{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8344548940658569, "class": 0 } ], "prob": 0.8344549, "class": 0, "models": [ { "m": "az", "prob": 0.8344549, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T16:40:09Z" }, "path": "475500", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "k": { "hash.imp": "57093973dc531b4c9aa08a4e6323c528", "pe.timestamp": 1555518834, "hash.authenti": "d497739f4eb5c8411a25065933f5e6e2ec49d84472ffdcc7293d5221cff98386", "build.target_arch": "x86", "pe.linker_version": "12.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_MANIFEST", "pe.inflated_sections[0]": ".reloc", "pe.data_directories[0].rva": 78390, "pe.data_directories[1].rva": 81928, "pe.data_directories[2].rva": 94208, "pe.data_directories[3].rva": 36868, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 272, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 10980, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 16, "pe.data_directories[3].name": "load_config", "pe.data_directories[3].size": 72, "pe.load_config.security_cookie": "0x40904c", "pe.dll_characteristics.nx_compat": true, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.manifest.supported_os[0].guid": "{e2011457-1546-43c5-a5fe-008deee3d3f0}", "pe.manifest.supported_os[0].name": "vista", "pe.manifest.supported_os[1].guid": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.manifest.supported_os[1].name": "win7", "pe.manifest.supported_os[2].guid": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[2].name": "win8", "pe.manifest.supported_os[3].guid": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[3].name": "win8.1", "pe.manifest.supported_os[4].guid": "{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}", "pe.manifest.supported_os[4].name": "win10", "pe.section_characteristics[0].name": ".bss", "pe.section_characteristics[1].name": ".text", "pe.section_characteristics[2].name": ".rdata", "pe.section_characteristics[3].name": ".idata", "pe.section_characteristics[4].name": ".rsrc", "pe.section_characteristics[5].name": ".reloc", "pe.section_characteristics[6].name": "_STAS", "pe.dll_characteristics.dynamic_base": true, "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.manifest.dependencies[0].language": "*", "pe.manifest.requested_execution_level": "asInvoker", "pe.section_characteristics[0].raw_size": 1024, "pe.section_characteristics[1].raw_size": 27136, "pe.section_characteristics[2].raw_size": 40960, "pe.section_characteristics[3].raw_size": 1024, "pe.section_characteristics[4].raw_size": 11264, "pe.section_characteristics[5].raw_size": 512, "pe.section_characteristics[6].raw_size": 2098954, "pe.section_characteristics[0].virtual_size": 4096, "pe.section_characteristics[1].virtual_size": 28672, "pe.section_characteristics[2].virtual_size": 40960, "pe.section_characteristics[3].virtual_size": 4096, "pe.section_characteristics[4].virtual_size": 12288, "pe.section_characteristics[5].virtual_size": 4096, "pe.section_characteristics[6].virtual_size": 2101248, "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 8192, "pe.section_characteristics[2].virtual_address": 36864, "pe.section_characteristics[3].virtual_address": 77824, "pe.section_characteristics[4].virtual_address": 81920, "pe.section_characteristics[5].virtual_address": 94208, "pe.section_characteristics[6].virtual_address": 