{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.998200535774231, "class": 1 } ], "prob": 0.99820054, "class": 1, "models": [ { "m": "az", "prob": 0.99722725, "class": 1 }, { "m": "az/native", "prob": 0.9917604, "class": 0 }, { "m": "az/pe", "prob": 0.99820054, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9958679, 0.99937946 ], "analyzed_at": "2026-05-05T10:35:10Z" }, "path": "45911", "raw": { "v": "4", "fs": [ { "f": "KO₅(As₈C₅DyEr₅I)H₅(Db₂Po₃Cm₂DsOs)Md₅(Bi₇HeSiPa)", "k": { "pe.checksum": "0x0003f289", "pe.timestamp": 1317868477, "debug.pdb_path": "d:\\hehualiang\\HME_windows\\src\\Components\\codec\\codec_dll\\HME_Codec_iLBC.pdb", "hashes.imphash": "6629eb8331008601bc33c0bf1e09830b", "pe.codeview_age": 1, "pe.codeview_guid": "D1A72498-C71E-43B0-9D7F-D0CEF50F8131", "build.target_arch": "x86", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_MANIFEST", "pe.rich_header.xor_key": "0xead38040", "hashes.rich_header_hash": "0567be8ce30eb83259de0e99285a23d87c1e86558137896e8cc59cf2c9bdf655", "pe.debug_entries[0].size": 100, "pe.debug_entries[0].type": "codeview", "pe.debug_directory_types[0]": 2, "pe.debug_entries[0].timestamp": 1317868477, "pe.load_config.security_cookie": "0x1001f9b0", "binary.top_complex_unnamed[0].cc": 114, "binary.top_complex_unnamed[1].cc": 110, "binary.top_complex_unnamed[2].cc": 65, "binary.top_complex_unnamed[3].cc": 56, "binary.top_complex_unnamed[4].cc": 50, "binary.top_complex_unnamed[5].cc": 50, "binary.top_complex_unnamed[6].cc": 49, "binary.top_complex_unnamed[7].cc": 49, "binary.top_complex_unnamed[0].bbs": 182, "binary.top_complex_unnamed[1].bbs": 173, "binary.top_complex_unnamed[2].bbs": 81, "binary.top_complex_unnamed[3].bbs": 92, "binary.top_complex_unnamed[4].bbs": 37, "binary.top_complex_unnamed[5].bbs": 37, "binary.top_complex_unnamed[6].bbs": 100, "binary.top_complex_unnamed[7].bbs": 100, "binary.top_complex_unnamed[0].addr": "0x100165c0", "binary.top_complex_unnamed[0].size": 1680, "binary.top_complex_unnamed[1].addr": "0x10016c80", "binary.top_complex_unnamed[1].size": 2246, "binary.top_complex_unnamed[2].addr": "0x10010899", "binary.top_complex_unnamed[2].size": 2872, "binary.top_complex_unnamed[3].addr": "0x100017b0", "binary.top_complex_unnamed[3].size": 4444, "binary.top_complex_unnamed[4].addr": "0x1000bbd0", "binary.top_complex_unnamed[4].size": 869, "binary.top_complex_unnamed[5].addr": "0x1000cb90", "binary.top_complex_unnamed[5].size": 869, "binary.top_complex_unnamed[6].addr": "0x10015b3c", "binary.top_complex_unnamed[6].size": 1346, "binary.top_complex_unnamed[7].addr": "0x1001607e", "binary.top_complex_unnamed[7].size": 1346, "pe.rich_header.entries[0].use_count": 27, "pe.rich_header.entries[1].use_count": 32, "pe.rich_header.entries[2].use_count": 3, "pe.rich_header.entries[3].use_count": 76, "pe.rich_header.entries[4].use_count": 119, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 110, "pe.rich_header.entries[1].product_id": 125, "pe.rich_header.entries[2].product_id": 147, "pe.rich_header.entries[3].product_id": 1, "pe.rich_header.entries[4].product_id": 109, "pe.rich_header.entries[5].product_id": 122, "pe.rich_header.entries[6].product_id": 120, "pe.rich_header.entries[0].build_number": 50727, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 50727, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 30729, "pe.rich_header.entries[2].