{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9940488338470459, "class": 2 } ], "prob": 0.99404883, "class": 2, "oprob": 0.9318409, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T19:30:02Z" }, "path": "8290", "raw": { "v": "4", "fs": [ { "f": "KO₄(C₆As₈ErI)H₂(Os₃Po₂)Md₂(SiBi₅)", "x": 242, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "RegCloseKey", "PatBlt", "GetAdaptersInfo", "CoInitialize", "ORDINAL 9", "UrlEscapeA", "GetDC", "VerQueryValueA", "ORDINAL 116" ], "ms": { "pe": { "signer": "VeriSign Class 3 Code Signing 2010 CA, appbundler.com, VeriSign Class 3 Public Primary Certification Authority - G5, VeriSignMPKI-2-8", "machine": 332.0, "checksum": 212017.0, "rsrc_size": 7680.0, "subsystem": 2.0, "timestamp": 1303516432.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.59, "entry_section": "UPX1", "has_signature": true, "size_of_image": 495616.0, "timestamp_day": 22.0, "checksum_valid": true, "file_alignment": 512.0, "primary_signer": "appbundler.com", "resource_count": 7.0, "signature_type": "developer", "timestamp_year": 2011.0, "characteristics": 259.0, "entry_point_rva": 486352.0, "size_of_headers": 4096.0, "timestamp_month": 4.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 10.0, "manifest_present": true, "certificate_count": 1.0, "computed_checksum": 212017.0, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 0.0, "dll_characteristics": 32768.0, "rich_header_present": true, "linker_major_version": 9.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 3760.0, "export_timestamp_present": false, "resource_timestamp_present": false, "entry_in_nonstandard_section": true }, "binary": { "code_size": 196096.0, "file_size": 208560.0, "entry_point": 486352.0, "wx_sections": 2.0, "code_entropy": 3.97, "import_count": 15.0, "string_count": 232.0, "has_signature": true, "section_count": 3.0, "avg_complexity": 15.5, "function_count": 2.0, "import_density": 0.08, "max_complexity": 30.0, "string_density": 1.21, "overall_entropy": 4.18, "avg_basic_blocks": 28.0, "avg_section_size": 67925.34, "dependency_count": 10.0, "entropy_variance": 3.25, "function_density": 0.01, "avg_function_size": 227.5, "avg_string_length": 11.28, "complexity_per_kb": 0.08, "max_string_length": 560.0, "wide_string_count": 9.0, "writable_sections": 3.0, "avg_string_entropy": 2.5, "code_to_data_ratio": 25.53, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.04, "total_basic_blocks": 56.0, "executable_sections": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 37.38, "largest_section_ratio": 0.94, "sentence_string_count": 8.0, "sentence_string_ratio": 0.03, "behavioral_import_ratio": 0.27, "function_analysis_depth": 2.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, "UPX0" ], [ 536, "UPX1" ], [ 576, ".rsrc" ], [ 987, "3.03" ], [ 1343, "XBWE" ], [ 5148, "p999i" ], [ 6375, "P.dh" ], [ 10277, "zNN\u0026\u003c\u003c" ], [ 11157, "ICWH" ], [ 14937, "OSU3" ], [ 18060, "RAQ7" ], [ 19450, "ELNK" ], [ 24217, "HJH@Y!A." ], [ 25239, "RH9D" ], [ 26004, "FM88" ], [ 26111, "At w" ], [ 26672, "K.px" ], [ 28257, "GLPW" ], [ 31455, "Xfpr" ], [ 34907, "/2YY" ], [ 35589, "Kjhwl" ], [ 35880, "Ssuc" ], [ 38254, "/E90" ], [ 38795, "V3VS" ], [ 40838, "490L" ], [ 41209, "L 8Y" ], [ 41881, "AWAQ" ], [ 48161, "N8VV" ], [ 51876, "J5B8" ], [ 55175, "ZV13" ], [ 57192, "NDPHCNeJ" ], [ 58170, "o064" ], [ 60884, "34ot" ], [ 64753, "SSQRS" ], [ 65610, "LB2QE" ], [ 70752, "Vhzw" ], [ 74421, "MTER" ], [ 74706, "E0CG" ], [ 76081, "D9Z_" ], [ 78035, "MXL8" ], [ 78148, "4MMM" ], [ 