98304, "pe.section_characteristics[0].characteristics_hex": "c0000080", "pe.section_characteristics[1].characteristics_hex": "60000020", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "42000040", "pe.section_characteristics[6].characteristics_hex": "40000040", "pe.manifest.dependencies[0].processor_architecture": "x86" }, "x": 6, "id": 0, "is": [ "TlsSetValue", "QueryPerformanceCounter", "Sleep", "CreateEventW", "GetTickCount", "FormatMessageW", "TlsGetValue", "ExitProcess", "lstrcmpW", "CompareStringW", "SetEvent", "lstrcpyW", "ResetEvent", "IsProcessorFeaturePresent", "GetMenuState", "EnableWindow", "UpdateWindow", "SetMenuItemInfoW", "WindowFromPoint", "MessageBoxW", "GetParent", "GetMenuItemInfoW", "LoadMenuA", "ShowWindow" ], "ms": { "pe": { "entry": 21248.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 11264.0, "subsystem": 2.0, "timestamp": 1555518834.0, "icon_count": 2.0, "image_base": 4194304.0, "has_manifest": true, "rsrc_entropy": 6.15, "entry_section": ".text", "size_of_image": 2199552.0, "file_alignment": 512.0, "resource_count": 3.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON", "RT_MANIFEST" ], "characteristics": 258.0, "security_cookie": 4231244.0, "size_of_headers": 1024.0, "export_timestamp": 0.0, "import_dll_count": 2.0, "computed_checksum": 2187267.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 33088.0, "has_export_timestamp": false, "linker_major_version": 12.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "max_section_inflation_ratio": 8.0 }, "file": { "size": 2181898.0 }, "binary": { "code_size": 27136.0, "code_entropy": 6.31, "data_entropy": 4.05, "import_count": 24.0, "string_count": 9590.0, "section_count": 7.0, "import_density": 0.91, "string_density": 361.89, "overall_entropy": 3.61, "avg_section_size": 311553.44, "dependency_count": 2.0, "entropy_variance": 2.46, "avg_string_length": 26.84, "max_string_length": 1010.0, "avg_string_entropy": 3.42, "code_to_data_ratio": 0.01, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.01, "string_length_stddev": 21.31, "largest_section_ratio": 0.96, "sentence_string_count": 1611.0, "sentence_string_ratio": 0.17, "nonstandard_section_count": 1.0 } }, "ss": [ [ 312, ".bss" ], [ 352, ".text" ], [ 431, "@.idata" ], [ 471, "@.rsrc" ], [ 511, "@.reloc" ], [ 551, "B_STAS" ], [ 3358, "QQSVW" ], [ 3713, "QSVW" ], [ 21615, "stack", "lloc" ], [ 21622, "lloc3" ], [ 21656, "Virt" ], [ 30542, "xor", "nZO6nZ2\u0026nZ" ], [ 31082, "xor", "fZDUeZ'EeZ" ], [ 31786, "xor", "j*$ej*Guj*" ], [ 31917, "xor", "zh*'Ih*JYh*" ], [ 32105, "xor", "ye*4He*WXe*" ], [ 32853, "xor", "ey*%ty*HDy*" ], [ 33041, "xor", "dv*2sv*UCv*" ], [ 42345, "xor", ";I(jjI(MYI(P" ], [ 42550, "xor", "1YRP.Ywa.Y" ], [ 42657, "xor", "T+YEb+Yf3+Y" ], [ 42761, "xor", "X%XRf%Xu5%X" ], [ 65644, "Ayted sider." ], [ 65660, "Eerdtas tea ertt ycusn." ], [ 65684, "Thitoe ntanlaatsdeich ritoereo esitstin cifmcei aanot." ], [ 65740, "Fnpairshe uttni dinnarcro uvigl." ], [ 65776, "Dnirpceraet igfo." ], [ 65796, "Ds ysb tetls lalamnese." ], [ 65820, "Hoemtx yungca." ], [ 65836, "Iotamev lr eahtodnedr ustposev atnpecols lgactt swfahf." ], [ 65892, "A hspeorbh." ], [ 65908, "Nolt no wehrat etio." ], [ 65932, "oehuetrsa/besrne/oen" ], [ 65964, "um_csdoln/raudelc/aogseoht/ctaassaal/ato/eegaev" ], [ 