{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.4260355, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-30T17:27:39Z" }, "path": "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 3333373.0, "checksum_valid": 1.0, "computed_checksum": 3333373.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 3310176.0, "entropy": 5.08, "size_bytes": 3310176.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.07, "overlay_size": 6240.0, "string_count": 10233.0, "overlay_ratio": 0.0, "overlay_entropy": 7.52, "entropy_variance": 6.18, "avg_string_length": 6.21, "max_string_length": 7182.0, "code_to_data_ratio": 1.0, "string_length_stddev": 73.48, "largest_section_ratio": 1.0, "sentence_string_count": 8.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 3302912.0, "entropy_max": 5.07, "entropy_mean": 2.59, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 234935, "u8", "% sh" ], [ 3253973, "u8", "pr62" ], [ 3271640, "u8", "BSJB" ], [ 3275092, "u8", "IEnumerable`1" ], [ 3275106, "u8", "ICollection`1" ], [ 3275120, "u8", "IEnumerator`1" ], [ 3275142, "u8", "Int32" ], [ 3275148, "u8", "Int64" ], [ 3275154, "u8", "Int16" ], [ 3275160, "u8", "\u003cModule\u003e" ], [ 3275169, "u8", "Microsoft.VisualStudio.VIL" ], [ 3275196, "u8", "CreateVM" ], [ 3275205, "u8", "System.IO" ], [ 3275215, "u8", "GetPrimitiveTypeFromTypeX" ], [ 3275241, "u8", "GetTypeX" ], [ 3275250, "u8", "CustomAttributeData" ], [ 3275270, "u8", "GetCustomAttributesData" ], [ 3275294, "u8", "Microsoft.VisualStudio.Debugger.Metadata" ], [ 3275335, "u8", "mscorlib" ], [ 3275344, "u8", "Eecbbeaadbdfedaffdadcfcc" ], [ 3275369, "u8", "get_IsPublic" ], [ 3275382, "u8", "System.Collections.Generic" ], [ 3275409, "u8", "get_IsStatic" ], [ 3275422, "u8", "Thread" ], [ 3275429, "u8", "Load" ], [ 3275438, "u8", "Guid" ], [ 3275443, "u8", "GetField" ], [ 3275452, "u8", "SetField" ], [ 3275461, "u8", "get_Build" ], [ 3275471, "u8", "Append" ], [ 3275478, "u8", "LayoutKind" ], [ 3275489, "u8", "get_IsGenericMethod" ], [ 3275509, "u8", "ExecuteMethod" ], [ 3275523, "u8", "GetGetMethod" ], [ 3275536, "u8", "GetSetMethod" ], [ 3275549, "u8", "get_IsInterface" ], [ 3275565, "u8", "Replace" ], [ 3275573, "u8", "get_Namespace" ], [ 3275587, "u8", "CreateNullReference" ], [ 3275607, "u8", "TypeCode" ], [ 3275616, "u8", "AddRange" ], [ 3275625, "u8", "Invoke" ], [ 3275632, "u8", "IDisposable" ], [ 3275644, "u8", "RuntimeTypeHandle" ], [ 3275662, "u8", "GetTypeFromHandle" ], [ 3275680, "u8", "get_Module" ], [ 3275691, "u8", "get_Name" ], [ 3275700, "u8", "get_FullName" ], [ 3275713, "u8", "ContainsName" ], [ 3275726, "u8", "TryGetByName" ], [ 3275739, "u8", "AssemblyName" ], [ 3275752, "u8", "VirtualMachine" ], [ 3275767, "u8", "get_IsGenericType" ], [ 3275785, "u8", "get_FieldType" ], [ 3275799, "u8", "get_BaseType" ], [ 3275812, "u8", "get_IsValueType" ], [ 3275828, "u8", "IsValidPrimitiveType" ], [ 3275849, "u8", "get_DeclaringType" ], [ 3275867, "u8", "GetPrimitiveTypeFromSystemType" ], [ 3275898, "u8", "GetBuiltInType" ], [ 3275913, "u8", "get_ReturnType" ], [ 3275928, "u8", "GetKnownType" ], [ 3275941, "u8", "get_ParameterType" ], [ 3275959, "u8", "MakePointerType" ], [ 3275975, "u8", "GetTypeUniverseForType" ], [ 3275998, "u8", "GetDefaultValueForType" ], [ 3276021, "u8", "GetAsType" ], [ 3276031, "u8", "GetType" ], [ 3276039, "u8", "CorElementType" ], [ 3276054, "u8", "get_HasElementType" ], [ 