDINAL 37", "ORDINAL 10", "ORDINAL 40", "ORDINAL 15", "ORDINAL 17", "ORDINAL 18", "ORDINAL 20", "ORDINAL 19", "ORDINAL 23", "ORDINAL 24", "ORDINAL 4", "ORDINAL 8", "ORDINAL 12", "ORDINAL 9", "ORDINAL 150", "ORDINAL 6", "ORDINAL 149", "ORDINAL 8" ], "ms": { "pe": { "machine": 332.0, "checksum": 843718.0, "rsrc_size": 102400.0, "subsystem": 2.0, "timestamp": 1573031334.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 7.09, "entry_section": ".text", "size_of_image": 802816.0, "timestamp_day": 6.0, "file_alignment": 4096.0, "resource_count": 11.0, "timestamp_year": 2019.0, "characteristics": 259.0, "entry_point_rva": 333899.0, "size_of_headers": 4096.0, "timestamp_month": 11.0, "checksum_present": true, "export_timestamp": 1573031334.0, "import_dll_count": 11.0, "manifest_present": true, "checksum_mismatch": true, "computed_checksum": 844000.0, "section_alignment": 4096.0, "unusual_alignment": true, "delay_load_imports": 1.0, "number_of_sections": 4.0, "resource_timestamp": 0.0, "rich_header_present": true, "export_timestamp_day": 6.0, "linker_major_version": 8.0, "export_timestamp_year": 2019.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 11.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 524288.0, "file_size": 786714.0, "entry_point": 333899.0, "has_overlay": true, "code_entropy": 6.6, "data_entropy": 4.49, "export_count": 1.0, "import_count": 612.0, "overlay_size": 282.0, "string_count": 1616.0, "overlay_ratio": 0.0, "section_count": 4.0, "avg_complexity": 7.11, "function_count": 1291.0, "import_density": 1.2, "max_complexity": 384.0, "string_density": 3.16, "overall_entropy": 5.67, "avg_basic_blocks": 11.35, "avg_section_size": 195584.0, "dependency_count": 11.0, "entropy_variance": 1.23, "function_density": 2.52, "avg_function_size": 344.22, "avg_string_length": 17.9, "complexity_per_kb": 0.01, "max_string_length": 393.0, "wide_string_count": 113.0, "writable_sections": 1.0, "avg_string_entropy": 3.22, "code_to_data_ratio": 2.03, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.13, "text_to_file_ratio": 0.67, "total_basic_blocks": 14653.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 21.18, "largest_section_ratio": 0.67, "sentence_string_count": 155.0, "sentence_string_ratio": 0.1, "behavioral_import_ratio": 0.01, "function_analysis_depth": 2.0, "high_complexity_functions": 14.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".rsrc" ], [ 4645, "JUWS" ], [ 5632, "VVVVW" ], [ 6559, "PAQW" ], [ 8686, "QQSV" ], [ 9261, "QWSP" ], [ 12686, "PWVSV" ], [ 13696, "USVW" ], [ 14821, "RC4 for x86, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 16933, "QSVW" ], [ 17870, "C4VP" ], [ 18039, "PVPW" ], [ 19832, "SSSW" ], [ 19877, "SSS3" ], [ 25849, "QQVW" ], [ 26305, "YYSP" ], [ 28660, "PH_3" ], [ 33728, "WWWWQS" ], [ 34651, "6WPV" ], [ 37424, "E S3" ], [ 39308, "SSOWVQ" ], [ 44868, "Pjnhd.H" ], [ 51425, "QQSUVW" ], [ 51539, "UUUUW" ], [ 51578, "SUVW" ], [ 51717, "pu.f" ], [ 53052, "VVUVS" ], [ 59307, "KLVP" ], [ 63489, "v WWWWSWh" ], [ 63843, "XSVW" ], [ 64455, "QSUV" ], [ 67758, "QWWV" ], [ 72330, "PQQQQQ" ], [ 79180, "FLW3" ], [ 80045, "SUV3" ], [ 81669, "t7j0" ], [ 81815, "F W3" ], [ 83770, "9p u" ], [ 94697, "SUVW3" ], [ 96987, "QQSVW" ], [ 99106, "QPWWW" ], [ 105307, "Nxjd" ], [ 108621, "SQRP" ], [ 111398, "SVW3" ], [ 115196, "HtcHt7Ht-HHt" ], [ 116738, "RVHP" ], [ 117462, "4SVW" ], [ 118968, "WSWV" ], [ 121726, "QQSVW3" ], [ 121910, "QSUVW3" ], [ 123618, "PPWVP" ], [ 129664, "PSSSSS" ], [ 137219, "QVW3" ], [ 142301, "YYPS" ], [ 143561, "HSWU" ], [ 143577, "VVVVPUVV" ], [ 144210, "F0PU" ], [ 144226, "F2PU" ], [ 144355, "G0PUU" ], [ 144374, "2WUU" ], [ 144418, "VVVVP" ], [ 144444, "VVSP" ], [ 169509, "PWVWWW" ], [ 169544, "WVWWW" ], [ 169594, "QQV3" ], [ 170327, "SVWP" ], [ 171982, "RPVQ" ], [ 181358, "FHPU" ], [ 181400, "FDPU" ], [ 181442, "FLPU" ], [ 184994, "AQPQV" ], [ 188924, "QQSUV" ], [ 191009, "SSSSV" ], [ 192751, "t3h8" ], [ 196086, "TSVW" ], [ 205269, "PWPPV" ], [ 206656, "HSVW" ], [ 209841, "SWWWWP" ], [ 212375, "RQQQQQ" ], [ 216122, "RSSSSS" ], [ 216703, "jTSSSSS" ], [ 233435, "jWWWWWW" ], [ 234991, "G WhHVH" ], [ 265353, "6PVPV" ], [ 265950, "PWS3" ], [ 268974, "QSUVW" ], [ 269004, "UUSW" ], [ 269751, "PPWV" ], [ 269987, "WPPWV" ], [ 270350, "ASSSS" ], [ 274381, "SUUS" ], [ 274914, "FHSP" ], [ 274924, "F8SP" ], [ 274934, "FXSP" ], [ 275711, "KLPQ" ], [ 277184, "QPVR" ], [ 278245, "N8SW" ], [ 