{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.97384614, "class": 0 }, { "m": "az/pe", "prob": 0.6589404, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T09:26:09Z" }, "path": "e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58.exe", "raw": { "v": "5", "fs": [ { "f": "H(Cm)Md₂(Bk)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 4.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 230440.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 201216.0, "entropy": 5.45, "size_bytes": 201216.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.04, "string_count": 1257.0, "entropy_variance": 6.79, "avg_string_length": 23.69, "max_string_length": 6439.0, "code_to_data_ratio": 1.0, "string_length_stddev": 202.47, "largest_section_ratio": 0.81, "sentence_string_count": 8.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 36352.0, "entropy_max": 6.04, "entropy_mean": 3.69, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 7304, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 7461, "u8", "PADPADP" ], [ 7472, "u8", "BSJB" ], [ 12917, "u8", "Q44p6Gc074692e98f2e9029o52K8ud9c10" ], [ 12952, "u8", "55Vdfa40RWb5ed10" ], [ 12969, "u8", "3NmWU2f20" ], [ 12979, "u8", "6Z4Li69p4952LDu4630I7I47Hq1v90140" ], [ 13013, "u8", "HI9b23EbC9k5c2fDol2dNV440" ], [ 13039, "u8", "BM92mdBS2f90" ], [ 13052, "u8", "0p9f94a5X5aX9D0" ], [ 13068, "u8", "564443D1099Odbce5dwM0" ], [ 13090, "u8", "9bgA552Ewcb29gci45W0" ], [ 13111, "u8", "B35ca9vkeT25X0" ], [ 13126, "u8", "HfG2t59f9G9a0" ], [ 13150, "u8", "C9vh5939c89494Mnbfazeebb4d646Vf26cU4Z7Fd3cmab0" ], [ 13197, "u8", "I2c654KB6c2EzL6d11QS9c0" ], [ 13221, "u8", "01eO97a249uf3Q5Mb0dsbjls3Vm9YbzF5cb7l0" ], [ 13260, "u8", "979ij1WIRc9352b74b9p0" ], [ 13282, "u8", "C5bacT4E4i9K912faZV9fDbo49cGba4dEe4f94dI96v4421" ], [ 13330, "u8", "912J4Hl997o71" ], [ 13344, "u8", "464F2fca1c9cJpIKe795s92Qc00b104925wo2255cac4Ib091" ], [ 13394, "u8", "E6t5ahRkRL45Ycu9aft32dC9c4aTE7lc5f5o7ffet4k4Nfp91" ], [ 13444, "u8", "4d6uR90OD95B49P1" ], [ 13461, "u8", "B526jL22hnQ1" ], [ 13474, "u8", "D4K5Ezhmkacadda1AQbX4cCU1" ], [ 13500, "u8", "N062Y51aP9maUeXfaeYaaVZb6514jg9fb9h2975a7XU1" ], [ 13556, "u8", "ReadOnlySpan`1" ], [ 13571, "u8", "ICollection`1" ], [ 13592, "u8", "9a25fGN9dC0Dw0Zabd0fbNTff1cb5SgS44d1" ], [ 13629, "u8", "C45N2f36549d1" ], [ 13643, "u8", "99f4a3l794aH1NBb30W422LAa227Re0cfb9622xe1" ], [ 13685, "u8", "WyV9M5nGa7bifJ5Xc5Q92d7G03i22544ff2c02" ], [ 13724, "u8", "1b2bbac4e96Uas0x1cb7i6eha93br24a5dN9fQ9f012" ], [ 13768, "u8", "get_T9f4g094Ufb4OuC28bbTbUB4PBR2m9r22412" ], [ 13809, "u8", "2ba4c2edR3W3BacPd4GeiaJe5bLk40Xd712" ], [ 13845, "u8", "S2b2S8c9Z12942a252s45kq522" ], [ 13872, "u8", "7e2aBV19dS60d660b42332c22" ], [ 13898, "u8", "I56d290b919r239e64defodb0g20ayax24Hbdbn94gXa32" ], [ 13945, "u8", "B9zc1U44fbeeQz94c93w25nUw1zbuwab3dG196aa2E2Had32" ], [ 