66012, "teerhwaewse" ], [ 66024, "oslte/asmroe" ], [ 66040, "nfxersate/tteghopktefr/ttoembes" ], [ 66072, "dnpuegtl" ], [ 66084, "sapfunol/lbe" ], [ 66100, "aoti/diryahwdu" ], [ 66116, "wtmiled/taewbatsia/aowmvo/rfiqloihhyr" ], [ 66156, "ounluloetbs/iistkiytades/leedcyocoha/cyh_tnoykwa" ], [ 66208, "odtse/tweis/otrrado" ], [ 66228, "aonaan" ], [ 66236, "Ylfoarirroi a wtieth nrvi psnasrd deri." ], [ 66276, "Iatssaho ehrniotegnob." ], [ 66285, "xor", ":7-160+:810=q" ], [ 66300, "ehcs/saes_tesmoitel/lihesuc/hgeltcaamhte/renadesonm/ighiasst" ], [ 66364, "rtdiwtte/lnecaudaefn/tssese" ], [ 66392, "jegneisn/otdentit/mhtogtseb" ], [ 66420, "Doiktyf mawomtalln ti aadi enneux rsupecnohl tne ne." ], [ 66476, "Uhtna azoagr gotoawbhemlpy." ], [ 66512, "Sstiescroh nhs daocvuitiy ins tien." ], [ 66548, "Ewe esiid." ], [ 66560, "Lrneik." ], [ 66569, "rhoattalse ncupmaus uts kwren hairtha sma enefe sitciwo btyevdeknyse." ], [ 66640, "Liertewortlap ntoh eerxmu pnce." ], [ 66672, "Ansnogl dirrettat tefai hiatacmte." ], [ 66708, "Lheev ihsr imgpe hd naeg klbaadhevedy eensh." ], [ 66756, "Dkewnianannsied odtseh naetoesoih ia." ], [ 66796, "tttu/oyt/oushmins/lovuergkeafru/rrvias/aa" ], [ 66840, "Anffo mnidcenin lapod htwi safhsonliifmgenoatl eanwe." ], [ 66896, "Chalrasn aits." ], [ 66912, "ohnhemhuiti/dtta/uowcyytl" ], [ 66940, "iorgdandce/or_sen_grey" ], [ 66964, "Vhuesetsid ebnhiteo tdni." ], [ 66992, "Lninbognar aohedi in liirtd itla." ], [ 67028, "Nrranafaa atyd." ], [ 67044, "Easl ingfusierisntint." ], [ 67068, "Alenehnwyn sacuntii ouscreqri imfeis." ], [ 67108, "Evrho nsfil criedmsa tselmiho rosoli gtsoono trendsetnetdi eetkr traenylo." ], [ 67184, "Narcyale nlgisoat lrenesth." ], [ 67212, "Lrhedeitiis a lpgeybt." ], [ 67236, "Oleoti dbe siatpnaele mtaelnyene." ], [ 67272, "mnum/noelugsnah/tnw/hryanoob" ], [ 67277, "xor", "A@JCZH\\ANG" ], [ 67304, "Osatneb." ], [ 67340, "Nsin dlerloeneo eoflvaihigeneef." ], [ 67376, "Yicv coo uisi kliney." ], [ 67400, "Nimeicseekat niswli tyembihei." ], [ 67432, "Doi cept etltotlleloetto ndnethtansr." ], [ 67472, "Sieskra eugcaed podwtac ieveowy rhpic." ], [ 67512, "Lswoicsynss." ], [ 67532, "hsiehwo/oytilmne/optr/htaawoahenaareen" ], [ 67572, "bertav/aketu_luvhicmtite/ep_roehnteoreerd" ], [ 67616, "sdnens/ckoitierebc/atmerw/aedlmi/lsai_eadist/ndneutnuli" ], [ 67672, "aachnued/tntant" ], [ 67688, "oethutw/utltecrhiro" ], [ 67708, "Risneond aownw easniahh." ], [ 67736, "Ahipooldr ehlva dg." ], [ 67760, "irfto_cepuet/hnihla/twne/nusehtp/snse" ], [ 67800, "acetfalic/eenfuna/helahrpadg/ottetitseiseeta/ryphneahi" ], [ 67856, "ncwilttil/taa_thoetesd/fchanrd/cdw_forsseelu/idptoarsneh/ncose_naagtau/bbadnu" ], [ 67936, "soi/efni/iahhe_uhdoisav/arootitgto/hergipa/naedar" ], [ 67988, "A metghegbca ec iigyho droer." ], [ 68032, "Vaefbwan lih lmaevtalnwi." ], [ 68060, "ftaifemnophoer/cdtoa/tuuhlha/esr" ], [ 68096, "aacitocaitdaegtyany/rcnirne/fad_ritu_heebehio" ], [ 68156, "Nnaedr enrci." ], [ 68172, "rpee/fegcethreavi" ], [ 68192, "nsoatxiyhdedtp" ], [ 68208, "aomiandae/tgupgek/eoreutei/eehmwyumfo" ], [ 68248, "ldanyc" ], [ 68256, "Ttradenfbemele nrhu htnouku." ], [ 68288, "Aeso feuhsri ehterbhe rpiahto sneahon." ], [ 68328, "Ptteohsece." ], [ 68340, "Deiwfs asrreype olatgt uatata rodean oh." ], [ 68384, "Titarnoo." ], [ 68396, "Gmr otyfhgisua." ], [ 68412, "Dwdeisetdtae