{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.7395973, "class": 0 }, { "m": "az/pe", "prob": 0.41964287, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T12:41:03Z" }, "path": "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec.exe", "raw": { "v": "5", "fs": [ { "f": "H(Cm)Md(He)", "x": 4, "ff": { "i": [ [ "wininet", "FindFirstUrlCacheEntryExW" ], [ "wininet", "IncrementUrlCacheHeaderData" ], [ "wininet", "GetUrlCacheHeaderData" ], [ "wininet", "FindFirstUrlCacheContainerA" ], [ "wininet", "FtpRemoveDirectoryW" ], [ "wininet", "InternetGoOnline" ], [ "wininet", "GetUrlCacheEntryInfoA" ], [ "msacm32", "acmDriverMessage" ], [ "msacm32", "acmFilterEnumW" ], [ "resutils", "ResUtilGetResourceNameDependency" ], [ "resutils", "ResUtilSetPropertyParameterBlock" ], [ "resutils", "ResUtilAddUnknownProperties" ], [ "resutils", "ResUtilFindSzProperty" ], [ "resutils", "ResUtilStopResourceService" ], [ "urlmon", "URLDownloadToFileW" ], [ "urlmon", "HlinkSimpleNavigateToString" ], [ "urlmon", "Extract" ], [ "urlmon", "CoGetClassObjectFromURL" ], [ "urlmon", "URLOpenPullStreamW" ], [ "urlmon", "RegisterMediaTypeClass" ], [ "comdlg32", "GetOpenFileNameA" ], [ "comdlg32", "GetOpenFileNameW" ], [ "comdlg32", "ReplaceTextA" ], [ "comdlg32", "ChooseColorW" ], [ "comdlg32", "FindTextW" ], [ "comdlg32", "FindTextA" ], [ "ole32", "CoInstall" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 3.0, "checksum_stripped": 1.0, "computed_checksum": 234610.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 28.0 }, "file": { "size": 175616.0, "entropy": 1.61, "size_bytes": 175616.0 }, "binary": { "is_pie": 1.0, "code_entropy": 4.67, "string_count": 160.0, "entropy_variance": 3.02, "avg_string_length": 11.58, "max_string_length": 379.0, "code_to_data_ratio": 1.0, "string_length_stddev": 30.89, "largest_section_ratio": 0.95, "sentence_string_count": 4.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 27.0 }, "sections": { "count": 5.0, "code_size": 5120.0, "entropy_max": 5.17, "entropy_mean": 3.25, "name_entropy": 3.21, "writable_count": 1.0, "executable_count": 2.0, "nonstandard_count": 0.0, "executable_writable_count": 1.0 }, "dependencies": { "count": 6.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 192, "u8", "Rich" ], [ 456, "u8", ".text" ], [ 535, "u8", "@.data" ], [ 576, "u8", ".rsrc" ], [ 615, "u8", "@.reloc" ], [ 4832, "u8", ".rdata" ], [ 4848, "u8", ".rdata$zzzdbg" ], [ 4952, "u8", ".data" ], [ 5274, "u8", "FindFirstUrlCacheEntryExW" ], [ 5302, "u8", "GetUrlCacheEntryInfoA" ], [ 5326, "u8", "InternetGoOnline" ], [ 5346, "u8", "FtpRemoveDirectoryW" ], [ 5368, "u8", "FindFirstUrlCacheContainerA" ], [ 5398, "u8", "GetUrlCacheHeaderData" ], [ 5422, "u8", "IncrementUrlCacheHeaderData" ], [ 5450, "u8", "WININET.dll" ], [ 5464, "u8", "acmDriverMessage" ], [ 5484, "u8", "acmFilterEnumW" ], [ 5500, "u8", "MSACM32.dll" ], [ 5514, "u8", "ResUtilSetPropertyParameterBlock" ], [ 5550, "u8", "ResUtilAddUnknownProperties" ], [ 5580, "u8", "ResUtilFindSzProperty" ], [ 5604, "u8", "ResUtilStopResourceService" ], [ 5634, "u8", "ResUtilGetResourceNameDependency" ], [ 5668, "u8", "RESUTILS.dll" ], [ 5684, "u8", "CoGetClassObjectFromURL" ], [ 5710, "u8", "Extract" ], [ 5720, "u8", "HlinkSimpleNavigateToString" ], [ 5750, "u8", "URLDownloadToFileW" ], [ 5772, "u8", "URLOpenPullStreamW" ], [ 5794, "u8", "RegisterMediaTypeClass" ], [ 5818, "u8", "urlmon.dll" ], [ 5832, "u8", "GetOpenFileNameA" ], [ 5852, "u8", "GetOpenFileNameW" ], [ 5872, "u8", "ReplaceTextA" ], [ 5888, "u8", "ChooseColorW" ], [ 5904, "u8", "FindTextW" ], [ 5916, "u8", "FindTextA" ], [ 5926, "u8", "COMDLG32.dll" ], [ 5942, "u8", "CoInstall" ], [ 5952, "u8", "ole32.dll" ], [ 6194, "u8", "QQSVW" ], [ 6302, "u8", "SVWjuXjrf" ], [ 6327, "u8", "Xjnf" ], [ 6334, "u8", "Xj.f" ], [ 6341, "u8", "Xjdf" ], [ 6348, "u8", "XjsZjef" ], [ 6374, "u8", "Xjkf" ], [ 6385, "u8", "Yjaf" ], [ 6414, "u8", "Xjrf" ], [ 6421, "u8", "Xjhf" ], [ 6434, "u8", "Xjtf" ], [ 6444, "u8", "Xjpf" ], [ 6527, "u8", "jiXjmf" ], [ 6536, "u8", "Xjgf" ], [ 6567, "u8", "Yjif" ], [ 6596, "u8", "Xjef" ], [ 6603, "u8", "Xjlf" ], [ 6622, "u8", "YjsXjxf" ], [ 6632, "u8", "Xjbf" ], [ 6639, "u8", "Xjzf" ], [ 6992, "u8", "QVPW" ], [ 8315, "u8", "IHDR" ], [ 8362, "u8", "IDATx" ], [ 9201, "u8", "T9YK" ], [ 11474, "u8", "xD4WN" ], [ 12424, "u8", "IEND" ], [ 174296, "u8", "\u003c?xml version='1.0' encoding='UTF-8' standalone='yes'?