13994, "u8", "ToInt32" ], [ 14002, "u8", "get_OO45d09342" ], [ 14017, "u8", "set_OO45d09342" ], [ 14042, "u8", "N32b2u5abd4x69d9fNR4f49c44a42" ], [ 14072, "u8", "Qm4c45Eacpb9b03M94b1du39uaK0td5E0252" ], [ 14119, "u8", "Js1WdzAa903H72" ], [ 14134, "u8", "LUa5W03fT49aQb934e5999982" ], [ 14160, "u8", "Jo43Lcd9Zb1s0292" ], [ 14177, "u8", "6mcc9476Gd3a93fD2m5492" ], [ 14200, "u8", "D8A1v5daa9X79Q9dTeibZe4id2Nbco5Xbeb4C4jf32d22992" ], [ 14249, "u8", "4beb3S2a2TzO54e94ddlbc3M2" ], [ 14275, "u8", "LyH3i3a5CEf7b63W2" ], [ 14293, "u8", "FEc9a92f9cTtOW2" ], [ 14318, "u8", "Dictionary`2" ], [ 14339, "u8", "U4U544R5aeiMa22a073h6b2" ], [ 14363, "u8", "Q5VG954a9iY0Qa9uaee9c97MRVe9S259b4690a9n5H50df2" ], [ 14411, "u8", "67bU264Ek4df2" ], [ 14425, "u8", "Gf4N4sec94q2wpdZ263c40266l36A492G9EI1J02Ove6aj2" ], [ 14473, "u8", "37siao4wCT2a99q2" ], [ 14490, "u8", "B465O2Qaf3a29d32d9950qe23aPcq2" ], [ 14521, "u8", "29oc92979291Ky529C4eU39LAs2" ], [ 14549, "u8", "02963XzQdr3HSf31Ya47N69p7d5v9ml22g2441e0uJ32u2" ], [ 14596, "u8", "F9344ab2e4c976cI21acalwoEu2" ], [ 14624, "u8", "EIGf41521pveY68t2ba29v2" ], [ 14648, "u8", "Cl3126craIdDad2x4oRn4fg4J45F4Af7Bh52qbw2" ], [ 14689, "u8", "get_0aE54bdX9z909aR3fP9bf755hpdw2" ], [ 14723, "u8", "set_0aE54bdX9z909aR3fP9bf755hpdw2" ], [ 14757, "u8", "92a2ab0f2taldI0441994T0049249V9E9703" ], [ 14794, "u8", "Af6cfd73eh23" ], [ 14807, "u8", "Ac2c99x94lff02b943" ], [ 14826, "u8", "92ba20fY43" ], [ 14837, "u8", "SB3w79dM91Cf56bWbzNMu32YdbQ2df43" ], [ 14870, "u8", "99d64GpfdFsf1Kja0OVf9524O9bEf17b0X2cWI53" ], [ 14911, "u8", "FSb02433yb4t0f92ccan2P4d9S45aZB9cJH5e219eie52l53" ], [ 14971, "u8", "44Gcmbw498ah36chcNwfld4wl2u5B3OwP63" ], [ 15007, "u8", "DtCf2B9kxf93W51bcbaDT66m92d6G2ab193" ], [ 15043, "u8", "279ax55bu52wfj84af9aU36cbSdPn299b9I094b99c93" ], [ 15088, "u8", "2eht242HfaL2Gbb3r42VdTf93" ], [ 15134, "u8", "AGR92ac5AabR245294ch932ed6f9ben5Bd2nE9cfV24" ], [ 15178, "u8", "A2kf34al1XCA95P220R2ceDaYP4faHUJaB0Ube9Yb9f644" ], [ 15225, "u8", "Dd9bFRUdad9bb4o4wd9U44" ], [ 15248, "u8", "Cbp6z2Vd519Kl44" ], [ 15264, "u8", "29nL50O22ca9wU0cid93523f962fD49baV2V7m9S9j54" ], [ 15309, "u8", "L15c4ifXbGMc2964" ], [ 15326, "u8", "Bl9C2a1cG29fa5929N64" ], [ 15347, "u8", "F9w352bLFn2OZT49199bf94qcbe876he294" ], [ 15383, "u8", "A96cP9Sfo9g5JBfYrU4d9bg1Q9fb24XcbcI94" ], [ 15421, "u8", "D2T44aS9ydDp72X4y747Rua9fdf40VT2a94" ], [ 15457, "u8", "N7Lb9A4X9qeFd4P44uedfE99965c7j02ca5l5a94" ], [ 15498, "u8", "Nf14K2EuVY94twNa47a29z52c4D4" ], [ 15527, "u8", "Lgbf2w999b09764NgyR9W4d54FlH4" ], [ 15557, "u8", "9dDeBloqxu52cud9cj7045dbX4b9549O3fS0527dbBki4I4" ], [ 15605, "u8", "V577b84JRY9Ad9x3vw2w6oIbTude5I4" ], [ 15637, "u8", "79Z9Hf98f1M4" ], [ 15650, "u8", "Lk4lnGfqY2a4" ], [ 15663, "u8", "C94219avbb06tQXc9DzK050223c4" ], [ 