80554, "04488" ], [ 82081, "TAWS" ], [ 84303, "UyUfnxi" ], [ 84845, "HCE8" ], [ 85362, "5v8t" ], [ 87673, "J8K4" ], [ 89711, "740v" ], [ 91817, "74PI" ], [ 94129, "VCA4" ], [ 94741, "TCY8" ], [ 95095, "4uxp" ], [ 96831, "16MZ" ], [ 96888, "JR2\u003e_" ], [ 97375, "AIIL" ], [ 97714, "P0AO" ], [ 101041, "LGAM" ], [ 102113, "Rxkd" ], [ 104473, "/1tAl" ], [ 105133, "GSVI" ], [ 107595, "06zy" ], [ 107607, "U6TX" ], [ 107721, "Z1WU" ], [ 108143, "YKYYW4M" ], [ 108510, "KNHX" ], [ 108663, "u3vz" ], [ 111017, "SFNHHW_" ], [ 115217, "010V" ], [ 122221, "sea8" ], [ 127423, "KHFK" ], [ 128576, "360a" ], [ 129260, "2P8O" ], [ 132027, "72gi" ], [ 132937, "P1SW" ], [ 136929, "/2H3KE" ], [ 139095, "XDEFGHQh" ], [ 139105, "IJKLMNOP" ], [ 139119, "ZXYZabcdefghijklmnopq" ], [ 139144, "rstuvwxyz0123456789+/" ], [ 139227, "|InterlockedP" ], [ 139263, "\u0026rnel32.dllWbad alXat" ], [ 139330, "orExitPr" ], [ 139339, "ess8m" ], [ 139378, "Guara" ], [ 139453, "Octo" ], [ 139481, "|AprilMarchebr`" ], [ 139727, "0pime x" ], [ 139739, "r vLOSS" ], [ 139774, "Anjppli" ], [ 140231, "C/idna" ], [ 140261, "Bmiv" ], [ 141049, "C.UserOt" ], [ 141096, "geBoxbUSER" ], [ 141178, "Type" ], [ 141347, "RTTI" ], [ 141542, "OGO__" ], [ 142277, "POSTQGE" ], [ 142753, "Vers" ], [ 142763, "G*5ZHUNZ5BNU" ], [ 142963, "Canl" ], [ 143753, "DOYB" ], [ 143935, "y-auth" ], [ 143962, "KN05B" ], [ 146297, "ut:blanJBG\u003c" ], [ 147428, "gapos\"\u0026quo\"" ], [ 147565, "n6z5" ], [ 147858, "u1ghl" ], [ 148982, "Scsi" ], [ 149105, "4NPG" ], [ 149497, "PSCSIDISK" ], [ 149867, "he+\u003e6o@zNsn8lrH0 f\tP" ], [ 149959, "ZNKKGK5AHH" ], [ 149979, "A7UH" ], [ 150554, "xp3vist" ], [ 151076, "7CPR" ], [ 151224, ".html" ], [ 151415, ";WPCMSG_SIGNER_x" ], [ 151882, "Z#c/ HTTP/1.1" ], [ 151957, "COMMA" ], [ 151979, "chzed7" ], [ 151993, "8oki" ], [ 162987, "HMXB" ], [ 163458, "_CAtlEA" ], [ 163837, "Qkkh" ], [ 164734, "s@GVgE4NOb\\v" ], [ 164794, "q$1?_G\u003cD_b2d0778b_ac" ], [ 164818, "99_4c58" ], [ 165332, "Poly" ], [ 169372, "riVJ/rF" ], [ 169509, "Hjgv" ], [ 170091, "L6UN" ], [ 170862, "p6at" ], [ 172471, "al3s" ], [ 172569, "z3vo" ], [ 172630, "VHO6" ], [ 173433, "c65e" ], [ 173470, "/qBn8'O7" ], [ 173650, "7NEZ" ], [ 173973, "/mGZ" ], [ 176091, "WCXS7" ], [ 176779, "HYOC" ], [ 177268, "3QFA" ], [ 177665, "8V8C" ], [ 178832, "DGQ_" ], [ 178887, "35PK" ], [ 180194, "Lgvw" ], [ 180461, "u2\u003eRKG" ], [ 180939, "ou6o" ], [ 180996, "bz.w" ], [ 181599, "Zkqq" ], [ 181681, "Hvix" ], [ 182481, "/jWe" ], [ 184084, "ds/q'XiBwJ" ], [ 185645, "Frbp" ], [ 186054, "IW7BF" ], [ 186879, "/Wnp" ], [ 187476, "s2ke" ], [ 188027, "42wm" ], [ 188095, "Zzgm" ], [ 188355, "c13p" ], [ 189391, "o9sf" ], [ 190231, "h.wo" ], [ 191693, "Psci" ], [ 191745, "B_L8" ], [ 193592, "Hgxs" ], [ 194100, "N7SK" ], [ 194231, "Tool" ], [ 194239, "help32Snapshot2" ], [ 194300, "zASp*J0orsTG" ], [ 194377, "hare" ], [ 194509, "BuffNDk" ], [ 195560, "2DLS" ], [ 195839, "Bdnh" ], [ 196965, "XPTPSW" ], [ 198026, "wide", "JPEG" ], [ 200095, "wwwwwwwxp" ], [ 201591, "X1CC" ], [ 202770, "wide", "VS_VERSION_INFO" ], [ 202862, "wide", "StringFileInfo" ], [ 202922, "wide", "FileDescription" ], [ 202956, "wide", "Installer" ], [ 202982, "wide", "FileVersion" ], [ 203034, "wide", "ProductVersion" ], [ 203090, "wide", "VarFileInfo" ], [ 203122, "wide", "Translation" ], [ 203156, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e\u003cdependency\u003e\u003cdependentAssembly\u003e\u003cassemblyIdentity type=\"" ], [ 204036, "KERNEL32.DLL" ], [ 204049, "ADVAPI32.dll" ], [ 