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[3].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[4].build_number": 50727, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 50727, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 50727, "pe.rich_header.entries[6].product_name": "Cvtres_VS2008" }, "x": 50, "id": 0, "is": [ "GetLastError", "HeapFree", "HeapAlloc", "GetCurrentThreadId", "GetCommandLineA", "GetVersionExA", "GetProcessHeap", "GetProcAddress", "GetModuleHandleA", "ExitProcess", "HeapDestroy", "HeapCreate", "VirtualFree", "DeleteCriticalSection", "LeaveCriticalSection", "EnterCriticalSection", "VirtualAlloc", "HeapReAlloc", "WriteFile", "GetStdHandle", "GetModuleFileNameA", "TlsGetValue", "TlsAlloc", "TlsSetValue", "TlsFree", "InterlockedIncrement", "SetLastError", "InterlockedDecrement", "Sleep", "SetHandleCount", "GetFileType", "GetStartupInfoA", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "LoadLibraryA", "InitializeCriticalSection", "RtlUnwind", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "HeapSize", "MultiByteToWideChar", "GetLocaleInfoA", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "RaiseException" ], "ms": { "pe": { "machine": 332.0, "checksum": 258697.0, "pdb_path": "d:\\hehualiang\\HME_windows\\src\\Components\\codec\\codec_dll\\HME_Codec_iLBC.pdb", "rsrc_size": 4096.0, "subsystem": 2.0, "timestamp": 1317868477.0, "image_base": 268435456.0, "codeview_age": 1.0, "rsrc_entropy": 3.06, "codeview_guid": "D1A72498-C71E-43B0-9D7F-D0CEF50F8131", "entry_section": ".rmnet", "size_of_image": 225280.0, "timestamp_day": 6.0, "checksum_valid": true, "file_alignment": 4096.0, "resource_count": 1.0, "resource_types": [ "RT_MANIFEST" ], "timestamp_year": 2011.0, "characteristics": 8450.0, "entry_point_rva": 163840.0, "security_cookie": 268564912.0, "size_of_headers": 4096.0, "timestamp_month": 10.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1317868477.0, "import_dll_count": 1.0, "manifest_present": true, "computed_checksum": 258697.0, "section_alignment": 4096.0, "unusual_alignment": true, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1317868477.0, "debug_timestamp_min": 1317868477.0, "rich_header_present": true, "export_timestamp_day": 6.0, "linker_major_version": 8.0, "debug_directory_types": [ 2.0 ], "export_timestamp_year": 2011.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 10.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "entry_in_nonstandard_section": true, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 221184.0 }, "binary": { "code_size": 159744.0, "func_count": 115.0, "entry_point": 163840.0, "wx_sections": 1.0, "code_entropy": 7.23, "data_entropy": 5.76, "export_count": 1.0, "func_density": 0.74, "import_count": 61.0, "string_count": 299.0, "avg_func_size": 525.36, "section_count": 6.0, "avg_complexity": 13.78, "import_density": 0.39, "max_complexity": 114.0, "string_density": 1.92, "overall_entropy": 5.45, "avg_basic_blocks": 22.34, "avg_section_size": 36181.33, "dependency_count": 1.0, "entropy_variance": 1.64, "avg_string_length": 33.45, "complexity_per_kb": 0.09, "max_string_length": 3933.0, "wide_string_count": 1.0, "writable_sections": 2.0, "avg_string_entropy": 3.21, "code_to_data_ratio": 2.79, "data_to_file_ratio": 0.06, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.44, "total_basic_blocks": 2569.0, "executable_sections": 2.