15692, "u8", "L3I41mE22xm5fH4zv819bf6f9662Kc4" ], [ 15724, "u8", "ASaV262Y4wd46fegazRza2cfe19d4" ], [ 15754, "u8", "I5Vi1322FHf6b8nGw32f4" ], [ 15785, "u8", "04Cco543f4TV0Ld4f4" ], [ 15804, "u8", "Xu1R59bIH5c4bN19faeJc5B4I4OVtb9ffc9f4" ], [ 15842, "u8", "B4K3bb9eGN54b99eeec425z3bkb9ddf2af2crCdB923c9a1h4" ], [ 15892, "u8", "XHMZ1yI92ye2aE9V7M0xS23f2k4" ], [ 15920, "u8", "D59v6Zjmc6oi4o4" ], [ 15936, "u8", "D9rA0ffkfb02pt5d1rI10S95r2d4a3s4" ], [ 15969, "u8", "E1F9V9yu5U25" ], [ 15982, "u8", "C749HCbBc30Hwa5a242a59zU059ba6AL9f9q1545" ], [ 16023, "u8", "M15mda95b6Bvc4a4adT12ceXS33fSuS45" ], [ 16057, "u8", "5894Qbu954c7e5SCe1W95guDcX2e5W9c9q45" ], [ 16094, "u8", "F9C21Wbo59s5ebf1zs9e33zHgae5Us9090644X52lcpbzOW55" ], [ 16144, "u8", "BJ3YfI4d8C34e9495" ], [ 16162, "u8", "C124bca3iUa9145n95" ], [ 16181, "u8", "6za1p51fm5GafXA5" ], [ 16198, "u8", "9Cjf40T95fb44na9Csd27vb3Pb05rmxRG5" ], [ 16233, "u8", "4c2dc4ar1990p64W5" ], [ 16251, "u8", "C9P29a4Wd3Ogbc3Q6b52G2c5cJi992L29943bf2Z5" ], [ 16293, "u8", "U92faV2d23c5" ], [ 16306, "u8", "9b24O2fRa0e5" ], [ 16319, "u8", "RedhW2feIW1DTPCa309Nqc4c2c2fb209Q3M5f5" ], [ 16358, "u8", "JybaDUb540992dL9e29MfGw539cbIlWDr5" ], [ 16393, "u8", "45U2cf4dMx0dW5cWlaEz5" ], [ 16415, "u8", "F4bN5M3Isj9Le8392fVuf5b0ecK2951aa4CQb95f3G549x216" ], [ 16465, "u8", "240afoWf692a9Zbb8Hab2Yfv4dfbc93d2242nqf26" ], [ 16507, "u8", "4E8xXbMa0P95942427DL1f4A74309KQc2bGcC236" ], [ 16548, "u8", "NfK4w03O42975u65aeVf9Jb08u46" ], [ 16577, "u8", "59462s32b99at9Z54ds1bgH3Jja38i9tyop956" ], [ 16616, "u8", "2L9Of9M4s5b26TIM8t9cec6M6aL9532f56" ], [ 16651, "u8", "BQxE4gdae5b9466" ], [ 16667, "u8", "5dAfD4f9acArUe6B05c52y8i532bS4955d5cjcsa76" ], [ 16710, "u8", "Kd2cc7Ys422f4JmuLla2bE40f642STcmf4vedP9bedpl76" ], [ 16757, "u8", "9vb1Rq942X4cf9I49PbR9U20932c96" ], [ 16788, "u8", "S49kcGJkdh96" ], [ 16801, "u8", "Mbe570v3WeaPbcZ6" ], [ 16818, "u8", "H6dbesd7s1dlEbA955bMp4c5tIb6" ], [ 16847, "u8", "Hl49D2fcn91nY2am9Q964fY4zQ5lzL90b6cdgAbE52aQm3e6" ], [ 16907, "u8", "Dw095s5BE3f6" ], [ 16920, "u8", "4wfaZGb4330z70Up4382057860ff6" ], [ 16950, "u8", "4dK51b939d52cebe93Nf4fEj6" ], [ 16976, "u8", "XF26Vw4fjb9k49awpbd13hkcy6" ], [ 17003, "u8", "90265cwJhbeeb41cOq4Rxd29592Jbe17" ], [ 17036, "u8", "4dT9S4q1XreIU7" ], [ 17051, "u8", "3ccab0Y43D2Pb432XSJl24uiD3IH6dOgF2fb7" ], [ 17101, "u8", "9y2a294dT6qccD7dQ929c54Ab44D294oI6e4796da8" ], [ 17144, "u8", "F3c42dfcKJ1gu94f9AZ2B49BcwKcgf39b8" ], [ 17179, "u8", "24l9b3bdGcmd1HbqE965e8" ], [ 17202, "u8", "952zQc91dO5hk69049rb7c4f6b19" ], [ 17231, "u8", "P9XbHf9rb2Y44f44S94O2LfQ4993w429" ], [ 17264, "u8", "C2cb2cAd53426cHcc5vde101bi2f2crbf9OcfOxff2Kacn629" ], [ 17314, "u8", "3Z4db2uck1fbd4576f95dl9fj85bxe4M9cl56c22fX29" ], [ 17359, "u8", "Kb0d0m6c2530k22e41p5a29" ], [ 17383, "u8", "FeTdCS3orUg5f9wRTbDuQ0bf29" ], [ 17410, "u8", "Pn9rbYk4jf9t94fwfBGC2dUoG29U18Tb2Ff4h0d6d09n63549" ], [ 