\u003e" ], [ 174353, "u8", "\u003cassembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'\u003e" ], [ 174428, "u8", "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 174484, "u8", "\u003csecurity\u003e" ], [ 174500, "u8", "\u003crequestedPrivileges\u003e" ], [ 174529, "u8", "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], [ 174601, "u8", "\u003c/requestedPrivileges\u003e" ], [ 174631, "u8", "\u003c/security\u003e" ], [ 174648, "u8", "\u003c/trustInfo\u003e" ], [ 174664, "u8", "\u003c/assembly\u003e" ] ], "v": { "file.stem": "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec", "pe.imphash": "0162c0d4b083e9259ae3a5f11034f58d", "pe.machine": "i386", "pe.rich.key": 3169579969, "pe.rich.hash": "07eeaaca47dc8c39d2544b03c0eb3f56", "pe.subsystem": "windows_gui", "pe.timestamp": 1630974022, "file.basename": "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec.exe", "pe.image_base": 4194304, "pe.image_size": 188416, "pe.machine_id": 332, "pe.os_version": "6.0", "pe.entry_point": 4096, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "64dd5b6eccd759f74f9e4292c5c4bef0cd3fc6b0", "pe.image_hash.sha256": "ab412cc44bbe28e1de6963da237373539a57986596e24efaf5bd01f9ab5df705", "pe.image_hash.sha384": "1353299e0bdb7f942c2a5851d1cb9b98bf7430e1d0cc5a30d9472ecffb0231a7dff41b53c38b8353e4b9412b1e65e242", "pe.image_hash.sha512": "cca802aa46a071455f86a8dac7d2a3d2dc25809a303ef660e92b3a3763eeb6c87394fd6f17e80744c3663617f9fd55827c3e9dba790abb3f6dc340076572c360", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 258, "pe.linker_major_version": 14, "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "pogo", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.data_directories[0].rva": 8584, "pe.data_directories[1].rva": 16384, "pe.data_directories[2].rva": 184320, "pe.data_directories[3].rva": 8336, "pe.data_directories[4].rva": 8192, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 140, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 167000, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 64, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 144, "pe.debug.entries[0].type_id": 13, "pe.rich.entries[0].build_id": 257, "pe.rich.entries[1].build_id": 1, "pe.rich.entries[2].build_id": 260, "pe.rich.entries[3].build_id": 255, "pe.rich.entries[4].build_id": 151, "pe.rich.entries[5].build_id": 258, "pe.rich.entries[0].use_count": 13, "pe.rich.entries[1].use_count": 27, "pe.rich.entries[2].use_count": 1, "pe.rich.entries[3].use_count": 1, "pe.rich.entries[4].use_count": 1, "pe.rich.entries[5].use_count": 1, "pe.coff.dos_header_pe_pointer": 208, "pe.rich.entries[0].product_id": 27412, "pe.rich.entries[2].product_id": 24215, "pe.rich.entries[3].product_id": 24210, "pe.rich.entries[5].product_id": 24215, "pe.debug.entries[0].size_bytes": 220, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 28, "pe.debug.entries[0].timestamp_unix": 1630974022, "pe.manifest.requested_execution_level": "asInvoker" }, "id": "pe", "sc": [ [ ".text", 1024, 3584, 4.46, "r-x" ], [ ".rdata", 4608, 1536, 4.29, "r--" ], [ ".data", 6144, 1536, 5.17, "rwx" ], [ ".rsrc", 7680, 167424, 1.38, "r--" ], [ ".reloc", 175104, 512, 0.93, "r--" ] ] }, "id": 0, "sz": 175616, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x154a" ] }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1, "el": [ "0x16ba" ] }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0x207b" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0x2a9c1" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 27.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "URLDownloadToFileW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1, "el": [ "0x1676" ] }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "sections.count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 160.