280671, "QSUV3" ], [ 280741, "PUUUUU" ], [ 284884, "DSVRP" ], [ 286092, "QQQS" ], [ 287110, "RRPQV" ], [ 292251, "QQSV3" ], [ 293712, "FXSWhzQD" ], [ 303002, "LSVW" ], [ 312526, "Pjsh" ], [ 324832, "Wj j" ], [ 330203, "PWSV" ], [ 330397, "350RJ" ], [ 350304, "YYt SVW" ], [ 354208, "WVS3" ], [ 355482, "YSSSSS" ], [ 364042, "UVWS" ], [ 365300, "SUWV" ], [ 365347, "98uq" ], [ 366878, "YYPV" ], [ 378062, "50RJ" ], [ 378070, "54RJ" ], [ 380604, "54VJ" ], [ 380636, "50VJ" ], [ 380931, "RPSW" ], [ 392676, "E4PV" ], [ 397290, "HHtAHHt" ], [ 400802, "QWVP" ], [ 412216, "f95h" ], [ 412284, "PVVRV" ], [ 412399, ".VVVVVSRSSj" ], [ 418033, "tK\u003c_t\u003c\u003c$t8\u003c\u003ct4\u003c\u003et0\u003c-t,\u003ca|" ], [ 422604, "Ft)Nt\tNt@Nt NuM" ], [ 423698, "E4SP" ], [ 425695, "t.\u003c@t5V" ], [ 430078, "ELSP" ], [ 430255, "ETVP" ], [ 435214, "tm95" ], [ 435985, "UQPXY]Y[" ], [ 438535, "SSSSW" ], [ 439632, "WVU3" ], [ 445515, "E8PV" ], [ 447574, "EXPW" ], [ 456848, "AA8Y" ], [ 459596, "98tl" ], [ 462801, "Yu.j" ], [ 464887, "t 9u" ], [ 466777, "8VVVVV" ], [ 486134, "WWWWV" ], [ 486520, "u09u" ], [ 486840, "u99u" ], [ 531056, "Invalid DateTimeSpan" ], [ 531080, "Invalid DateTime" ], [ 531504, "CDibDoc" ], [ 532520, "CDibView" ], [ 533160, "CMainFrame" ], [ 533200, "LM8i$3v61gSvru1" ], [ 533708, "CInvalidArgException" ], [ 533732, "CNotSupportedException" ], [ 533756, "CMemoryException" ], [ 533776, "CException" ], [ 533984, "COleException" ], [ 534028, "CLSID" ], [ 534064, "DISPLAY" ], [ 534080, "CPalette" ], [ 534092, "CBitmap" ], [ 534124, "CGdiObject" ], [ 534136, "CPaintDC" ], [ 534148, "CWindowDC" ], [ 534160, "CClientDC" ], [ 534176, "CUserException" ], [ 534192, "CResourceException" ], [ 534576, "GetLayout" ], [ 534588, "GDI32.DLL" ], [ 534600, "SetLayout" ], [ 535260, "CDocument" ], [ 535408, "ReplaceFileA" ], [ 535424, "KERNEL32" ], [ 535556, "Exception thrown in destructor" ], [ 535588, "f:\\rtm\\vctools\\vc7libs\\ship\\atlmfc\\include\\afxwin2.inl" ], [ 535656, "CCmdTarget" ], [ 535940, "CFileException" ], [ 536148, "InProcServer32" ], [ 536164, "f:\\rtm\\vctools\\vc7libs\\ship\\atlmfc\\src\\mfc\\filecore.cpp" ], [ 536272, "DllGetClassObject" ], [ 536292, "CWinApp" ], [ 536300, "Recent File List" ], [ 536320, "File%d" ], [ 536328, "Settings" ], [ 536340, "PreviewPages" ], [ 536488, "DeactivateActCtx" ], [ 536508, "ActivateActCtx" ], [ 536524, "ReleaseActCtx" ], [ 536540, "CreateActCtxA" ], [ 536556, "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" ], [ 536624, "NoDrives" ], [ 536636, "RestrictRun" ], [ 536648, "NoNetConnectDisconnect" ], [ 536672, "NoRecentDocsHistory" ], [ 536692, "NoClose" ], [ 536700, "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network" ], [ 536760, "NoEntireNetwork" ], [ 536776, "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" ], [ 536836, "NoPlacesBar" ], [ 536848, "NoBackButton" ], [ 537072, "Automation" ], [ 537084, "Embedding" ], [ 537100, "Unregserver" ], [ 537112, "Unregister" ], [ 537124, "Regserver" ], [ 537136, "Register" ], [ 537156, "ntdll.dll" ], [ 537172, "Control Panel\\Desktop\\ResourceLocale" ], [ 537212, "GetSystemDefaultUILanguage" ], [ 537240, "GetUserDefaultUILanguage" ], [ 537268, "kernel32.dll" ], [ 537284, "%s.dll" ], [ 537312, "CWinThread" ], [ 537480, "system" ], [ 537504, "CMultiDocTemplate" ], [ 537700, "CMDIChildWnd" ], [ 537716, "CMDIFrameWnd" ], [ 538560, "mdiclient" ], [ 539240, "CDialog" ], [ 539632, "Edit" ], [ 539840, "MS Shell Dlg" ], [ 539884, "AfxControlBar80s" ], [ 539904, "AfxMDIFrame80s" ], [ 539920, "AfxFrameOrView80s" ], [ 539940, "AfxOleControl80s" ], [ 539960, "AfxOldWndProc423" ], [ 540016, "EnumDisplayDevicesA" ], [ 540036, "GetMonitorInfoA" ], [ 540052, "EnumDisplayMonitors" ], [ 540072, "MonitorFromPoint" ], [ 540092, "MonitorFromRect" ], [ 540108, "MonitorFromWindow" ], [ 540128, "GetSystemMetrics" ], [ 540148, "USER32" ], [ 540156, "wide", "accParent" ], [ 540176, "wide", "accChildCount" ], [ 540204, "wide", "accChild" ], [ 540224, "wide", "accName" ], [ 540240, "wide", "accValue" ], [ 540260, "wide", "accDescription" ], [ 540292, "wide", "accRole" ], [ 540308, "wide", "accState" ], [ 540328, "wide", "accHelp" ], [ 540344, "wide", "accHelpTopic" ], [ 540372, "wide", "accKeyboardShortcut" ], [ 540412, "wide", "accFocus" ], [ 540432, "wide", "accSelection" ], [ 540460, "wide", "accDefaultAction" ], [ 540496, "wide", "accSelect" ], [ 