mnitt." ], [ 68432, "Howtseacuhwy ddeehlsi uemanri." ], [ 68464, "Toahleb anhtefh gnsih henmdeu tskoce ntepeh." ], [ 68512, "Lhonar hatihwtop caikgetoimos utt." ], [ 68548, "Siecwriadoo adstoucs fty celputne rudeetied clhaplater." ], [ 68604, "Tbnyxyafle egtbihln." ], [ 68628, "Behyhitovw rtnapntav rshaslce rdwu." ], [ 68664, "Thraerde" ], [ 68752, "Gemenetecdi swmotvi ieseneh rsatrc biarh lifahrtav." ], [ 68804, "Owodr oatteno." ], [ 68820, "Tie elge liastlorr aetglebectn." ], [ 68852, "Summate nswitsromgra nattre esesate fpsa." ], [ 68896, "hpo_enapeer/oitfvehoyhii" ], [ 68924, "surrsaugeohisat" ], [ 68940, "Lornean isdciiwnea iwtleiwyplan rmeet." ], [ 68980, "Wanist amwhu tdti eabahbtaont endsihnei." ], [ 69010, "xor", ":1;,671:6q" ], [ 69024, "Tfseev achigssoeh hemtiel." ], [ 69052, "Oataettqehl etdegi nithloweevo." ], [ 69084, "ttirrdyho/eyt_ismot/rcou" ], [ 69112, "oehrirr/oypoimh/touns/ionetoupsioru" ], [ 69148, "loowua/rhdee/ahrno" ], [ 69168, "dato_ashneh/getfio/oyrq_snsee/tahoncotkr/eta_kiotah/ehtdehotao/nildgoatcoah" ], [ 69244, "twaopst/sofudtii/caelwt/fretl_etfeits/ear" ], [ 69288, "relwpi/fhnon_eewcsomwse/cbtatihehhgald/sdy" ], [ 69340, "ealuadu/ihou_nthepdiohrei/tnbeweig/elrtuerletttinloeln/eada" ], [ 69400, "dtornymaweu/hahatcvampne" ], [ 69428, "tlu_ftsi/esontliopri/ihmaebghohnriowr" ], [ 69468, "slnoenootyr" ], [ 69480, "nai_ortsesabsteym/isctaejwraehc/lehasoehdte/ii" ], [ 69528, "fdnoobrte/igtpu_mqcegsdeatd/rrdyla" ], [ 69564, "lahhafrnato/eugscilinamh/aihicio" ], [ 69600, "epln/dyrtir/tteesoa/hehsialntiun/oi_nvne" ], [ 69644, "fstonc/snsiqa/rvcoptdate/nrorra" ], [ 69676, "uero_aceviehs/teondta" ], [ 69700, "oicffa/telaseegetoqdrudrma/oeltai/aodr/aemta" ], [ 69748, "nh/hiduynobge" ], [ 69764, "Sss stletocl cnei a vethkaekeuhb etebhre leit aslenicy a." ], [ 69824, "Rhpiron ladountied nehfal cneodnw uwlsetepmne eloeramdayt." ], [ 69884, "Tuehnihnaddg egtorro takisntonc uehhan." ], [ 69924, "Ygaeksc go aohiamsnir" ], [ 70320, "kernel32.dll" ], [ 70335, "TlsSetValue" ], [ 70349, "QueryPerformanceCounter" ], [ 70375, "Sleep" ], [ 70383, "CreateEventW" ], [ 70398, "GetTickCount" ], [ 70413, "FormatMessageW" ], [ 70430, "TlsGetValue" ], [ 70444, "ExitProcess" ], [ 70458, "lstrcmpW" ], [ 70469, "CompareStringW" ], [ 70486, "SetEvent" ], [ 70497, "lstrcpyW" ], [ 70508, "ResetEvent" ], [ 70521, "IsProcessorFeaturePresent" ], [ 70547, "user32.dll" ], [ 70560, "GetMenuState" ], [ 70575, "EnableWindow" ], [ 70590, "UpdateWindow" ], [ 70605, "SetMenuItemInfoW" ], [ 70624, "WindowFromPoint" ], [ 70642, "MessageBoxW" ], [ 70656, "GetParent" ], [ 70668, "GetMenuItemInfoW" ], [ 70699, "ShowWindow" ], [ 72027, "GRUQ" ], [ 72183, "xor", "Y_ZYY_ZYY_ZYQ_ZYI_ZYA_ZYy_ZYqgba)" ], [ 72951, "xor", "Y_ZYY_ZYY_ZYYGBAA" ], [ 74300, "ILOW" ], [ 81087, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 81144, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e\u003cdependency\u003e\u003cdependentAssembly\u003e\u003cassemblyIdentity type=\"" ], [ 81218, "xor", "KJ_JAKJALV" ], [ 81454, "xor", "KJ_JAKJALV" ], [ 98467, "GEXH" ], [ 119027, "87ON" ], [ 123907, "v060" ], [ 157006, "I4 0" ], [ 158421, "ONT6" ], [ 171837, "IDYH" ], [ 186506, "Yewf" ], [ 199619, "XUDB" ], [ 218023, "na5u" ], [ 236911, "053w" ], [ 248622, "9AKT" ], [ 274687, "334k" ], [ 277446, "PRXI" ], [ 