17460, "u8", "Be98340NaD6bJ9ayiM3g9djdX59bddV849" ], [ 17495, "u8", "FYa9a546e611bT0c3O9Wle659" ], [ 17521, "u8", "Ey23c462Nb43a42gHSbbKc3f25WB44YO430bnafIhc69" ], [ 17566, "u8", "52b9d8Bdq04599" ], [ 17581, "u8", "214b33c99" ], [ 17602, "u8", "2Zbb4Ps9iK296l59eSlcc8P9cq2cJ9" ], [ 17633, "u8", "Xaae34aK9" ], [ 17643, "u8", "47j9f3d8Vvh2Oe5x2i5523ya409f129cRf7a5d2R9" ], [ 17685, "u8", "7V7M299D75f9af3ddG3924HaCzN6cf9a3a9" ], [ 17721, "u8", "D34gS1f9Id94vb9" ], [ 17737, "u8", "FOf4716aW3p62d656d49a6x9fKT2C3KU3zkc9" ], [ 17775, "u8", "3f894C6L97i2acFbw5a8oxdd7kA2dZ9Bd6fV62Ry55d9" ], [ 17820, "u8", "9O9k4f55aX434bKd9" ], [ 17838, "u8", "Ce1uN99a04eyaObsJ0buo9fq9IeqjvCb349e47cfqh4e9" ], [ 17884, "u8", "CTc2he3c6akD3MHQ0bVe9" ], [ 17906, "u8", "UB2aur8974Yeb2622adxba93zV6f9" ], [ 17936, "u8", "CQ5a6e4029Gq9a49J2HDd2Rb43Pli2af9" ], [ 17970, "u8", "Ed0FWa24ur4ubdawp9" ], [ 17989, "u8", "Ca9z7bin3JffaaLaa6572g9293U4c5V3e7M9399qDq9" ], [ 18033, "u8", "AB2VldDP26BserF2nfd46kUs9" ], [ 18059, "u8", "Ak94lfU2974e53f80x2b1O92549XU64bb240A" ], [ 18097, "u8", "Fb61909dfob6A" ], [ 18111, "u8", "R8E10af30vF4e4Abcq616bVfM6425U12f3dt5291B" ], [ 18153, "u8", "3bbt6V9fv2Iwc4d3fDbRbS4E159Vf49NaC" ], [ 18188, "u8", "AskA2o3tb1I842Mbf6d1UbbC" ], [ 18213, "u8", "L649bbb9h4e0843989z6065f0b9A9Mae602b3Hea5heJd4eC" ], [ 18262, "u8", "AH439a68D" ], [ 18281, "u8", "AbB73996454p79M5z94hf922aW8pWAc65554q5P11uq4pD" ], [ 18328, "u8", "331032E" ], [ 18336, "u8", "4dfDK01euae9ck1964439fe4zOyP2c933E" ], [ 18371, "u8", "3Cbc2t52cd4j4twm5O4Ye8u664c5z9E" ], [ 18403, "u8", "Ed5i5630dK4beD2P4222RoX46b5dtc1zWmtY42GI9dG" ], [ 18447, "u8", "42F6dE2t95b9eG" ], [ 18462, "u8", "2J3ef9dsa27XfS64W8da96299QA924abH" ], [ 18496, "u8", "JQArub7X21N74z1I" ], [ 18513, "u8", "EW74bb26i2cGaL4cGO62b2f3dbb32d94cb4Pz9CW9b6I" ], [ 18558, "u8", "S69f5Q6b739aa4f62Dhae9I" ], [ 18582, "u8", "2Qb5f299Kc923ean49yP54q9cae2Noqbed4bI" ], [ 18620, "u8", "DGW7bbfxV049u0qV01fe2GaWSql25c912r9a4dKapfI" ], [ 18664, "u8", "FR9iL509592nN9d9eWf5J" ], [ 18686, "u8", "M26f0c89dfD64ffi2b9J" ], [ 18707, "u8", "M4624bLdebtu49g2924Ra8K" ], [ 18731, "u8", "6dKb984FEP5g4cdKbK" ], [ 18750, "u8", "A282X5U7cMb8i6aeRMc098M" ], [ 18774, "u8", "Cb20p5LY2A296b5L995J435bkayG93e9ae2bM" ], [ 18812, "u8", "BN90O92492994I4l9WyN" ], [ 18833, "u8", "System.IO" ], [ 18843, "u8", "4oc529Q6cYu42f256P" ], [ 18862, "u8", "0Q2xd230EHf5h0YA59E6e298Y95cP" ], [ 18892, "u8", "A0i8X25S9a2e9Fr99bUP6U607758y9zdP" ], [ 18926, "u8", "89f93j7JB724ab9T154b39GQ" ], [ 18962, "u8", "55W9ac56gNf5m45oYB62293ee3a37c3Mn53gh9k6fY6dQ" ], [ 19008, "u8", "F3aZe2jvb265370336f2cedIb9fQ" ], [ 19037, "u8", "CEhx4e0Zd4fSfU9a40ai29N3Gs2q2aiQ" ], [ 19070, "u8", "LXb92EACB4R" ], [ 19082, "u8", "52bb4537zZ4fRyGR" ], [ 19099, "u8", "Q0t77mdJi9T39d2dv44aEfcSU919424hMx49591w9K3b3TcR" ], [ 