540516, "wide", "accLocation" ], [ 540540, "wide", "accNavigate" ] ], "sz": 786714, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1056.001", "c": 0.800000011920929, "d": "MapVirtualKey P/Invoke string reference", "e": [ "MapVirtualKeyA" ], "i": "micro-behaviors/hardware/input/keyboard::map-virtual-key-str", "l": 3, "m": "E1056.001" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Read data from clipboard", "e": [ "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::get-clipboard-data", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 150", "e": [ "ORDINAL 150" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-150", "l": 1, "m": "B0025" }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c0", "c0", "c0" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.7200000286102295, "d": "Write INI string value", "e": [ "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::write-private-profile-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 612.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "SetWindowRgn GDI function", "e": [ "SetWindowRgn" ], "i": "objectives/impact/ui/manipulation::set-window-rgn", "l": 1 }, { "c": 0.7400000095367432, "d": "Combine GDI regions", "e": [ "CombineRgn" ], "i": "micro-behaviors/ui/window/manage::combine-rgn", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 102400, entropy: 7.09)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.7400000095367432, "d": "Create rectangular GDI region", "e": [ "CreateRectRgn" ], "i": "micro-behaviors/ui/window/manage::create-rect-rgn", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.7799999713897705, "d": "Register custom clipboard format", "e": [ "RegisterClipboardFormatA" ], "i": "micro-behaviors/os/clipboard/access::register-clipboard-format-a", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 0.8999999761581421, "d": "RtlGenRandom export-ordinal alias (SystemFunction036)", "e": [ "SystemFunction036" ], "i": "micro-behaviors/os/random/generator::system-function-036", "l": 3 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.75, "d": "Find window by class/title (ANSI)", "e": [ "FindWindowA" ], "i": "micro-behaviors/ui/window/manage::find-window-a-import", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.949999988079071, "d": "Explorer policies registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" ], "i": "metadata/file/text::policies-explorer-path", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "© 1992 - 2001 Microsoft Corporation. All rights reserved." ], "i": "objectives/evasion/masquerade/dll/task-scheduler::microsoft-company-string", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Resolve COM class from ProgID", "e": [ "CLSIDFromProgID" ], "i": "micro-behaviors/os/com/object::clsid-from-progid", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 102400.00" ], "i": "well-known/malware/trojan/shellobject::xll-large-rsrc-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4e", "40", "40", "4e", "4e", "46", "40", "48", "41", "46", "41", "4e", "46", "4e", "46", "46" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.800000011920929, "d": "Query current foreground window", "e": [ "GetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::get-foreground-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.9300000071525574, "d": "Network policies registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network" ], "i": "metadata/file/text::policies-network-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1616.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "a": "T1112", "c": 0.949999988079071, "d": "Network and dialog restriction policy values", "e": [ "NoEntireNetwork", "NoPlacesBar", "NoBackButton" ], "i": "objectives/impact/degrade/windows-policy::network-dialog-restriction-value-cluster", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileA" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.75, "d": "Query active window title length", "e": [ "GetWindowTextLengthA" ], "i": "micro-behaviors/ui/window/manage::get-window-text-length", "l": 2 }, { "c": 0.800000011920929, "d": "CreateEllipticRgn GDI function", "e": [ "CreateEllipticRgn" ], "i": "objectives/impact/ui/manipulation::create-elliptic-rgn", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.DLL", "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "b4 16 48 00", "b4 16 48 00", "78 17 48 00", "78 17 48 