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 227.33, "debug_reference_count": 1.0, "high_complexity_funcs": 4.0, "largest_section_ratio": 0.44, "sentence_string_count": 45.0, "sentence_string_ratio": 0.15, "behavioral_import_ratio": 0.05, "unnamed_complex_func_count": 4.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 116, "xor", "ihy_WerObjecp" ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".rsrc" ], [ 639, "@.reloc" ], [ 679, "B.rmnet" ], [ 5084, "FP_3" ], [ 5186, "SWPV" ], [ 7865, "QWRS" ], [ 9128, "PVWS" ], [ 9893, "RQWPW" ], [ 15750, "SUVW3" ], [ 19610, "SUVW" ], [ 32028, "PQVR" ], [ 42720, "D\u003c\u003cV" ], [ 50625, "YYuTVWhU" ], [ 59499, "SQRP" ], [ 61775, "QQSV3" ], [ 64856, "xor", "met=wdrOܺ!ad" ], [ 66230, "QSUVW" ], [ 66749, "xor", "OHtUsu\"'bjes" ], [ 73870, "UVWS" ], [ 76992, "SSSSW" ], [ 78064, "WVU3" ], [ 81616, "xor", "Fu kru/qcz" ], [ 85162, "Hutj" ], [ 86381, "UQPXY]Y[" ], [ 96696, "SVW3" ], [ 96975, "xor", "3PIUwer;@WektI" ], [ 97558, "xor", "31IUwer;UWektI" ], [ 98628, "WWWWV" ], [ 102375, "xor", "GetUserObjectInformationAӘuUטsOҗdcȴof" ], [ 102748, "uniTC iLBC_codec V100R003P301" ], [ 105232, "CorExitProcess" ], [ 105248, "mscoree.dll" ], [ 105286, "GAIsProcessorFeaturePresent" ], [ 105316, "KERNEL32" ], [ 105328, "runtime error" ], [ 105348, "TLOSS error" ], [ 105364, "SING error" ], [ 105380, "DOMAIN error" ], [ 105392, "xor", "JotUserO0\\UP@Dd'" ], [ 105400, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 105407, "An application has made an attempt to load the C runtime library incorrectly." ], [ 105485, "Please contact the application's support team for more information." ], [ 105558, "xor", "Ge\u0026cCVABhGE\"" ], [ 105560, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 105567, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 105647, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 105808, "R6032\r\n- not enough space for locale information" ], [ 105815, "- not enough space for locale information" ], [ 105856, "xor", "JotUserO0\\UPEDdKO3" ], [ 105864, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 105871, "- Attempt to initialize the CRT more than once." ], [ 105919, "This indicates a bug in your application." ], [ 105964, "R6030\r\n- CRT not initialized" ], [ 105971, "- CRT not initialized" ], [ 105996, "R6028\r\n- unable to initialize heap" ], [ 106003, "- unable to initialize heap" ], [ 106036, "R6027\r\n- not enough space for lowio initialization" ], [ 106043, "- not enough space for lowio initialization" ], [ 106092, "R6026\r\n- not enough space for stdio initialization" ], [ 106099, "- not enough space for stdio initialization" ], [ 106148, "R6025\r\n- pure virtual function call" ], [ 106155, "- pure virtual function call" ], [ 106188, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 106195, "- not enough space for _onexit/atexit table" ], [ 106244, "R6019\r\n- unable to open console device" ], [ 106251, "- unable to open console device" ], [ 106288, "R6018\r\n- unexpected heap error" ], [ 106295, "- unexpected heap error" ], [ 106324, "R6017\r\n- unexpected multithread lock error" ], [ 106331, "- unexpected multithread lock error" ], [ 106372, "R6016\r\n- not enough space for thread data" ], [ 106379, "- not enough space for thread data" ], [ 106416, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 