3276073, "u8", "GetElementType" ], [ 3276088, "u8", "get_ArgumentType" ], [ 3276105, "u8", "AssemblyContentType" ], [ 3276125, "u8", "MakeArrayType" ], [ 3276139, "u8", "get_InvariantCulture" ], [ 3276160, "u8", "MethodBase" ], [ 3276171, "u8", "Release" ], [ 3276179, "u8", "Dispose" ], [ 3276187, "u8", "ITypeUniverse" ], [ 3276201, "u8", "get_TypeUniverse" ], [ 3276218, "u8", "get_StructLayoutAttribute" ], [ 3276244, "u8", "Byte" ], [ 3276249, "u8", "get_Value" ], [ 3276259, "u8", "get_TypedValue" ], [ 3276274, "u8", "get_BoxedValue" ], [ 3276289, "u8", "PrimitiveValue" ], [ 3276304, "u8", "get_HasValue" ], [ 3276317, "u8", "GetObjectValue" ], [ 3276332, "u8", "GetValue" ], [ 3276341, "u8", "GetRawConstantValue" ], [ 3276361, "u8", "GetUnboxValue" ], [ 3276375, "u8", "GetSlotForPrimitive" ], [ 3276395, "u8", "GetAsPrimitive" ], [ 3276410, "u8", "get_IsPrimitive" ], [ 3276426, "u8", "Eecbbeaadbdfedaffdadcfcc.exe" ], [ 3276455, "u8", "get_Size" ], [ 3276464, "u8", "GetObjectSize" ], [ 3276478, "u8", "GetSize" ], [ 3276486, "u8", "IndexOf" ], [ 3276506, "u8", "Stuff" ], [ 3276512, "u8", "LmrPlumbing" ], [ 3276524, "u8", "System.Threading" ], [ 3276541, "u8", "ToString" ], [ 3276550, "u8", "Substring" ], [ 3276560, "u8", "get_Length" ], [ 3276571, "u8", "GetArrayLength" ], [ 3276586, "u8", "GetArrayRank" ], [ 3276599, "u8", "Decimal" ], [ 3276607, "u8", "TryAutoMarshalInternal" ], [ 3276630, "u8", "IsNull" ], [ 3276637, "u8", "StringBuilderPool" ], [ 3276655, "u8", "PrimitiveImpl" ], [ 3276669, "u8", "MemoryStream" ], [ 3276682, "u8", "get_Item" ], [ 3276691, "u8", "System" ], [ 3276698, "u8", "IsAssignableFrom" ], [ 3276715, "u8", "GetSlotForEnum" ], [ 3276741, "u8", "GetAsBoolean" ], [ 3276754, "u8", "AppDomain" ], [ 3276764, "u8", "GetDomain" ], [ 3276774, "u8", "get_Revision" ], [ 3276787, "u8", "Version" ], [ 3276795, "u8", "System.Globalization" ], [ 3276816, "u8", "System.Reflection" ], [ 3276834, "u8", "get_IsGenericMethodDefinition" ], [ 3276864, "u8", "get_IsGenericTypeDefinition" ], [ 3276892, "u8", "GetGenericTypeDefinition" ], [ 3276917, "u8", "NotImplementedException" ], [ 3276941, "u8", "GetBuiltInSystemException" ], [ 3276967, "u8", "UnsupportedInterpreterOperationException" ], [ 3277008, "u8", "AssertedInterpreterExecutionException" ], [ 3277046, "u8", "InterpreterException" ], [ 3277067, "u8", "ArgumentException" ], [ 3277085, "u8", "StringComparison" ], [ 3277102, "u8", "Ilrun" ], [ 3277108, "u8", "FieldInfo" ], [ 3277118, "u8", "MethodInfo" ], [ 3277129, "u8", "GetTypeInfo" ], [ 3277141, "u8", "CultureInfo" ], [ 3277153, "u8", "get_MemberInfo" ], [ 3277168, "u8", "ParameterInfo" ], [ 3277182, "u8", "ConstructorInfo" ], [ 3277198, "u8", "PropertyInfo" ], [ 3277211, "u8", "KnownTypeMap" ], [ 3277224, "u8", "CorTypeMap" ], [ 3277235, "u8", "Sleep" ], [ 3277241, "u8", "Microsoft.MetadataReader" ], [ 3277266, "u8", "IFormatProvider" ], [ 3277282, "u8", "StringBuilder" ], [ 3277296, "u8", "Binder" ], [ 3277303, "u8", "SlotDecoder" ], [ 3277315, "u8", "ParameterModifier" ], [ 3277333, "u8", "get_IsGenericParameter" ], [ 3277356, "u8", "IsFunctionPointer" ], [ 3277374, "u8", "ConvertToPointer" ], [ 3277391, "u8", "GetAsPointer" ], [ 3277404, "u8", "get_IsPointer" ], [ 3277418, "u8", "BitConverter" ], [ 3277431, "u8", "get_Major" ], [ 3277441, "u8", "get_Minor" ], [ 3277451, "u8", "IEnumerator" ], [ 3277463, "u8", "GetEnumerator" ], [ 