{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.33898306, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T06:22:05Z" }, "path": "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908.exe", "raw": { "v": "5", "fs": [ { "f": "H(Cm)Md(Pt)", "x": 6, "ff": { "i": [ [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindFirstFileA" ], [ "kernel32", "FindNextFileA" ], [ "kernel32", "FindResourceW" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetLastError" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "LoadResource" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "SizeofResource" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "VirtualProtect" ], [ "kernel32", "VirtualQuery" ], [ "msvcrt", "strdup" ], [ "msvcrt", "stricoll" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "mb_cur_max" ], [ "msvcrt", "p__environ" ], [ "msvcrt", "p__fmode" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "cexit" ], [ "msvcrt", "errno" ], [ "msvcrt", "fpreset" ], [ "msvcrt", "fullpath" ], [ "msvcrt", "iob" ], [ "msvcrt", "isctype" ], [ "msvcrt", "onexit" ], [ "msvcrt", "pctype" ], [ "msvcrt", "setmode" ], [ "msvcrt", "abort" ], [ "msvcrt", "atexit" ], [ "msvcrt", "calloc" ], [ "msvcrt", "free" ], [ "msvcrt", "fwrite" ], [ "msvcrt", "malloc" ], [ "msvcrt", "mbstowcs" ], [ "msvcrt", "memcpy" ], [ "msvcrt", "memset" ], [ "msvcrt", "realloc" ], [ "msvcrt", "setlocale" ], [ "msvcrt", "signal" ], [ "msvcrt", "strcoll" ], [ "msvcrt", "strlen" ], [ "msvcrt", "tolower" ], [ "msvcrt", "vfprintf" ], [ "msvcrt", "wcstombs" ] ], "m": { "pe": { "checksum": 181514.0, "checksum_valid": 1.0, "resource_count": 1.0, "computed_checksum": 181514.0, "tls_callback_count": 2.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 172544.0, "entropy": 7.15, "size_bytes": 172544.0 }, "binary": { "is_pie": 0.0, "code_entropy": 6.07, "data_entropy": 7.02, "string_count": 2679.0, "entropy_variance": 6.85, "avg_string_length": 4.34, "max_string_length": 46.0, "code_to_data_ratio": 0.08, "string_length_stddev": 2.22, "largest_section_ratio": 0.88, "sentence_string_count": 7.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 55.0 }, "sections": { "count": 9.0, "code_size": 13312.0, "entropy_max": 7.13, "entropy_mean": 3.33, "name_entropy": 3.72, "writable_count": 6.0, "executable_count": 1.0, "nonstandard_count": 2.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 456, "u8", ".rdata" ], [ 494, "u8", "0@.eh_fram" ], [ 534, "u8", "0@.bss" ], [ 576, "u8", ".idata" ], [ 616, "u8", ".CRT" ], [ 656, "u8", ".tls" ], [ 696, "u8", ".rsrc" ], [ 12576, "u8", "UWVS" ], [ 14848, "u8", "libgcc_s_dw2-1.dll" ], [ 14867, "u8", "__register_frame_info" ], [ 14889, "u8", "__deregister_frame_info" ], [ 14913, "u8", "libgcj-16.dll" ], [ 14927, "u8", "_Jv_RegisterClasses" ], [ 14968, "u8", "Mingw runtime failure:" ], [ 14992, "u8", "VirtualQuery failed for %d bytes at address %p" ], [ 15044, "u8", "Unknown pseudo relocation protocol version %d." ], [ 15096, "u8", "Unknown pseudo relocation bit size %d." ], [ 15142, "u8", "glob-1.0-mingw32" ], [ 15168, "u8", "GCC: (GNU) 6.3.0" ], [ 15208, "u8", "GCC: (MinGW.org GCC-6.3.0-1) 6.3.0" ], [ 18978, "u8", "DeleteCriticalSection" ], [ 19002, "u8", "EnterCriticalSection" ], [ 19026, "u8", "ExitProcess" ], [ 19040, "u8", "FindClose" ], [ 19052, "u8", "FindFirstFileA" ], [ 19070, "u8", "FindNextFileA" ], [ 19086, "u8", "FindResourceW" ], [ 19102, "u8", "FreeLibrary" ], [ 19116, "u8", "GetCommandLineA" ], [ 19134, "u8", "GetLastError" ], [ 19150, "u8", "GetModuleHandleA" ], [ 19170, "u8", "GetProcAddress" ], [ 19188, "u8", "InitializeCriticalSection" ], [ 19216, "u8", "LeaveCriticalSection" ], [ 19240, "u8", "LoadLibraryA" ], [ 19256, "u8", "LoadResource" ], [ 19272, "u8", "SetUnhandledExceptionFilter" ], [ 19302, "u8", "SizeofResource" ], [ 