{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.5419355, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T10:55:46Z" }, "path": "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 5, "ff": { "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 4.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 4075083.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 4074056.0, "entropy": 6.99, "size_bytes": 4074056.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 6.96, "overlay_size": 12360.0, "string_count": 41711.0, "overlay_ratio": 0.0, "overlay_entropy": 7.63, "entropy_variance": 0.56, "avg_string_length": 5.83, "max_string_length": 2002.0, "code_to_data_ratio": 1.0, "string_length_stddev": 10.35, "largest_section_ratio": 0.82, "sentence_string_count": 21.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "sections": { "count": 4.0, "code_size": 3348480.0, "entropy_max": 6.96, "entropy_mean": 6.15, "name_entropy": 2.93, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.data" ], [ 495, "u8", "@.rsrc" ], [ 1027, "u8", "SVWVfN" ], [ 1531, "u8", "wfIfOf1" ], [ 1570, "stack", "%7i;" ], [ 2895, "u8", "L1bif" ], [ 6595, "u8", "B_XZ[^YVfNQS" ], [ 8149, "u8", "w)[uf" ], [ 9647, "u8", "{g)f" ], [ 11155, "u8", "DSWf1" ], [ 11272, "u8", "hfOf" ], [ 13528, "u8", "vrPf" ], [ 14454, "u8", "AVfFf" ], [ 15037, "u8", "YZVfNQS8" ], [ 15478, "u8", "ZYPQ" ], [ 15667, "u8", "PHRS" ], [ 16205, "u8", "QIYR" ], [ 16819, "u8", "Z_YX" ], [ 18340, "u8", "WfGRfB" ], [ 18910, "u8", "iJHWf" ], [ 19379, "u8", "XYPVf" ], [ 19593, "u8", "YWfBW" ], [ 20194, "u8", "Y_SP" ], [ 21030, "u8", "PfHSC" ], [ 21622, "u8", "/ZPR" ], [ 21640, "u8", "YXRJQf" ], [ 21714, "u8", "Z_SQ" ], [ 24480, "u8", "VfNSRf" ], [ 27125, "u8", "YZXQ" ], [ 28531, "u8", "SZ^[_YXWfOQ" ], [ 30323, "u8", "XYZRBZ" ], [ 35840, "u8", "fJPf5" ], [ 36446, "u8", "f58e" ], [ 38726, "u8", "tfJf" ], [ 41710, "u8", "[k^_[XZYWRf" ], [ 41926, "u8", "UMVQ" ], [ 43977, "u8", "GZa8f" ], [ 44092, "u8", "0[_YZXPfHXP" ], [ 44904, "u8", "RJVQ9" ], [ 45346, "u8", "XZYP" ], [ 45362, "u8", "RRJV" ], [ 46132, "u8", "fAWfOR" ], [ 46940, "u8", "TI7J" ], [ 48015, "u8", "7fBP8" ], [ 48889, "u8", "XZVSf9" ], [ 50328, "u8", "WfORf" ], [ 50456, "u8", "YXP8" ], [ 50575, "u8", "Qnzf" ], [ 52703, "u8", "eRfJSQf" ], [ 53844, "u8", "ffNf" ], [ 54865, "u8", "YfAWf9" ], [ 56672, "u8", "Y_ZXRQ" ], [ 56819, "u8", "QAYSf" ], [ 56948, "u8", "kfHf" ], [ 59509, "u8", "fYXZP" ], [ 59547, "u8", "RVNQ" ], [ 59718, "u8", "nbOf" ], [ 62293, "u8", "gtTn" ], [ 64333, "u8", "PfHVf" ], [ 64768, "u8", "PqfCfF" ], [ 65009, "u8", "YZXSR" ], [ 65455, "u8", "dfKf1" ], [ 66872, "u8", "qZYVf" ], [ 67801, "u8", "XY_ZSQf" ], [ 68198, "u8", "mfCf" ], [ 68567, "u8", "vfAf" ], [ 68774, "u8", "ri8f" ], [ 68791, "u8", "SCFIf" ], [ 69946, "u8", "zcSQ1" ], [ 71516, "u8", "ZYXSf" ], [ 72439, "u8", "dSKVPf" ], [ 75679, "u8", "15V_[ZYXQ" ], [ 76802, "u8", "Lnnf" ], [ 78970, "u8", "YZSQ" ], [ 79031, "u8", "ZYVQf" ], [ 79203, "u8", "ufOf" ], [ 79339, "u8", "WfGQP0" ], [ 81028, "u8", "mrVf9" ], [ 81034, "u8", "SfCWf" ], [ 81208, "u8", "MOBfIf" ], [ 82171, "u8", "ZY_XR" ], [ 84016, "u8", "WfGVRf" ], [ 84065, "u8", "QfAP43" ], [ 84508, "u8", "YXZR" ], [ 85052, "u8", "SfCVfF" ], [ 85706, "u8", "YXZ_" ], [ 86010, "u8", "g[f)" ], [ 87746, "u8", "FPR0" ], [ 87796, "u8", "VKRW" ], [ 88732, "u8", "`0b`" ], [ 92074, "u8", "fOYQf" ], [ 