106418, "This application has requested the Runtime to terminate it in an unusual way." ], [ 106568, "R6009\r\n- not enough space for environment" ], [ 106575, "- not enough space for environment" ], [ 106612, "R6008\r\n- not enough space for arguments" ], [ 106619, "- not enough space for arguments" ], [ 106656, "R6002\r\n- floating point support not loaded" ], [ 106663, "- floating point support not loaded" ], [ 106704, "Microsoft Visual C++ Runtime Library" ], [ 106741, "xor", "Get_yeraLDe_" ], [ 106752, "\u003cprogram name unknown\u003e" ], [ 106776, "Runtime Error!\n\nProgram:" ], [ 106804, ".mixcrt" ], [ 106812, "EncodePointer" ], [ 106828, "KERNEL32.DLL" ], [ 106844, "DecodePointer" ], [ 106860, "FlsFree" ], [ 106868, "FlsSetValue" ], [ 106880, "FlsGetValue" ], [ 106892, "FlsAlloc" ], [ 106904, "InitializeCriticalSectionAndSpinCount" ], [ 106944, "kernel32.dll" ], [ 108006, "xor", "GetUserObjec" ], [ 112113, "160.134.63.204:5352" ], [ 113157, "xor", "GetUserObjectI.!z" ], [ 115235, "xor", "GetUserObjectInf" ], [ 115637, "184.85.116.130:16269" ], [ 115742, "xor", "lXtUs5eoeUP,k-K" ], [ 117442, "21.191.18.231:55615" ], [ 119384, "xor", "GetUserOWY" ], [ 119871, "\u003cV/\u003e" ], [ 121675, "xor", "8etUserObjectInformat" ], [ 123129, "xor", "GetuڽMObje" ], [ 124564, "xor", "GetUserObjec$f7i\n" ], [ 125108, "xor", "_BJiserObj" ], [ 125588, "xor", "GetUserObjec$f7i\n" ], [ 126068, "xor", "_BJiserObj" ], [ 126254, "xor", "GeuWpawIebli" ], [ 126287, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 126384, "GetProcessWindowStation" ], [ 126408, "GetUserObjectInformationA" ], [ 126436, "GetLastActivePopup" ], [ 126456, "GetActiveWindow" ], [ 126472, "MessageBoxA" ], [ 126484, "USER32.DLL" ], [ 126620, "floor" ], [ 126628, "ceil" ], [ 126636, "atan" ], [ 126644, "exp10" ], [ 126652, "acos" ], [ 126660, "asin" ], [ 126672, "log10" ], [ 126959, "xor", "GEtusErobJeCtinFoRmItAoFAoe\\USeROBjEcTINfOrMaTiOnaGEtusErobJeCtin." ], [ 127042, "xor", "WedUcebOrjucdI" ], [ 127076, "xor", "WedUcebOrjucdI" ], [ 127140, "xor", "FedUcebOrjucdI" ], [ 127473, "xor", "GEtusErobJeCtinFoRm\ttAoFAoe\\USeROBjEcTINfOrMaTiOnaGEtusErobJeCtin." ], [ 127474, "wide", "h(((( H" ], [ 127556, "xor", "WedUcebOrjucdI" ], [ 127590, "xor", "WedUcebOrjucdI" ], [ 127654, "xor", "FddUcebOrjucdI" ], [ 127690, "xor", "EdvTqdpN`kgbvHlgmso`vhmoCFguWrur_bzestinFoRmAtIoNAgeTUSeROBjEcTINfOrMaTiOnaGEtusErobJeCtinFoRmAtIoNAgeTU;ebOrjucdI~f" ], [ 127844, "xor", "SedUcebOrjucdIo" ], [ 127973, "xor", "FguWrgsMchdauHoform" ], [ 128152, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 128167, "xor", "hUEg@QGyUR\\YOuSXP2" ], [ 128536, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 128772, "dddd, MMMM dd, yyyy" ], [ 128792, "MM/dd/yy" ], [ 128812, "December" ], [ 128824, "November" ], [ 128836, "October" ], [ 128844, "September" ], [ 128856, "August" ], [ 128864, "July" ], [ 128872, "June" ], [ 128880, "April" ], [ 128888, "March" ], [ 128896, "February" ], [ 128908, "January" ], [ 128964, "Saturday" ], [ 128976, "Friday" ], [ 128984, "Thursday" ], [ 128996, "Wednesday" ], [ 129008, "Tuesday" ], [ 129016, "Monday" ], [ 129024, "Sunday" ], [ 129092, "_nextafter" ], [ 129140, "_hypot" ], [ 129180, "atan2" ], [ 129212, "SunMonTueWedThuFriSat" ], [ 129236, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 129342, "xor", "EuĬruqObj700" ], [ 129352, "RSDS" ], [ 