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 1.0, "d": "Overrides WndProc method", "e": [ "AfxOldWndProc423" ], "i": "objectives/collection/clipboard/monitor::wndproc-override", "l": 1 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.8999999761581421, "d": "Mark object as OLE-contained", "e": [ "OleSetContainedObject" ], "i": "micro-behaviors/os/com/invoke::ole-set-contained-object", "l": 3 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query volume information", "e": [ "GetVolumeInformationA" ], "i": "micro-behaviors/fs/enumerate/volume::get-volume-info", "l": 3 }, { "c": 0.8500000238418579, "d": "MFC CCmdTarget class string", "e": [ "CCmdTarget" ], "i": "metadata/binary/framework::mfc-ccmdtarget", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.60)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "No error message is available.'An unsupported operation was attempted.$A required resource was unava...", "An unknown error has occurred.$An invalid argument was encountered." ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1112", "c": 0.9399999976158142, "d": "Multiple Explorer restriction policy values", "e": [ "NoDrives", "RestrictRun", "NoNetConnectDisconnect", "NoRecentDocsHistory", "NoClose" ], "i": "objectives/impact/degrade/windows-policy::explorer-restriction-value-cluster", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "d": "hide keyword", "e": [ "hide", "hide" ], "i": "micro-behaviors/data/text/keywords::hide", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload::find-resource-a", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 22 (shutdown)", "e": [ "ORDINAL 22" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-22", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1573031334.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "OleIsCurrentClipboard", "OleFlushClipboard", "…tion and puts it on the Clipboard", "RegisterClipboardFormatA", "OleGetClipboard", "GetClipboardData", "Insert Clipboard contents", "EmptyClipboard", "…tion and puts it on the Clipboard.Cut the selection and p…", "CloseClipboard", "OleSetClipboard", "OpenClipboard", "IsClipboardFormatAvailable", "SetClipboardData" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 612.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextA" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "c": 0.8399999737739563, "d": "ATL ForceRemove registry directive", "e": [ "ForceRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-forceremove-directive", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.11" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.7799999713897705, "d": "Apply shaped window region", "e": [ "SetWindowRgn" ], "i": "micro-behaviors/ui/window/manage::set-window-rgn", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 2 }, { "c": 0.8999999761581421, "d": "OleRun import (decoy triad)", "e": [ "OleRun" ], "i": "objectives/anti-static/obfuscation/imports::olerun-import", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.699999988079071, "d": "Get message cursor position", "e": [ "GetMessagePos" ], "i": "micro-behaviors/ui/window/manage::get-message-pos", "l": 2 }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform::amsi-memory-patch-hex-bytes", "l": 1 }, { "c": 0.8500000238418579, "d": "Get message (ANSI)", "e": [ "GetMessageA" ], "i": "micro-behaviors/os/message/queue::get-message-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.9300000071525574, "d": "Common dialog policies registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" ], "i": "metadata/file/text::policies-comdlg32-path", "l": 2 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1291.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-a-symbol", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster GetActiveWindow", "e": [ "GetActiveWindow" ], "i": "metadata/binary/symbols::gui-import-cluster-getactivewindow", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "COM Both threading model", "e": [ "Both" ], "i": "objectives/persistence/system/registry/com::threadingmodel-both-word", "l": 1 }, { "c": 1.0, "d": "Microsoft Corporation in resource section", "e": [ "© 1992 - 2001 Microsoft Corporation. All rights reserved." ], "i": "well-known/malware/trojan/loader-s047t5g::microsoft-corp-resource", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1140", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "© 1992 - 2001 Microsoft