19320, "u8", "TlsGetValue" ], [ 19334, "u8", "VirtualAlloc" ], [ 19350, "u8", "VirtualProtect" ], [ 19368, "u8", "VirtualQuery" ], [ 19384, "u8", "_strdup" ], [ 19394, "u8", "_stricoll" ], [ 19406, "u8", "__getmainargs" ], [ 19422, "u8", "__mb_cur_max" ], [ 19438, "u8", "__p__environ" ], [ 19454, "u8", "__p__fmode" ], [ 19468, "u8", "__set_app_type" ], [ 19486, "u8", "_cexit" ], [ 19496, "u8", "_errno" ], [ 19506, "u8", "_fpreset" ], [ 19518, "u8", "_fullpath" ], [ 19538, "u8", "_isctype" ], [ 19550, "u8", "_onexit" ], [ 19560, "u8", "_pctype" ], [ 19570, "u8", "_setmode" ], [ 19582, "u8", "abort" ], [ 19590, "u8", "atexit" ], [ 19600, "u8", "calloc" ], [ 19610, "u8", "free" ], [ 19618, "u8", "fwrite" ], [ 19628, "u8", "malloc" ], [ 19638, "u8", "mbstowcs" ], [ 19650, "u8", "memcpy" ], [ 19660, "u8", "memset" ], [ 19670, "u8", "realloc" ], [ 19680, "u8", "setlocale" ], [ 19692, "u8", "signal" ], [ 19702, "u8", "strcoll" ], [ 19712, "u8", "strlen" ], [ 19722, "u8", "tolower" ], [ 19732, "u8", "vfprintf" ], [ 19744, "u8", "wcstombs" ], [ 19844, "u8", "KERNEL32.dll" ], [ 19868, "u8", "msvcrt.dll" ], [ 23433, "u8", "gYix" ], [ 54000, "u8", "QlqJH" ], [ 57185, "u8", "TtCpNI" ], [ 58215, "u8", "TtCpHE" ], [ 63205, "u8", "PlqKH" ], [ 63577, "u8", "q9e9f" ], [ 102778, "u8", "t9RRF" ], [ 104923, "u8", "gaQVP" ], [ 111663, "u8", "TZWS" ], [ 113054, "u8", "ZRWB" ], [ 121399, "u8", "YQTA" ], [ 124114, "u8", "Fcnt" ], [ 124139, "u8", "Ahac" ], [ 124149, "u8", "Mdwr" ], [ 124239, "u8", "zuee" ], [ 124264, "u8", "hfau" ], [ 124304, "u8", "iwar" ], [ 124324, "u8", "fowe" ], [ 124484, "u8", "lsee" ], [ 124534, "u8", "hoev" ], [ 124624, "u8", "lmae" ], [ 125084, "u8", "ieaw" ], [ 125224, "u8", "iwfe" ], [ 125429, "u8", "Vtjp" ], [ 125469, "u8", "Vbhc" ], [ 125539, "u8", "hrau" ], [ 128589, "u8", "luQb" ], [ 128629, "u8", "Yntd" ], [ 128639, "u8", "Hbpx" ], [ 129624, "u8", "zeeh" ], [ 129634, "u8", "moab" ], [ 129654, "u8", "geeh" ], [ 129764, "u8", "LGCY" ], [ 129774, "u8", "FQUC" ], [ 129794, "u8", "jeaw" ], [ 129804, "u8", "doka" ], [ 131689, "u8", "HCGU" ], [ 131694, "u8", "OFLX" ], [ 131699, "u8", "BMI_" ], [ 131704, "u8", "YPVB" ], [ 131714, "u8", "SZXL" ], [ 131724, "u8", "MDBV" ], [ 131739, "u8", "ZUQG" ], [ 131884, "u8", "IADQ" ], [ 132134, "u8", "IAES" ], [ 132249, "u8", "guac" ], [ 132254, "u8", "luWt" ], [ 132259, "u8", "Fqpx" ], [ 132329, "u8", "4ADQ" ], [ 132340, "u8", "14.9.13.27:5278" ], [ 132544, "u8", "XSWE" ], [ 133069, "u8", "Znbe" ], [ 133524, "u8", "Zmat" ], [ 133539, "u8", "llPx" ], [ 133620, "u8", "14.9.13.27:5278" ], [ 134099, "u8", "7ADQ" ], [ 134309, "u8", "IADP" ], [ 134314, "u8", "JEAW" ], [ 134319, "u8", "AHNZ" ], [ 134324, "u8", "DOKA" ], [ 134404, "u8", "Gtis" ], [ 134484, "u8", "ZNBE" ], [ 134489, "u8", "HSAM" ], [ 134509, "u8", "nsea" ], [ 134744, "u8", "Zdht" ], [ 134944, "u8", "837Q" ], [ 135384, "u8", "ZDHT" ], [ 135684, "u8", "Fqac" ], [ 135854, "u8", "lLeb" ], [ 135859, "u8", "lsTp" ], [ 135944, "u8", "Anwe" ], [ 135954, "u8", "zuJp" ], [ 135964, "u8", "Ynve" ], [ 135984, "u8", "Encx" ], [ 135994, "u8", "lsJp" ], [ 136064, "u8", "l[m}" ], [ 136249, "u8", "Zues" ], [ 137020, "u8", "14.9.13.27:5278" ], [ 137364, "u8", "XSBU" ], [ 137389, "u8", "FQVI" ], [ 137464, "u8", "L5SU" ], [ 137469, "u8", "FH3I" ], [ 137474, "u8", "BGUT" ], [ 137509, "u8", "QXNH" ], [ 137549, "u8", "9KLE" ], [ 137579, "u8", "DOAH" ], [ 137604, "u8", "NX2D" ], [ 137824, "u8", "9S6H" ], [ 137929, "u8", "M02E" ], [ 138009, "u8", "KCTI" ], [ 138079, "u8", "SBVP" ], [ 138159, "u8", "SKRS" ], [ 138164, "u8", "9EUK" ], [ 138224, "u8", "P1TU" ], [ 138309, "u8", "BULX" ], [ 138384, "u8", "FJ2P" ], [ 138429, "u8", "NQIX" ], [ 138474, "u8", "9JVF" ], [ 138519, "u8", "JTRD" ], [ 138569, "u8", "DVGT" ], [ 138574, "u8", "QVFD" ], [ 138684, "u8", "P6RY" ], [ 