3277477, "u8", ".ctor" ], [ 3277483, "u8", ".cctor" ], [ 3277490, "u8", "get_Constructor" ], [ 3277506, "u8", "GetConstructor" ], [ 3277521, "u8", "IntPtr" ], [ 3277528, "u8", "System.Reflection.Adds" ], [ 3277551, "u8", "GetFields" ], [ 3277561, "u8", "PortableExecutableKinds" ], [ 3277585, "u8", "System.Runtime.InteropServices" ], [ 3277616, "u8", "System.Runtime.CompilerServices" ], [ 3277648, "u8", "GetProperties" ], [ 3277662, "u8", "MemberTypes" ], [ 3277674, "u8", "GetValueFromBytes" ], [ 3277692, "u8", "GetBytes" ], [ 3277701, "u8", "BindingFlags" ], [ 3277714, "u8", "get_Args" ], [ 3277723, "u8", "set_Args" ], [ 3277732, "u8", "CallArgs" ], [ 3277741, "u8", "Equals" ], [ 3277748, "u8", "Contains" ], [ 3277757, "u8", "TypeExtensions" ], [ 3277772, "u8", "System.Collections" ], [ 3277791, "u8", "ExceptionHandlingClauseOptions" ], [ 3277822, "u8", "RuntimeHelpers" ], [ 3277837, "u8", "get_ContainsGenericParameters" ], [ 3277867, "u8", "GetParameters" ], [ 3277881, "u8", "GetElementAddress" ], [ 3277899, "u8", "GetBits" ], [ 3277907, "u8", "GetGenericArguments" ], [ 3277927, "u8", "get_NamedArguments" ], [ 3277946, "u8", "get_ConstructorArguments" ], [ 3277971, "u8", "Concat" ], [ 3277978, "u8", "Format" ], [ 3277985, "u8", "DirectAllocateObject" ], [ 3278006, "u8", "GetSlotForHostObject" ], [ 3278031, "u8", "CharSet" ], [ 3278039, "u8", "GetFieldOffset" ], [ 3278054, "u8", "StoreElement" ], [ 3278067, "u8", "GetElement" ], [ 3278078, "u8", "CustomAttributeNamedArgument" ], [ 3278107, "u8", "CustomAttributeTypedArgument" ], [ 3278136, "u8", "get_Current" ], [ 3278148, "u8", "get_EntryPoint" ], [ 3278163, "u8", "get_Count" ], [ 3278173, "u8", "MachineUnwindSlot" ], [ 3278191, "u8", "get_ExceptionSlot" ], [ 3278209, "u8", "Assert" ], [ 3278216, "u8", "IsInst" ], [ 3278223, "u8", "IHost" ], [ 3278229, "u8", "get_Host" ], [ 3278238, "u8", "IObjectLayout" ], [ 3278252, "u8", "GetObjectLayout" ], [ 3278268, "u8", "MoveNext" ], [ 3278277, "u8", "System.Text" ], [ 3278289, "u8", "VThrow" ], [ 3278296, "u8", "GetKnownTypeNoThrow" ], [ 3278316, "u8", "CreateBox" ], [ 3278336, "u8", "CreateArray" ], [ 3278348, "u8", "ToByteArray" ], [ 3278360, "u8", "ToArray" ], [ 3278368, "u8", "get_IsArray" ], [ 3278380, "u8", "Verify" ], [ 3278387, "u8", "get_Assembly" ], [ 3278400, "u8", "GetSystemAssembly" ], [ 3278418, "u8", "GetTypeUniverseForAssembly" ], [ 3278445, "u8", "Copy" ], [ 3278450, "u8", "ISlotFactory" ], [ 3278463, "u8", "get_SlotFactory" ], [ 3278479, "u8", "op_Inequality" ], [ 3278493, "u8", "IsNullOrEmpty" ], [ 3278507, "u8", "GetProperty" ], [ 3286130, "u8", "KQpgKQ" ], [ 3287093, "u8", "伊诶伊R" ], [ 3287109, "u8", "诶艾诶A" ], [ 3287125, "u8", "贼哦贼N" ], [ 3287161, "u8", "杰吾杰O" ], [ 3287177, "u8", "艾哦艾M" ], [ 3287203, "u8", "艾吉艾S" ], [ 3287219, "u8", "迪哦迪T" ], [ 3287235, "u8", "丝贝丝R" ], [ 3287251, "u8", "诶勒诶I" ], [ 3287277, "u8", "贼哦贼G" ], [ 3292694, "u8", "pgKQpg" ], [ 3292701, "u8", "_pgKQpg" ], [ 3299933, "u8", "KQKQ" ], [ 3300215, "u8", "KQKQKQ" ], [ 3303166, "u8", "mscoree.dll" ], [ 3304002, "u8", "N0L0" ], [ 3304143, "u8", "Cacebcbfd1" ], [ 3304164, "u8", "Dfdcdbdabeabbaccee1" ], [ 3304192, "u8", "Bedbbeecb1" ], [ 3304238, "u8", "201213233738Z" ] ], "v": { "file.stem": "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1607902658, "file.basename": "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe", "pe.image_base": 4194304, "pe.image_size": 