129376, "d:\\hehualiang\\HME_windows\\src\\Components\\codec\\codec_dll\\HME_Codec_iLBC.pdb" ], [ 129900, "xor", "tmuE9ms_bjec" ], [ 130092, "xor", "GetUG\\s_bjec" ], [ 130184, "xor", "GetUserObjectInforma" ], [ 130454, "GetLastError" ], [ 130470, "HeapFree" ], [ 130482, "HeapAlloc" ], [ 130494, "GetCurrentThreadId" ], [ 130516, "GetCommandLineA" ], [ 130534, "GetVersionExA" ], [ 130550, "GetProcessHeap" ], [ 130568, "GetProcAddress" ], [ 130586, "GetModuleHandleA" ], [ 130606, "ExitProcess" ], [ 130620, "HeapDestroy" ], [ 130634, "HeapCreate" ], [ 130648, "VirtualFree" ], [ 130662, "DeleteCriticalSection" ], [ 130686, "LeaveCriticalSection" ], [ 130710, "EnterCriticalSection" ], [ 130734, "VirtualAlloc" ], [ 130750, "HeapReAlloc" ], [ 130764, "WriteFile" ], [ 130776, "GetStdHandle" ], [ 130792, "GetModuleFileNameA" ], [ 130814, "TlsGetValue" ], [ 130828, "TlsAlloc" ], [ 130840, "TlsSetValue" ], [ 130854, "TlsFree" ], [ 130864, "InterlockedIncrement" ], [ 130888, "SetLastError" ], [ 130904, "InterlockedDecrement" ], [ 130928, "Sleep" ], [ 130936, "SetHandleCount" ], [ 130954, "GetFileType" ], [ 130968, "GetStartupInfoA" ], [ 130986, "FreeEnvironmentStringsA" ], [ 131012, "GetEnvironmentStrings" ], [ 131036, "FreeEnvironmentStringsW" ], [ 131062, "WideCharToMultiByte" ], [ 131084, "GetEnvironmentStringsW" ], [ 131110, "QueryPerformanceCounter" ], [ 131136, "GetTickCount" ], [ 131152, "GetCurrentProcessId" ], [ 131174, "GetSystemTimeAsFileTime" ], [ 131200, "TerminateProcess" ], [ 131220, "GetCurrentProcess" ], [ 131240, "UnhandledExceptionFilter" ], [ 131268, "SetUnhandledExceptionFilter" ], [ 131298, "IsDebuggerPresent" ], [ 131318, "LoadLibraryA" ], [ 131334, "InitializeCriticalSection" ], [ 131362, "RtlUnwind" ], [ 131374, "GetCPInfo" ], [ 131396, "GetOEMCP" ], [ 131408, "IsValidCodePage" ], [ 131426, "HeapSize" ], [ 131438, "MultiByteToWideChar" ], [ 131460, "GetLocaleInfoA" ], [ 131478, "LCMapStringA" ], [ 131494, "LCMapStringW" ], [ 131510, "GetStringTypeA" ], [ 131528, "GetStringTypeW" ], [ 131546, "RaiseException" ], [ 131562, "KERNEL32.dll" ], [ 131619, "xor", "GUvWsebOb/gatIn.\"72\"" ], [ 131634, "HME_Codec_iLBC.dll" ], [ 131653, "HME_iLBC_GetAddr" ], [ 135743, "191.249.103.102:26246" ], [ 136154, "xor", "GetU3ZrObUec" ], [ 136514, "xor", "wZuM@ZqkTUbGMv" ], [ 140730, "xor", "T%tUQ%p)L*e" ], [ 141634, "xor", "o%uAH%pӘU" ], [ 141822, "xor", "@%vEm%paP*gs" ], [ 143200, "xor", "GetUserObjectInformationAGetUserObjectInformatio" ], [ 143769, "xor", "WetUserObjectI" ], [ 143926, "xor", "GetUserOrzusdY~v" ], [ 144190, "abcdefghijklmnopqrstuvwxyz" ], [ 144222, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 144442, "xor", "GetUserOrzusdY~v" ], [ 145382, "xor", "EudbqusObjuTvY" ], [ 145517, "xor", "8a4Tco2Nre%bd\\.g" ], [ 145746, "xor", "U!uEd!s_S.dsB" ], [ 145799, "xor", "8etUser_bjectInf" ], [ 145820, "xor", "GetUserObjec" ], [ 146190, "xor", "FugUse޷czDctIʞnbcati" ] ], "sz": 221184, "ts": [ { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 115.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.75, "d": "Large .data section in PE binary", "e": [ ".data (size: 12288, entropy: 5.94)" ], "i": "micro-behaviors/data/embedded/payload::large-data-section", "l": 3 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 115.