92590, "u8", "wrCf" ], [ 92986, "u8", "Sf%\"'f" ], [ 93516, "u8", "yRfBZY" ], [ 96874, "u8", "frBf" ], [ 98732, "u8", "XfJVf" ], [ 99372, "u8", "Z_WGV" ], [ 101644, "u8", "zf5X1" ], [ 104128, "u8", "VFfFCf" ], [ 105741, "u8", "M[f)" ], [ 107262, "u8", "AmfAWR" ], [ 108496, "u8", "DgPf5cyQ" ], [ 109654, "u8", "fJNfI" ], [ 112343, "u8", "YZPW" ], [ 113150, "u8", "BRHfJS" ], [ 113965, "u8", "UHfCf" ], [ 114053, "u8", "Jark9" ], [ 114595, "u8", "ZXY_" ], [ 114637, "u8", "VfNPf" ], [ 116877, "u8", "35ST" ], [ 117105, "u8", "eSLfCf" ], [ 117192, "u8", "YZRQ" ], [ 117298, "u8", "nQPQf" ], [ 118836, "u8", "SHR1" ], [ 119030, "u8", "Y_WOVR" ], [ 119215, "u8", "XY^_[ZPHXWQf" ], [ 121626, "u8", "P5T_" ], [ 122724, "u8", "fI409" ], [ 123351, "u8", "PQRQP" ], [ 123698, "u8", "wlHy" ], [ 124373, "u8", "/fJf" ], [ 125198, "u8", "tfKf" ], [ 125495, "u8", "cKbuPf" ], [ 126226, "u8", "ffOf" ], [ 127253, "u8", "VfFSf" ], [ 128372, "u8", "rpPf" ], [ 128833, "u8", "WfGPQ" ], [ 129186, "u8", "Nocf" ], [ 129518, "u8", "tfBf" ], [ 130806, "u8", "dfJVW" ], [ 130884, "u8", "ofFf" ], [ 131264, "u8", "VfNPW" ], [ 131272, "u8", "RBS9" ], [ 131706, "u8", "fGfIfCf" ], [ 131730, "u8", "iVFWR" ], [ 132041, "u8", "WGSQ" ], [ 133557, "u8", "rffK1" ], [ 133634, "u8", "cfCf" ], [ 133938, "u8", "KRW9" ], [ 134103, "u8", "3JAB" ], [ 136413, "u8", "WO_R" ], [ 137526, "u8", "bfAf" ], [ 137815, "u8", "002f" ], [ 137859, "u8", "/G718" ], [ 138522, "u8", "Dbqf" ], [ 140587, "u8", "oPtf" ], [ 142520, "u8", "FK4Vf" ], [ 142776, "u8", "mfIf" ], [ 144570, "u8", "51fNf" ], [ 144590, "u8", "SKPR" ], [ 146201, "u8", "P4Guf" ], [ 146466, "u8", "vfOfH" ], [ 147032, "u8", "YXSRf9" ], [ 150660, "u8", "RfBZYXQ" ], [ 156085, "u8", "dfBf" ], [ 156132, "u8", "BF4rW" ], [ 156838, "u8", "uSQPR" ], [ 157139, "u8", "qdR0f" ], [ 158125, "u8", "Gf55Qf58" ], [ 159668, "u8", "3fKFfIf" ], [ 160526, "u8", "gGya" ], [ 161456, "u8", "dfJf" ], [ 162810, "u8", "XQfIY" ], [ 164129, "u8", "M9PQ" ], [ 165353, "u8", "XZSWf" ], [ 167484, "u8", "VN4K" ], [ 167943, "u8", "fAIFf" ], [ 168942, "u8", "YQfAYPSf" ], [ 169497, "u8", "YZSRf" ], [ 169942, "u8", "XZY[_^WfGRQ" ], [ 170414, "u8", "tfIf" ], [ 170902, "u8", "WOS1" ], [ 173128, "u8", "YSRf1" ], [ 173162, "u8", "_[^XYZQfIVRf" ], [ 173353, "u8", "KRWsf" ], [ 174302, "u8", "PfHWf" ], [ 174345, "u8", "VNSR" ], [ 174371, "u8", "QfAYQ" ], [ 174460, "u8", "WfOS8" ], [ 174779, "u8", "QhfCfJ" ], [ 176022, "u8", "DRS8" ], [ 176962, "u8", "UrVfFSfK" ], [ 177139, "u8", "HWO0" ], [ 177498, "u8", "dfCf" ], [ 178029, "u8", "^_[YXZRBQfASPf" ], [ 178290, "u8", "/dzL" ], [ 178426, "u8", "Z5XQR" ], [ 178458, "u8", "XRQ1" ], [ 179315, "u8", "ufNf" ], [ 179892, "u8", "RfJPfHf" ], [ 180124, "u8", "lZUf9" ], [ 180185, "u8", "SfCRf" ], [ 180619, "u8", "effCf" ], [ 181469, "u8", "VfFQS" ], [ 181991, "u8", "XZYVNf" ], [ 182402, "u8", "XYQS" ], [ 183227, "u8", "XZSQf" ], [ 184438, "u8", "kshRf" ], [ 184452, "u8", "GYPRf1" ], [ 185445, "u8", "XYZP" ], [ 185667, "u8", "QIRSf" ], [ 187962, "u8", "GSP0" ], [ 188837, "u8", "WVS9" ], [ 188938, "u8", "YZXR" ], [ 189258, "u8", "YSfCQf" ], [ 190091, "u8", "SfCVf" ], [ 190348, "u8", "YZS0" ], [ 191508, "u8", "Z_YQIYVf" ], [ 191968, "u8", "lJPfHWf" ], [ 193287, "u8", "VfNSf" ], [ 194261, "u8", "XZYRf" ], [ 194608, "u8", "YXZP" ], [ 196627, "u8", "Y gz" ], [ 196838, "u8", "ZXYP" ], [ 197126, "u8", "XY_Z" ], [ 197142, "u8", "OYRQ" ], [ 198545, "u8", "eOrb" ], [ 199323, "u8", "YZXPfHS" ], [ 199799, "u8", "RNYWf" ], [ 199858, "u8", "YSKV" ], [ 200357, "u8", "4SKP" ], [ 202049, "u8", "WfOSR9" ], [ 202321, "u8", "b!