19148, "u8", "9de240aY2u45aqG3jR" ], [ 19167, "u8", "FfLcc4bRy2eudcb29bqej95389ad0feq00S" ], [ 19203, "u8", "909Aqu2eV73l29cq94R2eiS54eaUP102a95Al9hFf90S" ], [ 19248, "u8", "4bZf86929ef5ag69fM6899ocaF99Od7fTb6HNdS" ], [ 19288, "u8", "7ao5792v2949wB9dy339e4G3a3E9f7sU69e4amfT" ], [ 19329, "u8", "4c9e02ce4j64VP2P4c9a543jd3V2ecc4c9bYt9cf9EV" ], [ 19373, "u8", "Juz9zbdh3eyMV" ], [ 19387, "u8", "Yz4bl4fa2aD7WR645c9Hz269ccc2aV" ], [ 19418, "u8", "W2f620hd741kcb06o6I94GeQRa54x6Y9b5D42G294b2k5hV" ], [ 19466, "u8", "ApcyUfecsbd9hz937PL49b2644cnc21K959deaO29ba0bW" ], [ 19513, "u8", "961JdcdBa932b55fcW" ], [ 19532, "u8", "935E2T964bJ2Wd8DRr15c2X" ], [ 19556, "u8", "A4fe4O2e059Ka0t99K4szd24a4Rb2af26db2b6k249Va9X" ], [ 19603, "u8", "4d99Sua4mcGdW25U44o0a95jJ6DX" ], [ 19632, "u8", "BNwZ9cD24f5L92w2O5EyaMan6rB931bcY" ], [ 19666, "u8", "I2xPa4927Ord8eAC5ecdpS249b6he9afaQk1Tc2gabbZ" ], [ 19711, "u8", "94954wZ" ], [ 19719, "u8", "1UP426vpeaHa289zZ" ], [ 19737, "u8", "EF22j99f8434ab3bdXe22fTeU1vZ2M2319blq0fz95fQ0a" ], [ 19784, "u8", "UH460b272a" ], [ 19795, "u8", "ARb3wdcF9aP9ld0cHb4444b90eaTb5GN72a" ], [ 19831, "u8", "B1954W4246ci6d76bpat24a9P24aaTeb543VanPae4a" ], [ 19875, "u8", "B6bk4a4B2F3Ib23mc5R1O93BVcd2a1d3219l8b915a" ], [ 19918, "u8", "937e89f484W64989b02eoxa87a" ], [ 19945, "u8", "EcxB9nc41NP5XF540943c2d2zjfcf69a" ], [ 19978, "u8", "59eO5B95l99a" ], [ 19991, "u8", "2922220x44C5gwbbdba9a" ], [ 20013, "u8", "6t8937fe9299wcb22d25d9bE9zdIa" ], [ 20043, "u8", "Cf6F5A45L30b3ocj3bE3fIa" ], [ 20067, "u8", "QB38bc059d62agW230F3290jb4lfOG52bdP9eS9Pe7sJa" ], [ 20113, "u8", "7u40hbf9328ob90ibb9a5z7Ua" ], [ 20139, "u8", "2at09K977c2535d2d94aYa" ], [ 20162, "u8", "UMPJ6f459baa" ], [ 20175, "u8", "Db0V40feb985e3uQ0vbQNc9GY9Xkd9uH9eUd2f44O4pD6ZSba" ], [ 20225, "u8", "59U4f9kt059bb44L9aXd05z44h1456ca" ], [ 20258, "u8", "M49d6399d91vY52PR2M9tcc4x4cE2J4cNffbda" ], [ 20297, "u8", "70i44baea" ], [ 20307, "u8", "VVu1aoXab9d5fxea" ], [ 20324, "u8", "9obf4Ac250m4b1z2c418xfa" ], [ 20348, "u8", "85529Jy5cfUcaT9iCk6751b5ddb6f6ja" ], [ 20381, "u8", "get_Data" ], [ 20390, "u8", "9ddf04mpB1a3b" ], [ 20404, "u8", "F5db29v2c4Nube57f905M9Z42944e6be5344b" ], [ 20442, "u8", "get_CVd9eDfc9M5664cBZT94949459b" ], [ 20474, "u8", "JO4H6e9cTa3W9L3Sra9b" ] ], "v": { "file.stem": "e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 3899310314, "file.basename": "e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58.exe", "pe.image_base": 4194304, "pe.image_size": 221184, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 44286, "pe.headers_size": 512, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "6c290c596c1d62289059ce3711cf87418a025522", "pe.image_hash.sha256": "ade5c506ac166f9b827422d2987141783c7d5a74cdc5d679044211c92399522a", "pe.image_hash.sha384": "ba2673c2615889c288bc710c130584d2b1ebb8e23cca5b965ef15984a2cb2bc29476be70152e583556ce8e13627657dc", "pe.image_hash.sha512": "10d9ec5d1cc94f308345d3675d3ac769636f19c04cda81a1eed9eca5a5cd4f8bdc42bfe5be92cb0ac2810e8d8645e55e413d57686faf700e6426d2ca21c3c68f", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.resource_types[3]": "RT_MANIFEST", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 2021", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 34, "pe.clr.runtime_version": "2.5", "pe.version.description": "first", "pe.linker_major_version": 48, "pe.version.file_version": "1.0.0.0", "pe.version.product_name": "first", "pe.version.internal_name": "first.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 44200, "pe.data_directories[1].rva": 49152, "pe.data_directories[2].rva": 212992, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1.0.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 163744, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.version.original_filename": "first.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1, "pe.manifest.assembly_identity.name": "MyApplication.app", "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker" }, "id": "pe", "sc": [ [ ".text", 512, 36352, 6.04, "r-x" ], [ ".rsrc", 36864, 163840, 4.98, "r--" ], [ ".reloc", 200704, 512, 0.06, "r--" ] ] }, "id": 0, "sz": 201216, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x1d30" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x1d30" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1257.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.6000000238418579, "d": ".NET Process class token", "e": [ "Process" ], "i": "micro-behaviors/process/create/spawn::process-class-token-dotnet", "l": 1, "el": [ "0x611b" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x30d22" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x8eee" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x8eee" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO", "System.Net" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x4991", "0x617e" ] }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0x57d8" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "WebClient.DownloadString method", "e": [ "DownloadString" ], "i": "micro-behaviors/communications/http/client/managed::downloadstring", "l": 3, "el": [ "0x5a61" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x30bda" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1257.