138719, "u8", "Q9AS" ], [ 138789, "u8", "YE7D" ], [ 138839, "u8", "PXOU" ], [ 138849, "u8", "9IKW" ], [ 138894, "u8", "BG6B" ], [ 138899, "u8", "GQBZ" ], [ 138969, "u8", "STWF" ], [ 138974, "u8", "ZUJX" ], [ 139094, "u8", "C8LW" ], [ 139214, "u8", "LKSC" ], [ 139244, "u8", "HM6F" ], [ 139324, "u8", "KP6K" ], [ 139334, "u8", "PSGF" ], [ 139409, "u8", "JO5K" ], [ 139464, "u8", "9O1W" ], [ 139494, "u8", "ZNVC" ], [ 139499, "u8", "QR5A" ], [ 139504, "u8", "N11C" ], [ 139519, "u8", "ETK_" ], [ 139609, "u8", "O238" ], [ 139629, "u8", "MEJP" ], [ 139699, "u8", "JNBR" ], [ 139729, "u8", "HFMW" ], [ 139749, "u8", "043I" ], [ 139754, "u8", "L54F" ], [ 139779, "u8", "07QW" ], [ 139814, "u8", "M90B" ], [ 139844, "u8", "UZ52" ], [ 139879, "u8", "PGHF" ], [ 139904, "u8", "ZR7V" ], [ 139924, "u8", "9HKZ" ], [ 139949, "u8", "DRMS" ], [ 139954, "u8", "8D6X" ], [ 139999, "u8", "C00R" ], [ 140024, "u8", "LSEC" ], [ 140054, "u8", "X6VB" ], [ 140059, "u8", "8S6U" ], [ 140289, "u8", "ZGGD" ], [ 140344, "u8", "FSHE" ], [ 140454, "u8", "NWUZ" ], [ 140524, "u8", "V057" ], [ 140534, "u8", "HPKP" ], [ 140564, "u8", "NCJA" ], [ 140654, "u8", "9BBD" ], [ 140659, "u8", "YHIA" ], [ 140684, "u8", "XE3X" ], [ 140759, "u8", "9W4P" ], [ 140814, "u8", "OE3G" ], [ 140824, "u8", "QLUE" ], [ 140834, "u8", "S86A" ], [ 140884, "u8", "ENFI" ], [ 140914, "u8", "OE0P" ], [ 140919, "u8", "S00C" ], [ 140949, "u8", "Z9OK" ], [ 140954, "u8", "MWNE" ], [ 140994, "u8", "NS4F" ], [ 141134, "u8", "J85A" ], [ 141139, "u8", "Q2IT" ], [ 141234, "u8", "NFGY" ], [ 141324, "u8", "FM6H" ], [ 141359, "u8", "MK4U" ], [ 141389, "u8", "HEGH" ], [ 141449, "u8", "NOED" ], [ 141489, "u8", "ABK_" ], [ 141604, "u8", "GWLX" ], [ 141639, "u8", "OO3D" ], [ 141644, "u8", "GS1K" ], [ 141729, "u8", "KG6_" ], [ 141759, "u8", "8VTB" ], [ 141839, "u8", "MM0_" ], [ 142124, "u8", "SMQA" ], [ 142134, "u8", "A33V" ], [ 142139, "u8", "FRFX" ], [ 142169, "u8", "AKPW" ], [ 142244, "u8", "V64O" ], [ 142259, "u8", "SOSH" ] ], "v": { "file.stem": "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908", "pe.imphash": "c0f9401b13dd35f3e11f2b5cc5de60ea", "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 1700041171, "file.basename": "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908.exe", "pe.image_base": 4194304, "pe.image_size": 200704, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4832, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.image_hash.sha1": "3fd062e84d03485b63630a9968f338a24cc38535", "pe.image_hash.sha256": "fd7e301007a0b920da6ce0a9d851414ebcb4ce4ec6b26c0c0c00cf9c13419f96", "pe.image_hash.sha384": "38c651aa101d88169f68e0557077dcc667f76b6b1dd76e60609a37f6ba6d52d2383968ca2206b5be6895fe24fa08e502", "pe.image_hash.sha512": "822a5f138a7e079aec4260820a4a0a078cae24ecb7e878df7a90d05afe557b913db1051a706434bb8d6f3824f9e85f98d0b9fb07f054bb9b742c29767da5b229", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 783, "pe.linker_major_version": 2, "pe.linker_minor_version": 28, "pe.tls_callbacks[0].addr": "0x4020a0", "pe.tls_callbacks[1].addr": "0x402050", "pe.data_directories[0].rva": 36864, "pe.data_directories[1].rva": 49152, "pe.data_directories[2].rva": 45060, "pe.data_directories[3].rva": 37176, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 1584, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 150624, "pe.data_directories[2].name": "tls", "pe.data_directories[2].size": 24, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 232, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 1024, 13312, 6.07, "r-x" ], [ ".data", 14336, 512, 0.22, "rw-" ], [ ".rdata", 14848, 1024, 4.09, "r--" ], [ ".eh_fram", 15872, 2560, 4.83, "r--" ], [ ".bss", 0, 0, 0.0, "rw-" ], [ ".idata", 18432, 2048, 3.95, "rw-" ], [ ".CRT", 20480, 512, 0.11, "rw-" ], [ ".tls", 20992, 512, 0.22, "rw-" ], [ ".rsrc", 21504, 151040, 7.13, "rw-" ] ] }, "id": 0, "sz": 172544, "ts": [ { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE has multiple TLS callbacks", "e": [ "pe.tls_callback_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-multi-callbacks", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2679.