Corporation. All rights reserved." ], "i": "objectives/command-and-control/dropper/staging::microsoft-company-string", "l": 1, "m": "B0023" }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 23 (socket)", "e": [ "ORDINAL 23" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-23", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "c": 0.8500000238418579, "d": "LocalServer32 registry word", "e": [ "LocalServer32" ], "i": "objectives/persistence/system/registry/com::localserver32-word", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.22" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.9700000286102295, "d": "VirLock GUI noise import pair", "e": [ "UnpackDDElParam" ], "i": "well-known/malware/virus/virlock::gui-noise-imports", "l": 1 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassA" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "MFC CDialog class string", "e": [ "CDialog" ], "i": "metadata/binary/framework::mfc-cdialog", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll virtual key state", "e": [ "GetKeyState" ], "i": "micro-behaviors/hardware/input/keyboard::get-key-state", "l": 2, "m": "E1056.001" }, { "c": 0.8999999761581421, "d": "Local memory reallocation", "e": [ "LocalReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-realloc", "l": 2 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "c": 0.8399999737739563, "d": "ATL NoRemove registry directive", "e": [ "NoRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-noremove-directive", "l": 1 }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 7.09" ], "i": "well-known/malware/trojan/shellobject::xll-high-rsrc-entropy", "l": 1 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyA" ], "i": "micro-behaviors/os/registry/access::reg-create-key-a", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1559.001", "c": 0.8799999952316284, "d": "Create OLE object from file on disk", "e": [ "OleCreateFromFile" ], "i": "micro-behaviors/os/com/invoke::ole-create-from-file", "l": 3 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 0.00" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 2 }, { "c": 0.8500000238418579, "d": "Windows spooler library dependency", "e": [ "WINSPOOL.DRV" ], "i": "micro-behaviors/os/service/export::winspool-drv-dependency", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1291.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "OleSaveToStream", "MoveToEx" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 786714.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "GetAtomNameA API for atom retrieval", "e": [ "GetAtomNameA" ], "i": "objectives/evasion/process/injection/atom-bombing::getatomnama-api", "l": 1, "m": "C0041" }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 16384)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "String claiming to be Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/identity/vendor::microsoft-corporation-string", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 16 (recv)", "e": [ "ORDINAL 16" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-16", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "VVVVPUVV", "SECURITY", "COMBOBOX", "SCROLLBAR" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.67" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 102400.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Map virtual key code", "e": [ "MapVirtualKeyA" ], "i": "micro-behaviors/hardware/input/keyboard::map-virtual-key", "l": 2, "m": "E1056.001" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.6499999761581421, "d": "Repeated NOP-run pattern in executable section", "e": [ "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90", "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90", "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90", "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90" ], "i": "metadata/binary/section/content::nop-sled-in-data", "l": 3 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 19 (send)", "e": [ "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-19", "l": 1 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "MFC CWinApp class string", "e": [ "CWinApp" ], "i": "metadata/binary/framework::mfc-cwinapp", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 786714.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 14653.