287873, "54BV" ], [ 291370, "6S2N" ], [ 296041, "X2E1" ], [ 314964, "K52H" ], [ 323749, "t1m5" ], [ 338399, "Exrj" ], [ 346088, "/e H" ], [ 350869, "kw9e" ], [ 390036, "d4o3" ], [ 448870, "Mpisq" ], [ 489365, "Wtsg" ], [ 543318, "VKS0" ], [ 549116, "ids9m" ], [ 549200, "p8z2" ], [ 552973, "P 5U" ], [ 561285, "Ojvm" ], [ 587763, "/2ng" ], [ 594579, "6KRR" ], [ 597401, "B62G" ], [ 597719, "XZI9" ], [ 616342, "Z1JA" ], [ 625071, "W_28" ], [ 628200, "`2me`" ], [ 639549, "5 nc" ], [ 667394, "mu7xc" ], [ 674792, "S0Q0" ], [ 684357, "QI\u003c\u003c" ], [ 720320, "J3FB6" ], [ 753287, "xor", "_NUk_tI%_M" ], [ 783900, "P3Q6" ], [ 805675, "o94k" ], [ 814292, "B366" ], [ 819304, "/lc5" ], [ 838690, "P781" ], [ 890574, "xor", "a/ERe/.8f/" ], [ 899864, "Flnh/gjnnamhgdi/njgeonoh/phnole" ], [ 899889, "xor", "_GA@CJ/c_JK" ], [ 899896, "Lped" ], [ 899904, "Lhdccaohmlnlk/cplhhinifbka/mjlhangmgdicco/dhlnilfbk/anpj/beicafcdknl/lm/jnii" ], [ 899918, "xor", "L_CGGFAFIMDN" ], [ 899984, "Pmic/jdfbdibndafea/eajljhffddjfpa/ecln" ], [ 900003, "xor", "JNECEGIIKKEI_N" ], [ 900024, "Fdlgcjmpeb/cjniaofg/cddmgflonbgo/cleniefcckcalo/dccjlfg" ], [ 900044, "xor", "LKKBHIC@AMH@" ], [ 900057, "xor", "LCJAFJILLDLNC@" ], [ 900072, "xor", "KLLECIH/aNFBAMEN__@" ], [ 900080, "Naimnbjappo/epnapaipo/cokf" ], [ 900108, "Bfdpcacddhjmf/hpenfemgjae/nahgegf" ], [ 900122, "xor", "G_JAIJBHENJ" ], [ 900144, "Mejikbh/logloipgjbkjkk/mbjmpiggf/fehlaccinibd/dflnk/addiaka/pcnldbjigh" ], [ 900152, "xor", "C@HC@F_HEMDEDD" ], [ 900204, "xor", "_LACKMEFHG" ], [ 900216, "Ojgmdhefhh/cfldpohgjedladen/nmjhi" ], [ 900217, "xor", "493:6;866q=82:.1694;:2?:;0q03467" ], [ 900227, "xor", "LICK_@GHEJKCNKJA" ], [ 900252, "Bkcpopfik/nhg" ], [ 900253, "xor", "5=.1.875q069" ], [ 900268, "Oplic/jgp/opfcgnlej" ], [ 900278, "xor", "@_ILHACJE/hCDBML" ], [ 900288, "Glkmbc/phjbgdf/emfbca/okj/fdmchgkeo/poakoh/docpon/mca" ] ], "sz": 2181898, "ts": [ { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "475500" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 9590.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code IN token", "e": [ "_IN@", "_IN", "IN_", "@IN", "_IN_", "IN@" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-in", "l": 1, "m": "B0007.003" }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"processor_architecture\":\"x86\",\"public_key_token" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 9590.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "Command endpoint path marker", "e": [ "Noialfompflkalamg/kdchlaa/pga/cmdjn", "Lmhmnimnnd/ghdkjgimhnbdei/cmdc", "Dlmbmdfj/kaghfi/hcip/cmdbjmggojhalb", "Ofif/blcegeoeogem/j/cmdmagddnkjh", "Dpbbk/ij/cmdh/ooejildobifhmpi/cfieocp", "Cml/cmdkgfedl/ecpemgjpdhfjjbojp…" ], "i": "objectives/command-and-control/beacon/network/json::c2-command-result-endpoints", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 361.89" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 24.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.31" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.61" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "KMMCANLHAGN", "JKHMEDIDBM", "BADHNDAHIM", "LBDFALLGEIFH", "ANDNJJFCLEM", "CNLLALLAGDC", "EMANDFECME", "DLIJMALLDCBG", "CDIDNIJGLN", "MDLCEDMNCAN", "LGIHIMMKBIE", "JBHNKHNHIM" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.42" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "CompareStringW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "d": "hide keyword", "e": [ "hide" ], "i": "micro-behaviors/data/text/keywords/lexicon::hide", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "475500" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1555518834.