^_XZY^[RS" ], [ 202682, "u8", "HfOVf" ], [ 203275, "u8", "a8f1" ], [ 203776, "u8", "sJeZRf" ], [ 204051, "u8", "fBZR1" ], [ 205011, "u8", "ThPLf" ], [ 206123, "u8", "bbSf" ], [ 206158, "u8", "kfFf" ], [ 206303, "u8", "lcQGfJ" ], [ 206611, "u8", "KVFS" ], [ 208291, "u8", "ZY_S" ], [ 208340, "u8", "X_ZY" ], [ 208465, "u8", "SCVfFQ" ], [ 208487, "u8", "iMIWf" ], [ 209608, "u8", "NBV1" ], [ 210341, "u8", "yWfOVf" ], [ 210926, "u8", "Hytf" ], [ 211399, "u8", "P2PS" ], [ 213537, "u8", "rfBf" ], [ 215140, "u8", "ZRJZQ" ], [ 215300, "u8", "_^[YXZRfBPf" ], [ 217055, "u8", "rAsf" ], [ 217263, "u8", "SfKWf" ], [ 217613, "u8", "PX_YZS" ], [ 217951, "u8", "VFfAf" ], [ 219697, "u8", "5gVPf" ], [ 219862, "u8", "YXQV" ], [ 220472, "u8", "yFaf" ], [ 221070, "u8", "ifFf" ], [ 221902, "u8", "yByf" ], [ 222478, "u8", "ZYXPHQS1" ], [ 222983, "u8", "7YXPQ" ] ], "v": { "file.stem": "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1599051542, "file.basename": "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe", "pe.image_base": 4194304, "pe.image_size": 4075520, "pe.machine_id": 332, "pe.os_version": "6.0", "pe.version.os": "unknown", "pe.entry_point": 1740760, "pe.headers_size": 1024, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 12360, "pe.image_hash.sha1": "e25e5cfff2ab57adbb80a53a69f93f0e22dc5cc1", "pe.version.company": "FileZilla Project", "pe.version.comments": "Version 3.67.0", "pe.image_hash.sha256": "616b6fbce87479b31359fbb297e8f82f3f8fdc8eecb9d8aedf976579436731f9", "pe.image_hash.sha384": "d035c489a2615f133483570abb0bf4718a06dcd4bff2bd0858eae10cd3509ff699576e86d2e82b21e8a8268998ab3bfe", "pe.image_hash.sha512": "ba8451652895cad0d4dda3e5ea8bcd99ddd8acfdc423a0e9b7f0885c0d2272f01fd7cb3cd2c1ca2bc2b08c2acc2bc11d5bb902635c0dde91f90b8f3d8633c2f5", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.resource_types[3]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.version.copyright": "Copyright (C) 2006-2024", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.manifest.dpi_aware": "true", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 259, "pe.version.description": "FileZilla FTP Client", "pe.linker_major_version": 14, "pe.linker_minor_version": 33, "pe.manifest.description": "FileZilla FTP client", "pe.signatures[0].issuer": "CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB", "pe.signatures[0].serial": "31830c370ad7e497633b6eb3a02d69e6", "pe.version.file_version": "3, 67, 0, 0", "pe.version.product_name": "FileZilla", "pe.signatures[0].subject": "CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE", "pe.version.internal_name": "FileZilla 3", "pe.dll_characteristics[0]": "nx_compat", "pe.dll_characteristics[1]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 4034560, "pe.data_directories[1].rva": 4061696, "pe.dll_characteristics_raw": 33024, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2025-02-17T23:59:59Z", "pe.version.product_version": "3, 67, 0, 0", "pe.data_directories[0].name": "resource", "pe.data_directories[0].size": 38496, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 12360, "pe.manifest.dependencies[0]": "Microsoft.Windows.Common-Controls@6.0.0.0", "pe.manifest.supported_os[0]": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.manifest.supported_os[1]": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[2]": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[3]": "{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}", "pe.signatures[0].not_before": "2022-02-18T00:00:00Z", "pe.version.original_filename": "filezilla.