3325952, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 3310862, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 6240, "pe.image_hash.sha1": "5638501e5ed1a45c88ff4e2939b22de082828107", "pe.image_hash.sha256": "66913fc10f0ccdffa8ca81e83b749b03097c171da22cbbba588ec3b91b69999f", "pe.image_hash.sha384": "2f0cd866087e8564a259ca108924686a8a4f6c4788b445f25a131c993ecc8e79d50dda618dfed568b4182f9dd0097b62", "pe.image_hash.sha512": "b1bfefd922038680a75edbdac0743e6d5c44209e201c9a0a9999042c2d847cba6f82bf802994dbdc7d0336cf2492eef5392b3018f342753d28a527e4c31dfbd9", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=Bedbbeecb,O=Dfdcdbdabeabbaccee,CN=Cacebcbfd", "pe.signatures[0].serial": "35eb2ffe098781e4101982a7fa5af1ae", "pe.signatures[0].subject": "C=US,L=New York,OU=Bedbbeecb,O=Dfdcdbdabeabbaccee,CN=Cacebcbfd", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 3310784, "pe.data_directories[1].rva": 3303936, "pe.data_directories[2].rva": 3317760, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-12-13T23:37:38Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 6240, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-12-13T23:37:38Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "c04798cf2927710331ace5dfcdcd0deb9a80f8c1", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "66913fc10f0ccdffa8ca81e83b749b03097c171da22cbbba588ec3b91b69999f", "pe.signatures[0].thumbprint_sha256": "592edc1aed38d8ff283f99dadaf7bc9a82c024f8fe7b22f7d026a650cd777f46", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 3302912, 5.07, "r-x" ], [ ".reloc", 3303424, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 3310176, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x31ebd8" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x31ebd8" ] }, { "c": 1.0, "d": "Authenticode chain CN: Cacebcbfd", "e": [ "Cacebcbfd" ], "i": "metadata/signed/unknown::cacebcbfd", "l": 2 }, { "c": 1.0, "d": "Signed by Dfdcdbdabeabbaccee", "e": [ "Dfdcdbdabeabbaccee" ], "i": "metadata/signed/leaf::dfdcdbdabeabbaccee", "l": 3 }, { "c": 0.7200000286102295, "d": "Reflection GetFields reference", "e": [ "GetFields" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-fields-call", "l": 1, "el": [ "0x3202ef" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 10233.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8199999928474426, "d": "AppDomain GetDomain token", "e": [ "GetDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-getdomain-token", "l": 1, "el": [ "0x31ffdc" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection", "System.Reflection.Adds" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x320010", "0x3202d8" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 10233.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1546.012", "c": 0.8999999761581421, "d": "IFEO Debugger registry value", "e": [ "Debugger" ], "i": "objectives/persistence/login/ifeo/debugger::ifeo-debugger-value", "l": 1, "m": "F0012", "el": [ "0x31fa1e" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "0x31ffd2" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x3266fe" ] }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "0x31fb69" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025", "el": [ "0x31ff5d" ] }, { "c": 0.699999988079071, "d": "Assembly entry point resolution", "e": [ "get_EntryPoint" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-entrypoint", "l": 1, "el": [ "0x320544" ] }, { "c": 0.6000000238418579, "d": "GetProperties method reference", "e": [ "GetProperties" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-properties-method", "l": 1, "el": [ "0x320350" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 10233.