{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.9812265, "class": 0 }, { "m": "az/pe", "prob": 0.5413534, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T05:56:45Z" }, "path": "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 5, "ff": { "i": [ [ "msvbvm60", "vbaVarTstGt" ], [ "msvbvm60", "vbaVarSub" ], [ "msvbvm60", "vbaStrI2" ], [ "msvbvm60", "CIcos" ], [ "msvbvm60", "adj_fptan" ], [ "msvbvm60", "vbaVarMove" ], [ "msvbvm60", "vbaAryMove" ], [ "msvbvm60", "vbaFreeVar" ], [ "msvbvm60", "vbaStrVarMove" ], [ "msvbvm60", "vbaLenBstr" ], [ "msvbvm60", "vbaEnd" ], [ "msvbvm60", "vbaFreeVarList" ], [ "msvbvm60", "adj_fdiv_m64" ], [ "msvbvm60", "vbaFreeObjList" ], [ "msvbvm60", "adj_fprem1" ], [ "msvbvm60", "vbaStrCat" ], [ "msvbvm60", "vbaSetSystemError" ], [ "msvbvm60", "vbaHresultCheckObj" ], [ "msvbvm60", "adj_fdiv_m32" ], [ "msvbvm60", "vbaAryVar" ], [ "msvbvm60", "vbaAryDestruct" ], [ "msvbvm60", "ORDINAL 592" ], [ "msvbvm60", "ORDINAL 593" ], [ "msvbvm60", "vbaVarForInit" ], [ "msvbvm60", "vbaObjSet" ], [ "msvbvm60", "adj_fdiv_m16i" ], [ "msvbvm60", "vbaObjSetAddref" ], [ "msvbvm60", "adj_fdivr_m16i" ], [ "msvbvm60", "ORDINAL 598" ], [ "msvbvm60", "vbaVarTstLt" ], [ "msvbvm60", "CIsin" ], [ "msvbvm60", "vbaErase" ], [ "msvbvm60", "vbaChkstk" ], [ "msvbvm60", "vbaFileClose" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "vbaGet3" ], [ "msvbvm60", "vbaVarTstEq" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "adj_fpatan" ], [ "msvbvm60", "vbaR4Var" ], [ "msvbvm60", "vbaRedim" ], [ "msvbvm60", "vbaUI1ErrVar" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "CIsqrt" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaStr2Vec" ], [ "msvbvm60", "vbaVarMul" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 711" ], [ "msvbvm60", "vbaStrToUnicode" ], [ "msvbvm60", "ORDINAL 713" ], [ "msvbvm60", "adj_fprem" ], [ "msvbvm60", "adj_fdivr_m64" ], [ "msvbvm60", "ORDINAL 607" ], [ "msvbvm60", "vbaFPException" ], [ "msvbvm60", "ORDINAL 717" ], [ "msvbvm60", "vbaUbound" ], [ "msvbvm60", "vbaVarCat" ], [ "msvbvm60", "ORDINAL 537" ], [ "msvbvm60", "ORDINAL 644" ], [ "msvbvm60", "CIlog" ], [ "msvbvm60", "vbaFileOpen" ], [ "msvbvm60", "vbaNew2" ], [ "msvbvm60", "ORDINAL 648" ], [ "msvbvm60", "vbaVar2Vec" ], [ "msvbvm60", "adj_fdiv_m32i" ], [ "msvbvm60", "adj_fdivr_m32i" ], [ "msvbvm60", "vbaStrCopy" ], [ "msvbvm60", "ORDINAL 573" ], [ "msvbvm60", "vbaI4Str" ], [ "msvbvm60", "vbaFreeStrList" ], [ "msvbvm60", "adj_fdivr_m32" ], [ "msvbvm60", "adj_fdiv_r" ], [ "msvbvm60", "ORDINAL 578" ], [ "msvbvm60", "ORDINAL 685" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "vbaI4Var" ], [ "msvbvm60", "vbaVarAdd" ], [ "msvbvm60", "vbaAryLock" ], [ "msvbvm60", "vbaStrToAnsi" ], [ "msvbvm60", "vbaVarDup" ], [ "msvbvm60", "CIatan" ], [ "msvbvm60", "vbaStrMove" ], [ "msvbvm60", "vbaAryCopy" ], [ "msvbvm60", "vbaStrVarCopy" ], [ "msvbvm60", "allmul" ], [ "msvbvm60", "CItan" ], [ "msvbvm60", "vbaAryUnlock" ], [ "msvbvm60", "vbaVarForNext" ], [ "msvbvm60", "CIexp" ], [ "msvbvm60", "vbaFreeStr" ], [ "msvbvm60", "vbaFreeObj" ] ], "m": { "pe": { "checksum": 2104373.0, "icon_count": 2.0, "checksum_valid": 1.0, "resource_count": 5.0, "computed_checksum": 2104373.0, "bound_import_count": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 2213238563.0 }, "file": { "size": 2093056.0, "entropy": 3.86, "size_bytes": 2093056.0 }, "binary": { "is_pie": 0.0, "code_entropy": 3.7, "data_entropy": 0.0, "string_count": 492.0, "entropy_variance": 6.47, "avg_string_length": 7.98, "max_string_length": 95.0, "code_to_data_ratio": 1.0, "string_length_stddev": 7.87, "largest_section_ratio": 0.96, "sentence_string_count": 2.