204062, "GDI32.dll" ], [ 204072, "IPHLPAPI.DLL" ], [ 204085, "ole32.dll" ], [ 204095, "OLEAUT32.dll" ], [ 204108, "SHLWAPI.dll" ], [ 204120, "USER32.dll" ], [ 204131, "VERSION.dll" ], [ 204143, "WS2_32.dll" ], [ 204156, "LoadLibraryA" ], [ 204170, "GetProcAddress" ], [ 204186, "VirtualProtect" ], [ 204202, "VirtualAlloc" ], [ 204216, "VirtualFree" ], [ 204230, "ExitProcess" ], [ 204244, "RegCloseKey" ], [ 204266, "GetAdaptersInfo" ], [ 204284, "CoInitialize" ], [ 204298, "UrlEscapeA" ], [ 204318, "VerQueryValueA" ], [ 204862, "Z0X03" ], [ 205030, "VeriSign, Inc.1" ], [ 205055, "VeriSign Trust Network1;09" ], [ 205087, "2Terms of use at https://www.verisign.com/rpa (c)101.0," ], [ 205245, "Washington1" ], [ 205285, "appbundler.com1\u003e0\u003c" ], [ 205309, "5Digital ID Class 3 - Microsoft Software Validation v21" ], [ 205388, "appbundler.com0" ], [ 205739, "90705" ], [ 205749, "/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" ], [ 205839, "https://www.verisign.com/rpa0" ], [ 205918, "http://ocsp.verisign.com0;" ], [ 205955, "/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" ], [ 206453, "VeriSign Trust Network1:08" ], [ 206485, "1(c) 2006 VeriSign, Inc. - For authorized use only1E0C" ], [ 206545, "\u003cVeriSign Class 3 Public Primary Certification Authority - G50" ], [ 207151, "i0g0e" ], [ 207185, "https://www.verisign.com/cps0*" ], [ 207300, "image/gif0!0" ], [ 207348, "#http://logo.verisign.com/vslogo.gif04" ], [ 207402, "#http://crl.verisign.com/pca3-g5.crl04" ], [ 207468, "http://ocsp.verisign.com0" ], [ 207549, "VeriSignMPKI-2-80" ], [ 207626, "3130" ] ], "sz": 208560, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Code Signing 2010 CA", "e": [ "VeriSign Class 3 Code Signing 2010 CA" ], "i": "metadata/signed/developer::verisign-class-3-code-signing-2010-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: appbundler.com", "e": [ "appbundler.com" ], "i": "metadata/signed/developer::appbundler.com", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Public Primary Certification Authority - G5", "e": [ "VeriSign Class 3 Public Primary Certification Authority - G5" ], "i": "metadata/signed/developer::verisign-class-3-public-primary-certification-authority---g5", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSignMPKI-2-8", "e": [ "VeriSignMPKI-2-8" ], "i": "metadata/signed/developer::verisignmpki-2-8", "l": 2 }, { "c": 1.0, "d": "Signed by appbundler.com", "e": [ "appbundler.com" ], "i": "metadata/signed/leaf::appbundler.com", "l": 3 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 7680.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1303516432.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics/markers::low-function-count-marker", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.function_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics::no-functions", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.50" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.1" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 116 (WSACleanup)", "e": [ "ORDINAL 116" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-116", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 208560.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "Z#c/ HTTP/1.1" ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 232.