{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.99328107, "class": 0 }, { "m": "az/pe", "prob": 0.22268908, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T03:58:29Z" }, "path": "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 5, "ff": { "i": [ [ "msvbvm60", "ORDINAL 584" ], [ "msvbvm60", "CIcos" ], [ "msvbvm60", "adj_fptan" ], [ "msvbvm60", "vbaVarMove" ], [ "msvbvm60", "ORDINAL 586" ], [ "msvbvm60", "vbaFreeVar" ], [ "msvbvm60", "vbaAryMove" ], [ "msvbvm60", "vbaStrVarMove" ], [ "msvbvm60", "vbaFreeVarList" ], [ "msvbvm60", "vbaEnd" ], [ "msvbvm60", "adj_fdiv_m64" ], [ "msvbvm60", "vbaFreeObjList" ], [ "msvbvm60", "adj_fprem1" ], [ "msvbvm60", "vbaRecAnsiToUni" ], [ "msvbvm60", "ORDINAL 519" ], [ "msvbvm60", "ORDINAL 552" ], [ "msvbvm60", "vbaSetSystemError" ], [ "msvbvm60", "vbaRecDestruct" ], [ "msvbvm60", "vbaHresultCheckObj" ], [ "msvbvm60", "ORDINAL 557" ], [ "msvbvm60", "adj_fdiv_m32" ], [ "msvbvm60", "ORDINAL 666" ], [ "msvbvm60", "vbaAryDestruct" ], [ "msvbvm60", "ORDINAL 594" ], [ "msvbvm60", "vbaObjSet" ], [ "msvbvm60", "vbaOnError" ], [ "msvbvm60", "ORDINAL 595" ], [ "msvbvm60", "adj_fdiv_m16i" ], [ "msvbvm60", "vbaObjSetAddref" ], [ "msvbvm60", "adj_fdivr_m16i" ], [ "msvbvm60", "ORDINAL 703" ], [ "msvbvm60", "ORDINAL 705" ], [ "msvbvm60", "vbaFpR8" ], [ "msvbvm60", "CIsin" ], [ "msvbvm60", "vbaChkstk" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "vbaGenerateBoundsError" ], [ "msvbvm60", "vbaStrCmp" ], [ "msvbvm60", "vbaAryConstruct2" ], [ "msvbvm60", "vbaVarTstEq" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "ORDINAL 671" ], [ "msvbvm60", "adj_fpatan" ], [ "msvbvm60", "vbaLateIdCallLd" ], [ "msvbvm60", "vbaRecUniToAnsi" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "vbaUI1I2" ], [ "msvbvm60", "CIsqrt" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "adj_fprem" ], [ "msvbvm60", "adj_fdivr_m64" ], [ "msvbvm60", "vbaFPException" ], [ "msvbvm60", "ORDINAL 535" ], [ "msvbvm60", "ORDINAL 536" ], [ "msvbvm60", "ORDINAL 538" ], [ "msvbvm60", "CIlog" ], [ "msvbvm60", "vbaErrorOverflow" ], [ "msvbvm60", "ORDINAL 647" ], [ "msvbvm60", "vbaNew2" ], [ "msvbvm60", "vbaVar2Vec" ], [ "msvbvm60", "vbaInStr" ], [ "msvbvm60", "ORDINAL 648" ], [ "msvbvm60", "adj_fdiv_m32i" ], [ "msvbvm60", "adj_fdivr_m32i" ], [ "msvbvm60", "vbaStrCopy" ], [ "msvbvm60", "vbaFreeStrList" ], [ "msvbvm60", "adj_fdivr_m32" ], [ "msvbvm60", "adj_fdiv_r" ], [ "msvbvm60", "ORDINAL 685" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "vbaVarTstNe" ], [ "msvbvm60", "vbaI4Var" ], [ "msvbvm60", "ORDINAL 610" ], [ "msvbvm60", "ORDINAL 611" ], [ "msvbvm60", "vbaStrToAnsi" ], [ "msvbvm60", "ORDINAL 612" ], [ "msvbvm60", "vbaVarDup" ], [ "msvbvm60", "ORDINAL 613" ], [ "msvbvm60", "vbaFpI4" ], [ "msvbvm60", "vbaRecDestructAnsi" ], [ "msvbvm60", "CIatan" ], [ "msvbvm60", "vbaStrMove" ], [ "msvbvm60", "allmul" ], [ "msvbvm60", "vbaLateIdSt" ], [ "msvbvm60", "ORDINAL 544" ], [ "msvbvm60", "ORDINAL 652" ], [ "msvbvm60", "CItan" ], [ "msvbvm60", "CIexp" ], [ "msvbvm60", "vbaFreeObj" ], [ "msvbvm60", "vbaFreeStr" ], [ "msvbvm60", "ORDINAL 580" ] ], "m": { "pe": { "checksum": 134245.0, "icon_count": 2.0, "checksum_valid": 1.0, "resource_count": 3.0, "has_version_info": 1.0, "computed_checksum": 134245.0, "bound_import_count": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 4245696169.0 }, "file": { "size": 102400.0, "entropy": 5.91, "size_bytes": 102400.0 }, "binary": { "is_pie": 0.0, "code_entropy": 6.45, "data_entropy": 0.0, "string_count": 985.0, "entropy_variance": 6.96, "avg_string_length": 6.35, "max_string_length": 144.0, "code_to_data_ratio": 0.95, "string_length_stddev": 6.16, "largest_section_ratio": 0.84, "sentence_string_count": 4.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 92.0 }, "sections": { "count": 3.0, "code_size": 86016.0, "entropy_max": 6.45, "entropy_mean": 3.08, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 168, "u8", "Rich" ], [ 432, "u8", ".text" ], [ 512, "u8", ".rsrc" ], [ 568, "u8", "MSVBVM60.DLL" ], [ 4126, "u8", "GsbrIs" ], [ 4214, "u8", "HszcHs" ], [ 4357, "u8", "jGsEjGs" ], [ 4382, "u8", "IstLGs" ], [ 4410, "u8", "GspuIs" ], [ 5716, "u8", "Notitionbr5" ], [ 5836, "u8", "postdistrik" ], [ 5852, "u8", "KUNSTGDNINGSREJ" ], [ 7474, "u8", "noUm" ], [ 7511, "u8", "dfaaba" ], [ 7576, "u8", "BCDE" ], [ 9266, "u8", "JJQ__" ], [ 9329, "u8", "3...__" ], [ 9602, "u8", "File1" ], [ 9630, "u8", "Drive1" ], [ 9659, "u8", "List1" ], [ 9687, "u8", "Option1" ], [ 9699, "u8", "MACROSPORICMET" ], [ 9735, "u8", "Command1" ], [ 9748, "u8", "Avlsdyren" ], [ 9779, "u8", "Command2" ], [ 9792, "u8", "Syndserkendel1" ], [ 9828, "u8", "Text1" ], [ 9847, "u8", "Aktionsargument" ], [ 9875, "u8", "Text2" ], [ 9894, "u8", "healersfootsor" ], [ 9921, "u8", "Frame1" ], [ 9932, "u8", "EXPROPRI" ], [ 9962, "u8", "Frame5" ], [ 9973, "u8", "Dummepeter" ], [ 10005, "u8", "Line1" ], [ 10041, "u8", "Line2" ], [ 10077, "u8", "Shape1" ], [ 10103, "u8", "Label1" ], [ 10114, "u8", "MIKROFILMTON" ], [ 10148, "u8", "Label2" ], [ 10159, "u8", "Hokuspokusdata" ], [ 10195, "u8", "Label3" ], [ 10206, "u8", "proofreaded" ], [ 10239, "u8", "Label4" ], [ 10250, "u8", "Selskabsnavne6" ], [ 10286, "u8", "Label14" ], [ 10298, "u8", "gangsyste" ], [ 10329, "u8", "Image1" ], [ 11975, "u8", "iYcw" ], [ 13353, "u8", "gSuf" ], [ 13603, "u8", "JYcwS" ], [ 14061, "u8", "bw53" ], [ 14887, "u8", "cYcw" ], [ 15407, "u8", "yYcw" ], [ 15580, "u8", "eaw5" ], [ 17203, "u8", "eYcw" ], [ 17436, "u8", "oGOu5" ], [ 17604, "u8", "Haw53" ], [ 18700, "u8", "/bw5" ], [ 20919, "u8", "0Skw5" ], [ 21747, "u8", "5Wcw6" ], [ 21931, "u8", "5ScwkZ" ], [ 22192, "u8", "iaw5" ], [ 22582, "u8", "r9Scw" ], [ 22606, "u8", "r5Scw" ], [ 22763, "u8", "eScw" ], [ 24262, "u8", "BZc78Sb" ], [ 24753, "u8", "aw53" ], [ 24824, "u8", "/aw53" ], [ 26471, "u8", "0Sbw5" ], [ 27450, "u8", "r5Zcw" ], [ 28076, "u8", "Gbw5Z" ], [ 