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "475500" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KH token", "e": [ "_KH_", "KH@", "_KH@", "@KH_", "@KH", "KH_" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-kh", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.61" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 9590.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 8.00" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.42" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KG token", "e": [ "_KG_", "_KG@", "_KG/", "KG_", "@KG", "@KG@" ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-kg", "l": 1, "m": "B0007.003" }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "475500" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 9590.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.31)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false,\"supported_os\":[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"nam" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e\u003cdependency\u003e\u003cdependentAssembly\u003e\u003cassemblyIdentity type=\"" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8399999737739563, "d": "Large binary with few imports", "e": [ "binary.import_count = 24.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "475500" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "7:5\u003c\u003c9::2;:830\u003cp32908\u003e3944_" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AM token", "e": [ "_AM@", "@AM", "AM_", "@AM_", "_AM_" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-am", "l": 1, "m": "B0007.003" }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "jb cflim" ], "i": "micro-behaviors/crypto/symmetric/xor/loop::asm-loop-control-transfer", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code MD token", "e": [ "_MD@", "_MD", "MD@" ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-md", "l": 1, "m": "B0007.003" }, { "c": 0.9200000166893005, "d": "Large binary with few functions", "e": [ "binary.func_count = 0.00" ], "i": "metadata/package/metrics::recovered-function-count-under-10", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token", "e": [ "_ID", "@ID", "@ID/", "@ID_", "ID_" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003" }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "e2011457-1546-43c5-a5fe-008deee3d3f0" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 1.0, "d": "Manifest opts into Windows 10+ behavior", "e": [ "[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"name\":\"vista\"}, {\"guid\":\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\",\"name\":\"win7" ], "i": "metadata/build/manifest::pe-supports-win10", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 9590.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "Very low code-to-data ratio (large PE payload)", "e": [ "binary.code_to_data_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/payload/section::low-code-to-data-ratio-pe", "l": 1 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 24.