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].signing_time": "2024-04-15T18:25:00Z", "pe.signatures[0].thumbprint_sha1": "e57ce01f6a5e1d4c522bc68488af53d9bad13ab7", "pe.signatures[0].cert_chain_depth": 7, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "7c015360baee5a33cba84e3ead31e2c90eba9087c83c9597b953dbacff718227", "pe.manifest.assembly_identity.name": "FileZilla", "pe.signatures[0].signing_time_unix": 1713205500, "pe.signatures[0].thumbprint_sha256": "ed619a9a79713e12ffb757cf8a51bba89fbb967ec6223c653f1f8932b0e2a25a", "pe.signatures[0].signature_algorithm": "sha384WithRSAEncryption", "pe.manifest.assembly_identity.version": "3.40.0.0", "pe.manifest.requested_execution_level": "asInvoker", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 1024, 3348480, 6.96, "r-x" ], [ ".rdata", 3349504, 672256, 5.52, "r--" ], [ ".data", 4021760, 1024, 5.3, "r--" ], [ ".rsrc", 4022784, 38912, 6.83, "r--" ] ] }, "id": 0, "sz": 4074056, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Tim Kosse", "e": [ "Tim Kosse" ], "i": "metadata/signed/unknown::tim-kosse", "l": 2 }, { "c": 1.0, "d": "Signed by Tim Kosse", "e": [ "Tim Kosse" ], "i": "metadata/signed/leaf::tim-kosse", "l": 3 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright (C) 2006-2024" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "FileZilla FTP Client" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x3df108" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 41711.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 38912, entropy: 6.83)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0x3da66b" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0x3df51b" ] }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[Microsoft.Windows.Common-Controls@6.0.0.0]" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2, "el": [ "value:pe.manifest.dependencies" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "FileZilla" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.96)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 41711.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x3def12" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 41711.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x3defe2" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.96" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Tool identity claims FileZilla", "e": [ "FileZilla", "filezilla" ], "i": "metadata/package/tooling::tool-identity-filezilla", "l": 1, "el": [ "0x3deffc", "0x3df160" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"FileZilla\",\"version\":\"3.40.0.0\"},\"depe" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x3dfb36" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x15677" ] }, { "a": "T1555", "c": 0.8500000238418579, "d": "FileZilla application directory", "e": [ "name=\"FileZilla\"", "FileZilla FTP Client", "FileZilla Project", "\u003cdescription\u003eFileZilla FTP client\u003c/description\u003e", "FileZilla 3", "FileZilla" ], "i": "objectives/credential-access/ftp/filezilla::application-path", "l": 