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 92.0 }, "sections": { "count": 3.0, "code_size": 2019328.0, "entropy_max": 6.19, "entropy_mean": 3.3, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 168, "u8", "Rich" ], [ 448, "u8", ".text" ], [ 528, "u8", ".rsrc" ], [ 584, "u8", "MSVBVM60.DLL" ], [ 5548, "u8", "Colorful" ], [ 5696, "u8", "frmSplash" ], [ 5717, "u8", "Form2" ], [ 5763, "u8", "Frame1" ], [ 5792, "u8", "imgLogo" ], [ 6600, "u8", "lblCopyright" ], [ 6617, "u8", "Copyright" ], [ 6651, "u8", "Arial" ], [ 6665, "u8", "lblCompany" ], [ 6680, "u8", "Company" ], [ 6726, "u8", "lblWarning" ], [ 6741, "u8", "Warning" ], [ 6787, "u8", "lblVersion" ], [ 6802, "u8", "Version" ], [ 6852, "u8", "lblPlatform" ], [ 6868, "u8", "Platform" ], [ 6919, "u8", "lblProductName" ], [ 6938, "u8", "Product" ], [ 6986, "u8", "lblLicenseTo" ], [ 7003, "u8", "LicenseTo" ], [ 7053, "u8", "lblCompanyProduct" ], [ 7075, "u8", "CompanyProduct" ], [ 7131, "u8", "Image1" ], [ 845920, "u8", ".Colorful" ], [ 846424, "u8", "wmp.dll" ], [ 846432, "u8", "WMPLibCtl.WindowsMediaPlayer" ], [ 846461, "u8", "WindowsMediaPlayer" ], [ 849496, "u8", "Module1" ], [ 849504, "u8", "Module2" ], [ 849512, "u8", "clsComplexDataConsumer" ], [ 849652, "u8", "UserControl" ], [ 849680, "u8", "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 849800, "u8", "WindowsMediaPlayer1" ], [ 849836, "u8", "WMPLibCtl" ], [ 849888, "u8", "Color" ], [ 849924, "u8", "VBA6.DLL" ], [ 849936, "u8", "__vbaFreeVar" ], [ 849952, "u8", "__vbaFreeVarList" ], [ 850008, "u8", "__vbaUI1ErrVar" ], [ 850048, "u8", "__vbaVarMove" ], [ 850064, "u8", "__vbaFreeObj" ], [ 850080, "u8", "__vbaHresultCheckObj" ], [ 850120, "u8", "uSeR32" ], [ 850132, "u8", "CallWindowProcA" ], [ 850204, "u8", "kernel32" ], [ 850220, "u8", "MulDiv" ], [ 850308, "u8", "__vbaSetSystemError" ], [ 850328, "u8", "__vbaAryUnlock" ], [ 850344, "u8", "__vbaAryLock" ], [ 850396, "u8", "__vbaAryCopy" ], [ 850412, "u8", "__vbaVarForNext" ], [ 850428, "u8", "__vbaFreeStr" ], [ 850460, "u8", "__vbaFreeStrList" ], [ 850492, "u8", "__vbaLenBstr" ], [ 850508, "u8", "__vbaVarForInit" ], [ 850524, "u8", "__vbaAryDestruct" ], [ 850544, "u8", "__vbaEnd" ], [ 850556, "u8", "__vbaStrVarCopy" ], [ 850572, "u8", "__vbaStrMove" ], [ 850600, "u8", "__vbaRedim" ], [ 850624, "u8", "__vbaVarTstGt" ], [ 850640, "u8", "Class" ], [ 850648, "u8", "__vbaVarTstLt" ], [ 850664, "u8", "__vbaVarTstEq" ], [ 850680, "u8", "__vbaUbound" ], [ 850692, "u8", "__vbaStr2Vec" ], [ 850708, "u8", "__vbaAryMove" ], [ 850736, "u8", "__vbaStrCopy" ], [ 850752, "u8", "__vbaStrVarMove" ], [ 850768, "u8", "__vbaErase" ], [ 850780, "u8", "__vbaVar2Vec" ], [ 850876, "u8", "C:\\Windows\\SysWow64\\Msvbvm60.dll\\3" ], [ 850912, "u8", "VBRUN" ], [ 850980, "u8", "GetModuleFileNameA" ], [ 851092, "u8", "HqgK2TAeh" ], [ 851116, "u8", "__vbaStrToUnicode" ], [ 851136, "u8", "__vbaStrToAnsi" ], [ 851164, "u8", "__vbaFileClose" ], [ 851192, "u8", "__vbaFileOpen" ], [ 851352, "u8", "Form" ], [ 851536, "wide", "Version" ], [ 851596, "u8", "__vbaFreeObjList" ], [ 851616, "u8", "__vbaObjSetAddref" ], [ 852042, "u8", "Shape1" ], [ 2020758, "u8", "_adj_fptan" ], [ 2020886, "u8", "_adj_fdiv_m64" ], [ 2020922, "u8", "_adj_fprem1" ], [ 2020996, "u8", "_adj_fdiv_m32" ], [ 2021078, "u8", "_adj_fdiv_m16i" ], [ 2021116, "u8", "_adj_fdivr_m16i" ], [ 2021174, "u8", "__vbaChkstk" ], [ 2021206, "u8", "EVENT_SINK_AddRef" ], [ 2021254, "u8", "DllFunctionCall" ], [ 2021272, "u8", "_adj_fpatan" ], [ 2021332, "u8", "EVENT_SINK_Release" ], [ 