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 0.6000000238418579, "d": "MethodBase class reference", "e": [ "MethodBase" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token", "l": 1, "el": [ "0x31fd80" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x31fe8a" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "0x3277b2" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x31f9c5" ] }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "0x31faa5" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "0x320633" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x169b" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x320311" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x3266fe" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xe63" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "GetUnboxValue", "get_Value", "GetDefaultValueForType", "get_TypedValue", "get_BoxedValue", "GetValue", "GetRawConstantValue", "get_IsValueType", "get_HasValue", "GetObjectValue", "GetValueFromBytes", "PrimitiveValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x31fe49", "0x31fdd9", "0x31fcde", "0x31fde3", "0x31fdf2", "0x31fe2c", "0x31fe35", "0x31fc24", "0x31fe10", "0x31fe1d", "0x32036a", "0x31fe01" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x31fa47" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x1f3a" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 10233.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 10233.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "StringBuilder", "StringComparison", "Substring", "StringBuilderPool" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x31fefd", "0x3201e2", "0x32011d", "0x31ff06", "0x31ff5d" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.007", "c": 0.75, "d": "DJB2 hash algorithm constant (5381)", "e": [ "05 15 00 00" ], "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "l": 1, "m": "B0032.014", "el": [ "0xbc2f" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetCustomAttributesData", "GetDefaultValueForType", "NotImplementedException", "UnsupportedInterpreterOperationException", "GetBuiltInSystemException", "ExceptionHandlingClauseOptions", "CreateNullReference", "GetPrimitiveTypeFromTypeX", "GetGenericArguments", "GetSlotForPrimitive", "AssertedInterpreterExecutionException", "GetGenericTypeDefinition", "GetPrimitiveTypeFromSystemType", "CustomAttributeNamedArgument", "InterpreterException", "GetSlotForHostObject" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x31fa06", "0x31fcde", "0x320075", "0x3200a7", "0x32008d", "0x3203df", "0x31fb43", "0x31f9cf", "0x320453", "0x31fe57", "0x3200d0", "0x32005c", "0x31fc5b", "0x3204fe", "0x3200f6", "0x3204b6" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 3302912, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 10233.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 10233.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x31fe8a" ] }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 10233.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-12/db0a298a1d51893aaeca574e5fff17cbfa6b83ea8538fc0e6c7a0bc97ca8a198.exe", "type": "pe" } ], "tv": "ca5ef" } }