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "a": "T1573", "d": "RC4 encryption strings", "e": [ "RC4 for x86, CRYPT" ], "i": "micro-behaviors/crypto/symmetric/stream::rc4-strings", "l": 3, "m": "C0027" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 15", "e": [ "ORDINAL 15" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-15", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "CRYPTOGAMS OpenSSL support marker", "e": [ "RC4 for x86, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], "i": "micro-behaviors/crypto/library::cryptogams-marker", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1616.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 27", "e": [ "ORDINAL 27" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-27", "l": 1, "m": "B0025" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 612.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.75, "d": "Get window device context", "e": [ "GetWindowDC" ], "i": "micro-behaviors/ui/window/manage::get-window-dc", "l": 2 }, { "c": 0.8500000238418579, "d": "MFC Afx window class strings", "e": [ "AfxControlBar", "AfxMDIFrame", "AfxFrameOrView", "AfxOleControl" ], "i": "metadata/binary/framework::mfc-afx-window-classes", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to thread (ANSI)", "e": [ "PostThreadMessageA" ], "i": "micro-behaviors/os/message/queue::post-thread-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1291.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.7599999904632568, "d": "Convert GUID to string", "e": [ "StringFromGUID2" ], "i": "micro-behaviors/os/com/invoke::string-from-guid2", "l": 2 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform::ntdll-dll-str", "l": 1 }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableA", "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1616.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll mouse cursor position", "e": [ "GetCursorPos" ], "i": "micro-behaviors/hardware/input/keyboard::get-cursor-pos", "l": 2, "m": "E1056.001" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "8c 14 48 00", "ec 11 48 00", "f0 13 48 00", "f0 13 48 00", "dc 13 48 00", "c4 13 48 00", "b4 13 48 00", "8c 13 48 00", "74 11 48 00", "8c 14 48 00", "38 13 48 00", "1c 14 48 00", "dc 13 48 00", "1c 14 48 00", "08 15 48 00", "08 15 48 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Remove Windows input hook", "e": [ "UnhookWindowsHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::unhook-windows-hook", "l": 3, "m": "E1056.001" }, { "a": "T1071", "c": 1.0, "d": "CombineRgn import", "e": [ "CombineRgn" ], "i": "objectives/command-and-control/backdoor/binary::combine-region-import", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemDefaultUILanguage", "GetUserDefaultUILanguage", "InitCommonControlsEx", "SetThreadStackGuarantee", "InitializeCriticalSectionAndSpinCount", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetProcessWindowStation", "GetUserObjectInformationA", "CreateStdAccessibleObject", "AccessibleObjectFromWindow", "MultiByteToWideChar", "WideCharToMultiByte", "GetEnvironmentVariableA", "GetEnvironmentVariableW", "GetVolumeInformationA" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.75, "d": "DJB2 hash algorithm constant (5381)", "e": [ "05 15 00 00" ], "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-getpixel", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.8999999761581421, "d": "SuspendThread API reference", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime::suspend-thread", "l": 3 }, { "c": 0.800000011920929, "d": "Randomized or high-entropy export name", "e": [ "Xadsvbghtddsczxds" ], "i": "objectives/evasion/masquerade::suspicious-garbage-export", "l": 4 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.09)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 2, "m": "C0027" }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextA" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1056.001", "c": 0.800000011920929, "d": "Forward events in Windows hook chain", "e": [ "CallNextHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::call-next-hook-ex", "l": 3, "m": "E1056.001" }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1291.