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Very few recovered functions in large PE", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::recovered-function-count-under-10", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PE code-to-data ratio below 0.08", "e": [ "binary.code_to_data_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::code-data-ratio-below-008", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Android DCIM folder", "e": [ "H@MDCIME@F" ], "i": "objectives/impact/wipe/disk/mass-delete::android-dcim", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 24.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 24.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 24.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "475500" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Packed loader code-to-data ratio below 0.2", "e": [ "binary.code_to_data_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-packed-loader-code-to-data-ratio", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 24.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".idata", ".rdata+.idata = 154.7% of text (41984 / 27136 bytes)", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.code_to_data_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-3--inline-29204", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".rdata", ".rdata+.idata = 154.7% of text (41984 / 27136 bytes)", ".idata" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".rdata+.idata = 154.7% of text (41984 / 27136 bytes)", ".rdata", ".idata" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links kernel32.dll (TlsSetValue, QueryPerformanceCounter, Sleep, CreateEventW, GetTickCount, ... +9 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (GetMenuState, EnableWindow, UpdateWindow, SetMenuItemInfoW, WindowFromPoint, ... +5 more)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "QueryPerformanceCounter", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "binary.import_count = 24.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "0=498994::16?q56?2194?867?:=q..8?.02 \u003cxor\u003e", "LBKMEBHH@EGNCM/nEMNABICLC@F_HK@_H \u003cxor\u003e", "11676p7=9/11=1829p950822=2/16=699326; \u003cxor\u003e", "JJEDHNC_K/mFGKMB@JIAL/cKHNENGL_CDMHANCLI \u003cxor\u003e", "275?636q37707q.195;916926:.0\u003c\u003c:.071540:= \u003cxor\u003e", "8\u003e/27971:25=73p2\u003e\u003e=\u003e72/p517=9694/ \u003cxor\u003e", "Y_ZYY_ZYY_ZYQ_ZYI_ZYA_ZYy_ZYqgba) \u003cxor\u003e", "@FHACHNKEEB_@GAL_GAJ/g_HF_DELEAKJN \u003cxor\u003e", "\u003c324/\u003e5p\u003c9:43504\u003c09p/03=31/\u003c;36\u003e \u003cxor\u003e", "2\u003c2=\u003e8332:\u003cp\u003c2:87\u003e997:773p87/;94\u003c\u003c=6 \u003cxor\u003e", "8=/4\u003c1\u003c6;86/:p/3909=4356=6\u003e\u003e5\u003c1\u003e9493p547 \u003cxor\u003e", ";44.9889:8.:7q4;291;21?q;14\u003c\u003c44:7 \u003cxor\u003e", "430384\u003c\u003c7:;5428:;p2360817;60739583;924p/ \u003cxor\u003e", "=418:81014.0=74049=3q3;0;994?78q4598.;;8 \u003cxor\u003e", ":88;8.7q75.10?.;88?09135q02548:; \u003cxor\u003e", ":=;4/1\u003c279p253508=33=\u003c\u003cp035:\u003e/810 \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "e4bd509400198e716764360e71fafea039838b116a75eb700a1fad617d6623fc", "path": "475500", "type": "pe" } ], "tv": "46790" } }