2021354, "u8", "_CIsqrt" ], [ 2021364, "u8", "EVENT_SINK_QueryInterface" ], [ 2021422, "u8", "__vbaExceptHandler" ], [ 2021464, "u8", "_adj_fprem" ], [ 2021478, "u8", "_adj_fdivr_m64" ], [ 2021496, "u8", "__vbaFPException" ], [ 2021598, "u8", "_adj_fdiv_m32i" ], [ 2021616, "u8", "_adj_fdivr_m32i" ], [ 2021684, "u8", "_adj_fdivr_m32" ], [ 2021702, "u8", "_adj_fdiv_r" ], [ 2021792, "u8", "_CIatan" ], [ 2021852, "u8", "_allmul" ], [ 2043774, "u8", "EBBCDGHmorrrrrrrrrrrrrrrrrrqppnnnnqq" ], [ 2045067, "u8", "Qsdcccbfdfdc``cdddQOOOQbQbQOOO`QQQ`OOOKd" ], [ 2045265, "u8", "aZXXY" ], [ 2045307, "u8", "P|heetz~~ztehhz~~zheehuzuecOOcafh\\" ], [ 2046898, "u8", "vNNNNNNNNLGGGGGGGGGGGGGGGGg" ], [ 2047026, "u8", "M\u003cRZYXHGGGHKG;GGC966;96..6J" ], [ 2047858, "u8", "nnnnrynnprypnnnnkabakan" ], [ 2049185, "u8", "|9JK\u003e;;;=\u003c\u003c\u003c\u003c*****$*+" ], [ 2049210, "u8", "jSicgnpppnppnpnpnpnY" ], [ 2049237, "u8", "kgnpppppppppppppY" ], [ 2049258, "u8", "ldfehoqrrrrrrqqooooZ" ], [ 2049297, "u8", "ssssT" ], [ 2049513, "u8", "ssssX" ], [ 2049536, "u8", "sssssX" ], [ 2049593, "u8", "z4EE14E?\u0026\u0026?\u0026" ], [ 2049641, "u8", "z7ONF7PNF7PN\u0026\u0026N?" ], [ 2050883, "u8", "@?\u003eAIIIIIIH" ], [ 2050899, "u8", "!4i\"CCCCCCB" ], [ 2050915, "u8", "FgPELLLIIJG" ], [ 2050947, "u8", "OTUadedaZOM" ], [ 2050963, "u8", "OU^aefea_RM" ], [ 2050979, "u8", "OU`adeda_NN" ], [ 2050995, "u8", "OU[`aaa^TNM" ], [ 2051011, "u8", "OOU[`^ZTNMM" ], [ 2051027, "u8", "OOOTUUURMMM" ], [ 2051179, "u8", "IHDR" ], [ 2051226, "u8", "IDATx" ], [ 2051365, "u8", "[k}k" ], [ 2052787, "u8", "NNNz7n" ], [ 2056847, "u8", "qzXv" ], [ 2059430, "u8", "IDAT" ], [ 2059635, "u8", "jQdh" ], [ 2062595, "u8", "U_S=" ], [ 2063209, "u8", "jI.h" ], [ 2063228, "u8", "cVcun" ], [ 2066312, "u8", "tjuklKf" ], [ 2067316, "u8", "5BPI" ], [ 2072033, "u8", "IEND" ], [ 2080242, "u8", "ptIrW" ], [ 2080274, "u8", "otHqU" ], [ 2088019, "u8", "tRxc" ], [ 2089528, "wide", "sudo" ] ], "v": { "file.stem": "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd", "pe.imphash": "6ccdf2d6237cffcf045051d0dffb96c9", "pe.machine": "i386", "pe.rich.key": 2309593625, "pe.rich.hash": "4b4293436909365b5e47e83b7c138034", "pe.subsystem": "windows_gui", "pe.timestamp": 1675875371, "file.basename": "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe", "pe.image_base": 4194304, "pe.image_size": 2097152, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 5400, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "aa65a7fc5177b49d9ea335df58c9003cb27ff4ef", "pe.image_hash.sha256": "281c1a97c45537f27c034d36c94fb62e88cc805f2f593a019b7b104dfeaeaf45", "pe.image_hash.sha384": "cd27791acc36dd8b246d7358cb62e6bdf429c8fcd751c92c9b12f92805851cc23423c1504633c3207ffcd55d5ffab512", "pe.image_hash.sha512": "94bed9b02733ff3083708fe7bda7327a41da87e37209726814b09fe01d242c538a9beb2725348baae219be05de9af34430185769854ac41a1e4a1b633aff76be", "pe.resource_types[0]": "RT_CURSOR", "pe.resource_types[1]": "RT_ICON", "pe.resource_types[2]": "RT_STRING", "pe.resource_types[3]": "RT_GROUP_CURSOR", "pe.resource_types[4]": "RT_GROUP_ICON", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.resource_timestamp": 1675875371, "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 2020276, "pe.data_directories[1].rva": 2031616, "pe.data_directories[2].rva": 568, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 62584, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 372, "pe.rich.entries[0].build_id": 14, "pe.rich.entries[1].build_id": 9, "pe.rich.entries[2].