29152, "u8", "Scwm" ], [ 30169, "u8", "cw5Zb" ], [ 31021, "u8", "ulnLC" ], [ 31340, "u8", "9jke" ], [ 31435, "u8", "qZcw5" ], [ 31447, "u8", "qZcw" ], [ 31671, "u8", "yZcw" ], [ 31723, "u8", "uZcw" ], [ 32597, "u8", "jw53" ], [ 32803, "u8", "aYcw" ], [ 34119, "u8", "VYcwSb" ], [ 34504, "u8", "IcwSb" ], [ 34907, "u8", "bJcw" ], [ 38652, "u8", "Ccw5b" ], [ 38777, "u8", "wySb" ], [ 38815, "u8", "uYcw" ], [ 38904, "u8", "Zcwm" ], [ 39640, "u8", "faw5c" ], [ 39913, "u8", "aw5c" ], [ 39923, "u8", "uYcwUTR" ], [ 40148, "u8", "aaw5" ], [ 40445, "u8", "gw53" ], [ 40564, "u8", "/aw5" ], [ 43636, "u8", "Zcw5T" ], [ 44680, "u8", "[cw}" ], [ 46814, "hex", "\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"/" ], [ 48248, "u8", "RUTSCHEDEDEFE" ], [ 52464, "u8", "Elatinguds3" ], [ 52527, "u8", "bDyxO" ], [ 52580, "u8", "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 52804, "u8", "Form" ], [ 53088, "u8", "PolyPolyline" ], [ 53416, "u8", "kernel32" ], [ 53432, "u8", "GetVersionExA" ], [ 53504, "u8", "comdlg32.dll" ], [ 53524, "u8", "ChooseColorA" ], [ 53596, "u8", "gdi32" ], [ 53608, "u8", "CreateDCA" ], [ 53624, "u8", "SetStretchBltMode" ], [ 53700, "u8", "PSAPI.DLL" ], [ 53716, "u8", "EnumProcessModules" ], [ 53792, "u8", "GetFileAttributesA" ], [ 53868, "u8", "user32" ], [ 53880, "u8", "DestroyIcon" ], [ 53944, "u8", "Ammen7" ], [ 53952, "u8", "Annelenes" ], [ 53964, "u8", "Skrekniven" ], [ 53976, "u8", "VITELLIN" ], [ 53988, "u8", "Lynafledere" ], [ 54168, "wide", "Boretaarne" ], [ 54276, "wide", "COPAL" ], [ 54292, "wide", "PROPMEN" ], [ 54312, "wide", "JERNBANESTATIONS" ], [ 54352, "wide", "VENOMISATION" ], [ 54400, "wide", "Kontrahent" ], [ 54428, "wide", "Jargonal7" ], [ 54468, "wide", "Epizoal2" ], [ 54492, "wide", "BIOGENSOCTAETER" ], [ 54528, "wide", "Runitehydrophil" ], [ 54580, "wide", "EVOKED" ], [ 54600, "wide", "AKKUMULERES" ], [ 54656, "wide", "SHEARS" ], [ 54676, "wide", "6:6:6" ], [ 54708, "wide", "Proheim" ], [ 54728, "wide", "Out of string space" ], [ 54772, "wide", "Slipnoose" ], [ 54796, "wide", "betjeningspaneler" ], [ 54864, "wide", "endebalders" ], [ 54888, "u8", "VBA6.DLL" ], [ 54944, "u8", "__vbaVarTstNe" ], [ 54960, "u8", "__vbaVarTstEq" ], [ 54976, "u8", "__vbaEnd" ], [ 55000, "u8", "__vbaErrorOverflow" ], [ 55020, "u8", "__vbaSetSystemError" ], [ 55040, "u8", "__vbaFreeObj" ], [ 55056, "u8", "__vbaRecDestruct" ], [ 55076, "u8", "__vbaAryDestruct" ], [ 55096, "u8", "__vbaLateIdSt" ], [ 55112, "u8", "__vbaObjSetAddref" ], [ 55132, "u8", "__vbaOnError" ], [ 55148, "u8", "__vbaRecDestructAnsi" ], [ 55172, "u8", "__vbaRecAnsiToUni" ], [ 55192, "u8", "__vbaRecUniToAnsi" ], [ 55224, "u8", "__vbaStrCopy" ], [ 55240, "u8", "__vbaFreeVarList" ], [ 55260, "u8", "__vbaVar2Vec" ], [ 55276, "u8", "__vbaAryMove" ], [ 55292, "u8", "__vbaStrVarMove" ], [ 55308, "u8", "__vbaFreeStrList" ], [ 55328, "u8", "__vbaStrToAnsi" ], [ 55344, "u8", "__vbaVarMove" ], [ 