1, "el": [ "0x3df2f5", "0x3df048", "0x3deffc", "0x3df355", "0x3df0cc", "0x3df19c" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x3df0b2" ] }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1, "el": [ "0x3df85d", "0x3df85d", "0x3df85d" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "3, 67, 0, 0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1573", "c": 0.8500000238418579, "d": "Curve25519 scalar clamping byte sequence", "e": [ "88 80 cc 28 66" ], "i": "micro-behaviors/crypto/asymmetric/curve25519::curve25519-clamp", "l": 1, "m": "C0027", "el": [ "0x323221" ] }, { "c": 1.0, "d": "GUI binary declares DPI awareness", "e": [ "true" ], "i": "metadata/build/manifest::pe-dpi-aware", "l": 2, "el": [ "value:pe.manifest.dpi_aware" ] }, { "c": 1.0, "d": "Issued by Sectigo Code Signing CA", "e": [ "CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB" ], "i": "metadata/signed/certificate::pe-cert-issuer-sectigo", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x3df13e" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "cf" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x61eeb" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x3df160" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x5a232" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "4e", "40" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0xa96", "0xfeda4" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 41711.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x3505e" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 41711.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x3df182" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a", "1f676c76-80e1-4239-95bb-83d0f6d0da78", "4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38", "35138b9a-5d96-4fbd-8e2d-a2440225f93a" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030", "el": [ "0x3df6f7", "0x3df6a5", "0x3df653", "0x3df603" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x3def6e" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 1024)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x3df026" ] }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 41711.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 41711.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003c\u003c\u003cObsolete\u003e\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1, "el": [ "0x3dfa60" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 3348480, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 5.83" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x331b52" ] }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 41711.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x3df160" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Large PE with four standard sections", "e": [ "sections.count = 4.00", "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe" ], "i": "metadata/binary/metrics/structural::large-four-section-pe", "l": 3 }, { "c": 0.8600000143051147, "d": "PNG and manifest in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e", "IHDR" ], "i": "metadata/binary/resource::png-and-manifest-rsrc", "l": 2, "el": [ "0x3df51b", "0x3da66b" ] } ], "sha": "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4", "path": "dcd0823f72d6a145fb9acfbb6f2e4885b3e6fca6dc76f1476bd0c5431ae15ff4.exe", "type": "pe" } ], "tv": "52045" } }