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.18" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "a": "T1016", "c": 0.8999999761581421, "d": "Enumerate local adapters via GetAdaptersInfo", "e": [ "GetAdaptersInfo" ], "i": "micro-behaviors/os/network/interface::get-adapters-info", "l": 3 }, { "c": 0.9800000190734863, "d": "AppBundler certificate subject", "e": [ "appbundler.com1\u003e0\u003c", "appbundler.com0" ], "i": "well-known/malware/trojan/appbundler::appbundler-cert-subject", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "IJKLMNOP", "PSCSIDISK" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 495616.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.18" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 196096, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 15.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "c": 1.0, "d": "Compatibility alias", "e": [ "GetAdaptersInfo" ], "i": "micro-behaviors/os/sysinfo/network::get-adapters-info", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "links GDI32.dll (PatBlt)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (UrlEscapeA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links IPHLPAPI.DLL (GetAdaptersInfo)", "e": [ "IPHLPAPI.DLL" ], "i": "metadata/dylib::iphlpapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDC)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueA)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (ORDINAL 116)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/markers::misleading-upx-sections", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "VS_VERSION_INFO", "ProductVersion", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.8399999737739563, "d": "Cleanup Winsock library", "e": [ "ORDINAL 116", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::winsock-cleanup-ordinal", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "c": 0.8399999737739563, "d": "Network byte order conversion", "e": [ "ORDINAL 9", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::htons-api-ordinal", "l": 2 }, { "a": "T1071", "c": 0.9300000071525574, "d": "UPX admin network fingerprinting loader", "e": [ "GetAdaptersInfo", "UPX1", "WS2_32.dll", "\u003crequestedExecutionLevel level=\"requireAdministrator", "UPX0", "GetProcAddress" ], "i": "objectives/command-and-control/backdoor::upx-admin-network-fingerprint-loader", "l": 4 }, { "a": "T1105", "c": 0.9800000190734863, "d": "AppBundler signed UPX admin loader", "e": [ "WS2_32.dll", "appbundler.com1\u003e0\u003c", "binary.entry_in_nonstandard_section = 1.00", "UPX1", "binary.function_count = 2.00", "GetAdaptersInfo", "VirtualAlloc", "GetProcAddress", "UPX0", "appbundler.com", "VirtualFree", "VirtualProtect", "appbundler.com0", "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "well-known/malware/trojan/appbundler::signed-upx-admin-loader", "l": 5 }, { "a": "T1071", "c": 0.9599999785423279, "d": "UPX admin dynamic network loader", "e": [ "UPX1", "\u003crequestedExecutionLevel level=\"requireAdministrator", "VirtualAlloc", "GetAdaptersInfo", "GetProcAddress", "WS2_32.dll", "binary.entry_in_nonstandard_section = 1.00", "binary.function_count = 2.00", "VirtualProtect", "VirtualFree", "UPX0" ], "i": "objectives/command-and-control/backdoor::upx-admin-dynamic-network-loader", "l": 5 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "VirtualAlloc", "binary.function_count = 2.00", "UPX0", "VirtualProtect", "GetProcAddress", "VirtualFree", "UPX1", "binary.entry_in_nonstandard_section = 1.00" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload::minimal-pe-dynamic-load", "l": 3, "m": "B0032" } ], "sha": "e1bd248cb502807e5c4c6cd8f0ea7e0d2fa96f751aa23f69802d339da45a8c48", "path": "8290", "type": "pe" } ], "tv": "feb13" } }