55360, "u8", "__vbaFreeVar" ], [ 55376, "u8", "__vbaFreeObjList" ], [ 55396, "u8", "__vbaLateIdCallLd" ], [ 55428, "u8", "__vbaGenerateBoundsError" ], [ 55456, "u8", "__vbaFreeStr" ], [ 55472, "u8", "__vbaStrMove" ], [ 55500, "u8", "__vbaHresultCheckObj" ], [ 55548, "u8", "__vbaAryConstruct2" ], [ 55760, "u8", "filatelisti" ], [ 56464, "u8", "Espressoens" ], [ 56476, "u8", "Cruster4" ], [ 56488, "u8", "eastern" ], [ 56496, "u8", "BNKEVLLINGS" ], [ 56508, "u8", "BLUFRDIGHEDS" ], [ 56524, "u8", "RINGSKRE" ], [ 56536, "u8", "Maskinparkerne1" ], [ 56552, "u8", "Flongs" ], [ 56560, "u8", "OLDFRUE" ], [ 56568, "u8", "Bedaaret" ], [ 56580, "u8", "Picked" ], [ 85242, "u8", "_adj_fptan" ], [ 85354, "u8", "_adj_fdiv_m64" ], [ 85390, "u8", "_adj_fprem1" ], [ 85490, "u8", "_adj_fdiv_m32" ], [ 85556, "u8", "_adj_fdiv_m16i" ], [ 85594, "u8", "_adj_fdivr_m16i" ], [ 85634, "u8", "__vbaChkstk" ], [ 85648, "u8", "EVENT_SINK_AddRef" ], [ 85748, "u8", "DllFunctionCall" ], [ 85766, "u8", "_adj_fpatan" ], [ 85820, "u8", "EVENT_SINK_Release" ], [ 85856, "u8", "_CIsqrt" ], [ 85866, "u8", "EVENT_SINK_QueryInterface" ], [ 85894, "u8", "__vbaExceptHandler" ], [ 85916, "u8", "_adj_fprem" ], [ 85930, "u8", "_adj_fdivr_m64" ], [ 85948, "u8", "__vbaFPException" ], [ 86042, "u8", "_adj_fdiv_m32i" ], [ 86060, "u8", "_adj_fdivr_m32i" ], [ 86114, "u8", "_adj_fdivr_m32" ], [ 86132, "u8", "_adj_fdiv_r" ], [ 86244, "u8", "_CIatan" ], [ 86270, "u8", "_allmul" ], [ 94502, "wide", "VS_VERSION_INFO" ], [ 94594, "wide", "VarFileInfo" ], [ 94626, "wide", "Translation" ], [ 94662, "wide", "StringFileInfo" ], [ 94698, "wide", "040904B0" ], [ 94722, "wide", "Comments" ], [ 94740, "wide", "Enclosure Systems" ], [ 94782, "wide", "CompanyName" ], [ 94850, "wide", "ProductName" ], [ 94918, "wide", "FileVersion" ], [ 94944, "wide", "1.04" ], [ 94962, "wide", "ProductVersion" ], [ 95010, "wide", "InternalName" ], [ 95036, "wide", "RUTSCHEDEDEFE" ], [ 95070, "wide", "OriginalFilename" ], [ 95104, "wide", "RUTSCHEDEDEFE.exe" ] ], "v": { "file.stem": "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a", "pe.imphash": "2cca36a8b780dda46ffe453bdc810c88", "pe.machine": "i386", "pe.rich.key": 2292859599, "pe.rich.hash": "8854d3ec095906a7589b343a26214183", "pe.subsystem": "windows_gui", "pe.timestamp": 1268288620, "file.basename": "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a.exe", "pe.image_base": 4194304, "pe.image_size": 106496, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 5656, "pe.headers_size": 4096, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "5e08ce0fb81e8a6049f64a32e46ebbe165d9f5f4", "pe.version.comments": "Enclosure Systems", "pe.image_hash.sha256": "34fa9b56dfd3950e9bf74b783a17f4c89c4e17ee697f22135fc6b9af34e1cfdf", "pe.image_hash.sha384": "81f21e0901fe7223e1cfb7d02472bb3fff38b5347858bf0bc98d48d881b958f854070e057c8ceccbc3dfed98502fbcb1", "pe.image_hash.sha512": "ac6e9b03acf7d41c3862611d1231a7590db3bd832b541ce5a36d04cdf907ec6565a74b72a51d16d18bc3d9a19e55dc2752b39853a7c1830142959028e997fbb1", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.resource_timestamp": 