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 5, "pe.rich.entries[2].use_count": 1, "pe.coff.dos_header_pe_pointer": 200, "pe.rich.entries[0].product_id": 7299, "pe.rich.entries[1].product_id": 8041, "pe.rich.entries[2].product_id": 8169, "pe.bound_imports[0].time_date_stamp": 1588127676 }, "id": "pe", "sc": [ [ ".text", 4096, 2019328, 3.7, "r-x" ], [ ".data", 2023424, 4096, 0.0, "rw-" ], [ ".rsrc", 2027520, 65536, 6.19, "r--" ] ] }, "id": 0, "sz": 2093056, "ts": [ { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\ directory path", "e": [ "C:\\Windows\\SysWow64\\Msvbvm60" ], "i": "micro-behaviors/fs/path/system::windows-root", "l": 2, "m": "E1083", "el": [ "0xcfbbc" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x19d9" ] }, { "a": "T1546.015", "c": 0.949999988079071, "d": "Executable path in TypeLib redirection", "e": [ "C:\\Windows\\SysWow64\\Msvbvm60.dll" ], "i": "objectives/persistence/system/registry/com-hijack::typelib-executable-path", "l": 1, "el": [ "0xcfbbc" ] }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 65536, entropy: 6.19)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xcea58" ] }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0x1f4c6b" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x248" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_CURSOR, RT_ICON, RT_STRING, RT_GROUP_CURSOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x1ed786" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 1.0, "d": "PE has RT_CURSOR in resources list", "e": [ "[RT_CURSOR, RT_ICON, RT_STRING, RT_GROUP_CURSOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-cursor-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 492.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x1ed82e" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1588127676,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "d": "Windows directory path reference", "e": [ "C:\\Windows" ], "i": "micro-behaviors/fs/path/system::windows-dir", "l": 2, "el": [ "0xcfbbc" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x1094" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0xcf710" ] }, { "c": 0.9300000071525574, "d": "VB6 runtime file open helper", "e": [ "vbaFileOpen" ], "i": "micro-behaviors/fs/file/write/direct::vb6-file-open", "l": 2, "el": [ "0x10f4" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 92.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "VB6 __vbaVarCat string concatenation", "e": [ "vbaVarCat" ], "i": "micro-behaviors/data/string/runtime::vb6-string-construction-cat", "l": 1, "m": "B0032", "el": [ "0x10e4" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2, "el": [ "0xcfc24" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_CURSOR, RT_ICON, RT_STRING, RT_GROUP_CURSOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcA" ], "i": "micro-behaviors/ui/window/manage/control::call-window-proc", "l": 2, "el": [ "0xcf8d4" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x1888" ] }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0xce583" ] }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xcfc24" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 92.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (vbaVarTstGt, vbaVarSub, vbaStrI2, CIcos, adj_fptan, ... +87 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "92 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "MSVBVM60.DLL", "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x248", "0x1ed786" ] } ], "sha": "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd", "path": "da9a4f5abf8cc76df307abd21d9d60e1479aa19d5b1cf7da3b0bc40fc7d738fd.exe", "type": "pe" } ], "tv": "52045" } }