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x50dd", "0x1c88" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x5f5a" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "first" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "0x633a" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "0x5791" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"MyApplication.app\",\"version\":\"1.0.0.0\"" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDING", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1, "el": [ "0x30f93", "0x30f93", "0x30f93", "0x30f93", "0x30f93" ] }, { "c": 1.0, "d": "Modification of HTTP context items", "e": [ "set_Item" ], "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "l": 1, "el": [ "0x5c07" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.81" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x53d1", "0x5fe6" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x30c90" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x30c3e" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x5c73" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x1c88" ] }, { "c": 1.0, "d": "Access to Headers getter", "e": [ "get_Headers" ], "i": "micro-behaviors/communications/http/server/managed::http-headers-getter", "l": 1, "el": [ "0x610f" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.04" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "DownloadString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1, "el": [ "0x5a61" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0x30f0d" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x30ce6" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "first" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "WebClient" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-4", "l": 1, "el": [ "0x61c0" ] }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x1c88" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x2ffd" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x30abe" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x6097" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringBuilder", "DownloadString", "Strings", "StringSplitOptions", "ToString", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x5f3e", "0x5a61", "0x6088", "0x60e7", "0x5a70", "0x30b5e" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x5937" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "value", "GetValueOrDefault", "get_Value", "DefaultSettingValueAttribute", "get_HasValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x592c", "0x61ae", "0x5915", "0x58c9", "0x591f" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x6097" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x1c3f" ] }, { "c": 0.800000011920929, "d": "CodeDom compiler access", "e": [ "System.CodeDom.Compiler" ], "i": "metadata/lang/compiler/managed::codedom-compiler", "l": 2, "el": [ "0x5f6a" ] }, { "c": 0.8999999761581421, "d": "Manifest is MyApplication template name", "e": [ "MyApplication.app" ], "i": "metadata/build/manifest::pe-manifest-myapplication-template", "l": 3, "el": [ "value:pe.manifest.assembly_identity.name" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2021" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "get_Headers" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1, "el": [ "0x610f" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Randomized executable name string", "e": [ "H2a4X9w25b59lc4web.exe" ], "i": "objectives/anti-static/obfuscation/string/junking::randomized-exe-name", "l": 1, "m": "B0032", "el": [ "0x5937" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x30bb6" ] }, { "c": 0.8999999761581421, "d": "WCF generated code attribute", "e": [ "GeneratedCodeAttribute" ], "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute", "l": 1, "el": [ "0x587c" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 163840)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025", "el": [ "0x5f3e" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0x5fd3" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1257.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "NotImplementedException", "GeneratedCodeAttribute", "NotSupportedException", "IndexOutOfRangeException", "UserScopedSettingAttribute", "WebHeaderCollection", "DefaultSettingValueAttribute", "InvalidOperationException", "ParamArrayAttribute", "ApplicationSettingsBase", "CompilerGeneratedAttribute", "DebuggerNonUserCodeAttribute", "EditorBrowsableAttribute", "ArgumentOutOfRangeException", "StronglyTypedResourceBuilder", "ArgumentNullException" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x5cd4", "0x587c", "0x5cec", "0x5d1e", "0x58e6", "0x5cb4", "0x58c9", "0x5d4d", "0x5901", "0x582c", "0x5861", "0x5893", "0x58b0", "0x5d02", "0x8bc7", "0x5d37" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8799999952316284, "d": "Large low-entropy PE resources", "e": [ ".rsrc (size: 163840, entropy: 4.98)" ], "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc", "l": 2 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.81" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x5937" ] }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0x5f5a" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.81" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "System.Net.WebClient class usage", "e": [ "StringBuilder", "StringSplitOptions", "StringFileInfo", "DownloadString", "WebClient", "Strings", "get_Headers", "ToString" ], "i": "micro-behaviors/communications/http/client/managed::webclient", "l": 2, "el": [ "0x5f3e", "0x60e7", "0x30b5e", "0x5a61", "0x61c0", "0x6088", "0x610f", "0x5a70" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "UUU5bbb0zzz=\t\t\t:///\u0026444\"444,444/ \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3, "el": [ "offset:98108" ] } ], "sha": "e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-04/e547d52177207f8352766cd1e689e5f4891fb844367e12a1b6e04bca4d17ef58.exe", "type": "pe" } ], "tv": "52045" } }