1268288620, "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 84804, "pe.data_directories[1].rva": 98304, "pe.data_directories[2].rva": 552, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 4566, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 372, "pe.rich.entries[0].build_id": 14, "pe.rich.entries[1].build_id": 9, "pe.rich.entries[2].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 2, "pe.rich.entries[2].use_count": 1, "pe.coff.dos_header_pe_pointer": 184, "pe.rich.entries[0].product_id": 7299, "pe.rich.entries[1].product_id": 8783, "pe.rich.entries[2].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1208139325 }, "id": "pe", "sc": [ [ ".text", 4096, 86016, 6.45, "r-x" ], [ ".data", 90112, 4096, 0.0, "rw-" ], [ ".rsrc", 94208, 8192, 2.8, "r--" ] ] }, "id": 0, "sz": 102400, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xd100" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x238" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.45)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1, "el": [ "0xd1c4" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x14ef4" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x17126" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 985.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x1723e" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.45" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2, "el": [ "0xd0b8" ] }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x14f86" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1208139325,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x17322" ] }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x10a0" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0xcd64" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x1735e" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 92.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x17380" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x17282" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "Out of string space" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x171c6", "0xd5c8" ] }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x1b4d" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x1b4d" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x17380" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 584, CIcos, adj_fptan, vbaVarMove, ORDINAL 586, ... +87 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "92 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "DllFunctionCall", "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x14ef4", "0x238" ] } ], "sha": "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a", "path": "e1cd92cb67699c2cea95c4af1013cf34b6fda602a3596d48d4b21bb7f4248b2a.exe", "type": "pe" } ], "tv": "52045" } }