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowEnabled", "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "a": "T1055.012", "c": 0.6000000238418579, "d": "ResumeThread call", "e": [ "ResumeThread" ], "i": "objectives/evasion/process/injection/hollowing::resume-thread", "l": 1, "m": "E1055.012" }, { "c": 0.8500000238418579, "d": ".NET Clipboard class reference (WinForms)", "e": [ "Clipboard", "Clipboard" ], "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "l": 3 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Long NOP sled byte sequence", "e": [ "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90", "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90" ], "i": "objectives/anti-analysis/self-modify/runtime::nop-sled", "l": 2 }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1291.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "CreateRectRgn/PolygonRgn/RoundRectRgn import", "e": [ "CreateRectRgn" ], "i": "objectives/command-and-control/backdoor/binary::create-region-import", "l": 1, "m": "B0025" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Delete registry key via import", "e": [ "RegDeleteKeyA" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-key-a-symbol", "l": 3 }, { "a": "T1056.001", "c": 0.8999999761581421, "d": "Install global Windows input hook", "e": [ "SetWindowsHookExA" ], "i": "micro-behaviors/hardware/input/keyboard::set-windows-hook", "l": 3, "m": "E1056.001" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1291.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetFileInfoA, DragFinish, DragQueryFileA, ExtractIconA, DragAcceptFiles)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetStdHandle, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, ... +160 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (OleGetIconOfClass, CreateItemMoniker, CreateGenericComposite, OleIsRunning, GetRunningObjectTable, ... +65 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (PostThreadMessageA, GetTabbedTextExtentA, WindowFromPoint, GetKeyNameTextA, MapVirtualKeyA, ... +189 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comdlg32.dll (GetFileTitleA)", "e": [ "comdlg32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (ScaleWindowExtEx, GetCurrentPositionEx, ArcTo, PolyDraw, PolylineTo, ... +108 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINSPOOL.DRV (ClosePrinter, DocumentPropertiesA, OpenPrinterA, GetJobA)", "e": [ "WINSPOOL.DRV" ], "i": "metadata/dylib::winspool/drv", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegDeleteValueA, RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegEnumKeyA, ... +10 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathIsUNCA, PathFindExtensionA, PathRemoveExtensionA, PathStripToRootA, PathFindFileNameA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links oledlg.dll (ORDINAL 8)", "e": [ "oledlg.dll" ], "i": "metadata/dylib::oledlg/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 7, ORDINAL 161, ORDINAL 2, ORDINAL 114, ORDINAL 104, ... +34 more)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "MFC application framework metadata", "e": [ "AfxOleControl", "CDialog", "CWinApp", "CCmdTarget", "AfxControlBar", "AfxMDIFrame", "AfxFrameOrView" ], "i": "metadata/binary/framework::mfc-application-framework", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 612.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1497", "c": 0.8999999761581421, "d": "Input and foreground window check for sandbox evasion", "e": [ "GetKeyState", "GetForegroundWindow" ], "i": "objectives/anti-analysis/sandbox-detect/input::input-foreground-sandbox-gate", "l": 4 }, { "c": 0.8199999928474426, "d": "Reads and writes INI via ANSI", "e": [ "GetPrivateProfileStringA", "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle-ansi", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoA", "GetUserDefaultLCID", "GetLocaleInfoW", "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "Window text and GDI cluster", "e": [ "GetWindowRect", "CreateCompatibleDC", "IsWindowVisible", "GetWindowTextA", "CreateRectRgn", "GetWindow", "CreateCompatibleBitmap", "IsWindowEnabled", "CombineRgn" ], "i": "objectives/command-and-control/backdoor/binary::shellobject-window-gdi-cluster", "l": 1, "m": "B0025" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetModuleFileNameA", "GetFileSize", "CreateFileA", "ReadFile" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1115", "c": 0.800000011920929, "d": "Clipboard read and write APIs", "e": [ "GetClipboardData", "SetClipboardData" ], "i": "objectives/credential-access/clipboard/crypto::clipboard-rw", "l": 