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "URLDownloadToFile API name as string", "e": [ "URLDownloadToFileW" ], "i": "micro-behaviors/communications/http/get::url-download-to-file-str", "l": 3, "el": [ "0x1676" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\"}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 27.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2, "el": [ "0x2a9c1" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "HlinkSimpleNavigateToString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x1658" ] }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 167424)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 1536)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "sections.executable_writable_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 27.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.7200000286102295, "d": "WinInet DLL import name", "e": [ "WININET.dll" ], "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "l": 3, "el": [ "0x154a" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 27.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".data (size: 1536, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x103f" ] }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 27.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8799999952316284, "d": "Large low-entropy PE resources", "e": [ ".rsrc (size: 167424, entropy: 1.38)" ], "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "FindFirstUrlCacheContainerA", "FtpRemoveDirectoryW", "ResUtilAddUnknownProperties", "ResUtilSetPropertyParameterBlock", "ResUtilStopResourceService", "RegisterMediaTypeClass", "GetUrlCacheHeaderData", "FindFirstUrlCacheEntryExW", "ResUtilFindSzProperty", "ResUtilGetResourceNameDependency", "IncrementUrlCacheHeaderData", "GetUrlCacheEntryInfoA", "HlinkSimpleNavigateToString" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x14f8", "0x14e2", "0x15ae", "0x158a", "0x15e4", "0x16a2", "0x1516", "0x149a", "0x15cc", "0x1602", "0x152e", "0x14b6", "0x1658" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "GetUrlCacheHeaderData", "IncrementUrlCacheHeaderData", "FindFirstUrlCacheContainerA", "GetUrlCacheEntryInfoA", "FindFirstUrlCacheEntryExW" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "0x1516", "0x152e", "0x14f8", "0x14b6", "0x149a" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links urlmon (URLDownloadToFileW, HlinkSimpleNavigateToString, Extract, CoGetClassObjectFromURL, URLOpenPullStreamW, ... +1 more)", "e": [ "urlmon" ], "i": "metadata/dylib::urlmon", "l": 2, "el": [ "6 symbols" ] }, { "c": 0.949999988079071, "d": "links msacm32 (acmDriverMessage, acmFilterEnumW)", "e": [ "msacm32" ], "i": "metadata/dylib::msacm32", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links resutils (ResUtilGetResourceNameDependency, ResUtilSetPropertyParameterBlock, ResUtilAddUnknownProperties, ResUtilFindSzProperty, ResUtilStopResourceService)", "e": [ "resutils" ], "i": "metadata/dylib::resutils", "l": 2, "el": [ "5 symbols" ] }, { "c": 0.949999988079071, "d": "links comdlg32 (GetOpenFileNameA, GetOpenFileNameW, ReplaceTextA, ChooseColorW, FindTextW, ... +1 more)", "e": [ "comdlg32" ], "i": "metadata/dylib::comdlg32", "l": 2, "el": [ "6 symbols" ] }, { "c": 0.949999988079071, "d": "links ole32 (CoInstall)", "e": [ "ole32" ], "i": "metadata/dylib::ole32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links wininet (FindFirstUrlCacheEntryExW, IncrementUrlCacheHeaderData, GetUrlCacheHeaderData, FindFirstUrlCacheContainerA, FtpRemoveDirectoryW, ... +2 more)", "e": [ "wininet" ], "i": "metadata/dylib::wininet", "l": 2, "el": [ "7 symbols" ] }, { "c": 0.8600000143051147, "d": "PNG and manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e", "IHDR" ], "i": "metadata/binary/resource::png-and-manifest-rsrc", "l": 2, "el": [ "0x2a9c1", "0x207b" ] } ], "sha": "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec", "path": "dfc761bd651db9fbcf544787fa5b982e93949fda88c7362f34c101f8446a32ec.exe", "type": "pe" } ], "tv": "52045" } }