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x91f8" ] }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2, "el": [ "0x91e4" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x9138" ] }, { "c": 1.0, "d": "Large PE resource section with high entropy", "e": [ ".rsrc (size: 151040, entropy: 7.13)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-high-entropy-rsrc", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2679.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x3a00" ] }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 151040, entropy: 7.13)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "MinGW pseudo relocation message", "e": [ "Unknown pseudo relocation" ], "i": "metadata/binary/framework::mingw-pseudoreloc-runtime", "l": 2, "el": [ "0x3ac4" ] }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x9168" ] }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2, "el": [ "0x91d8" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 55.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x9160" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2679.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x916c" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "Allocate zeroed memory", "e": [ "calloc" ], "i": "micro-behaviors/mem/c-runtime/functions::calloc", "l": 2, "el": [ "0x91e0" ] }, { "c": 0.8999999761581421, "d": "Install signal handler", "e": [ "signal" ], "i": "micro-behaviors/os/signal/handler::signal", "l": 2, "el": [ "0x9204" ] }, { "c": 0.8999999761581421, "d": "Reallocate memory", "e": [ "realloc" ], "i": "micro-behaviors/mem/c-runtime/functions::realloc", "l": 2, "el": [ "0x91fc" ] }, { "c": 0.9300000071525574, "d": "MinGW libgcc runtime dependency", "e": [ "libgcc_s_dw2-1.dll" ], "i": "metadata/binary/framework::mingw-libgcc-runtime", "l": 2, "el": [ "0x3a00" ] }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x91f4" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 55.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2, "el": [ "0x9184" ] }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callback_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 55.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x9178" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "UHARC linker major version", "e": [ "2" ], "i": "metadata/binary/framework::uharc-linker-major", "l": 2, "el": [ "value:pe.linker_major_version" ] }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 4.09)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2, "el": [ "0x9148" ] }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2, "el": [ "0x914c" ] }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2, "el": [ "0x91ec" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.07" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.9300000071525574, "d": "GCJ runtime library dependency", "e": [ "libgcj-16.dll" ], "i": "metadata/binary/framework::gcj-runtime-library", "l": 2, "el": [ "0x3a41" ] }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2, "el": [ "0x917c" ] }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2, "el": [ "0x9154" ] }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021", "el": [ "0x9188" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x9180" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x915c" ] }, { "c": 0.8999999761581421, "d": "String length", "e": [ "strlen" ], "i": "micro-behaviors/data/string/library::strlen", "l": 2, "el": [ "0x920c" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "40" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x872" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "TlsGetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x4b78" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x4ae2" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x9170" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "libgcc / libstdc++ runtime marker", "e": [ "GCC: (GNU)" ], "i": "metadata/lang/compiler/native::mingw-runtime-marker", "l": 3, "el": [ "0x3b40" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 2679.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-w", "l": 2, "el": [ "0x9150" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "40" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "0x872" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 55.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2, "el": [ "0x9144" ] }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2, "el": [ "0x9174" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x9140" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2, "el": [ "0x918c" ] }, { "c": 0.8999999761581421, "d": "Variadic formatted output", "e": [ "vfprintf" ], "i": "micro-behaviors/os/stdio::vfprintf", "l": 2, "el": [ "0x9214" ] }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "0x9188" ] }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 151040)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x913c" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 55.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x9158" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2679.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeCriticalSection", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x4af4", "0x4b48" ] }, { "c": 0.949999988079071, "d": "Multiple external IPv4 endpoints in PE resources", "e": [ "14.9.13.27:5278" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-rsrc-pair", "l": 3, "el": [ "0x204f4" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Very low code-to-data ratio (large PE payload)", "e": [ "binary.code_to_data_ratio = 0.08" ], "i": "objectives/anti-static/obfuscation/payload/section::low-code-to-data-ratio-pe", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x3630" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "0x4b86" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (size: 151040, entropy: 7.13)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 3, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x9164" ] }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "14.9.13.27:5278" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1, "el": [ "0x204f4" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 55.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links kernel32 (DeleteCriticalSection, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileA, ... +17 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "22 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcrt (strdup, stricoll, getmainargs, mb_cur_max, p__environ, ... +28 more)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "33 symbols" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x9164", "0x9160" ] }, { "c": 0.9399999976158142, "d": "MinGW native wrapper for GCJ", "e": [ "libgcc_s_dw2-1.dll", "Unknown pseudo relocation", "libgcj-16.dll" ], "i": "metadata/binary/framework::mingw-gcj-native-wrapper", "l": 2, "el": [ "0x3a00", "0x3ac4", "0x3a41" ] }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindClose", "FindFirstFileA", "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2, "el": [ "0x9144", "0x9148", "0x914c" ] } ], "sha": "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-11/e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908.exe", "type": "pe" } ], "tv": "52045" } }