1, "m": "E1510" }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "BitBlt", "GetDC", "GetWindowDC", "GetDesktopWindow", "CreateCompatibleBitmap", "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 2, "m": "C0014" }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "PeekMessageA", "CreateThread" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Windows hook install and chain-management APIs", "e": [ "UnhookWindowsHookEx", "CallNextHookEx", "SetWindowsHookExA" ], "i": "micro-behaviors/hardware/input/keyboard::windows-hook-lifecycle", "l": 2, "m": "E1056.001" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.8600000143051147, "d": "Shape window with GDI regions", "e": [ "CreateRectRgn", "SetWindowRgn", "CombineRgn" ], "i": "micro-behaviors/ui/window/manage::window-region-shaping", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceA", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameW", "DeleteFileA", "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA", "RegOpenKeyA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyA", "RegOpenKeyA", "RegCreateKeyExA", "RegOpenKeyExA", "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "FindResourceA", "SizeofResource", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 1 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "GetWindowTextA", "CreateCompatibleBitmap", "GetForegroundWindow", "GetWindowTextLengthA", "GetDC", "GetDesktopWindow", "BitBlt", "CreateCompatibleDC", "GetWindowDC" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegOpenKeyExA", "RegSetValueExA", "RegOpenKeyA", "RegOpenKeyExA", "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1497.003", "c": 0.9100000262260437, "d": "Timer-gated key polling anti-analysis", "e": [ "SetTimer", "GetKeyState", "GetProcAddress", "KillTimer", "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-analysis/timing/evasion::ui-timer-keypoll-gate", "l": 2, "m": "B0003.003" }, { "a": "T1497.001", "c": 0.8799999952316284, "d": "User-interaction trigger APIs (mouse/keyboard/window monitoring)", "e": [ "GetKeyState", "GetForegroundWindow", "GetCursorPos" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::user-interaction-trigger-cluster", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetEnvironmentStringsW", "GetUserDefaultLCID", "GetLocaleInfoW", "GetLocaleInfoA", "EnumSystemLocalesA", "FreeEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetSystemMetrics", "GetDiskFreeSpaceA", "GetTickCount", "GetSystemInfo" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "OleFlushClipboard", "SetClipboardData", "…tion and puts it on the Clipboard", "OleGetClipboard", "GetClipboardData", "CloseClipboard", "…tion and puts it on the Clipboard.Cut the selection and p…", "SetClipboardData", "Insert Clipboard contents", "OleIsCurrentClipboard", "IsClipboardFormatAvailable", "EmptyClipboard", "RegisterClipboardFormatA", "OleSetClipboard", "GetClipboardData", "OpenClipboard" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetUserDefaultLCID", "GetCommandLineA", "FreeEnvironmentStringsW", "GetLocaleInfoA", "GetEnvironmentStringsW", "EnumSystemLocalesA", "GetLocaleInfoW", "GetSystemTimeAsFileTime" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 2, "m": "E1082" }, { "a": "T1112", "c": 0.9599999785423279, "d": "Writes multiple Explorer restriction policies", "e": [ "NoPlacesBar", "NoBackButton", "RestrictRun", "RegCreateKeyExA", "RegOpenKeyExA", "RegOpenKeyA", "RegSetValueExA", "NoNetConnectDisconnect", "RegOpenKeyExA", "NoClose", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32", "NoRecentDocsHistory", "NoEntireNetwork", "NoDrives", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network" ], "i": "objectives/impact/degrade/windows-policy::explorer-policy-lockdown", "l": 4 }, { "a": "T1112", "c": 0.9800000190734863, "d": "Locks Explorer network and dialog policies", "e": [ "RegOpenKeyExA", "NoPlacesBar", "NoBackButton", "NoNetConnectDisconnect", "NoDrives", "RestrictRun", "NoEntireNetwork", "RegOpenKeyA", "NoRecentDocsHistory", "RegCreateKeyExA", "RegOpenKeyExA", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network", "NoClose", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32", "RegSetValueExA" ], "i": "objectives/impact/degrade/windows-policy::explorer-network-dialog-policy-lockdown", "l": 4 } ], "sha": "d95c7c60ea9e9135e0a4950b643eed815341b92d731f477bc572085fbf0eafd7", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/527355", "type": "pe" } ], "tv": "2a0fe" } }