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 13.78" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GEtusErobJeCtinFoRm", "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.21" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.23" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8500000238418579, "d": "DarkGate C2 record with embedded key anchor", "e": [ "8bunz8" ], "i": "well-known/malware/trojan/darkgate::c2-record-key-anchor", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 299.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 225280.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.68)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "45911" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 115.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\hehualiang\\HME_windows\\src\\Components\\codec\\codec_dll\\HME_Codec_iLBC.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.45" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 12288)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2569.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "d": "PDB path on non-standard drive letter", "e": [ "d:\\hehualiang\\HME_windows\\src\\Components\\codec\\codec_dll\\HME_Codec_iLBC.pdb" ], "i": "metadata/binary/debug::pdb-nonstandard-drive", "l": 3 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "HeapCreate", "CreateFileA", "CreateProcessA", "CreateMutexA" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-3", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 3 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1317868477.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "HME_Codec_iLBC.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4e", "48", "41", "46" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "160.134.63.204:5352", "184.85.116.130:16269", "21.191.18.231:55615" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "c": 0.9599999785423279, "d": "XOR decoded GetUserObject strings", "e": [ "GetUserObjectInforma", "GetUserObjec$f7i\n", "GetUserObjec", "GetUserObjectInf", "GetUserObjectI.!z" ], "i": "well-known/malware/trojan/elex/test-loader::xor-getuserobject-cluster", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 61.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".rmnet (size: 61440, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload::unusual-alignment-pe", "l": 4 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::wx-sections", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "58 90 01 10", "00 90 01 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "WideCharToMultiByte", "SetUnhandledExceptionFilter", "InitializeCriticalSection", "GetProcessWindowStation", "GetUserObjectInformationA", "UnhandledExceptionFilter", "InitializeCriticalSectionAndSpinCount", "InterlockedDecrement", "GetModuleFileNameA", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetSystemTimeAsFileTime", "MultiByteToWideChar", "GetUserObjectInformationAGetUserObjectInformatio", "SunMonTueWedThuFriSat", "InterlockedIncrement", "GetCurrentProcessId" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 endpoint in data section", "e": [ "191.249.103.102:26246" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-data-literal", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "21.191.18.231:55615", "184.85.116.130:16269", "160.134.63.204:5352" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetLastError, HeapFree, HeapAlloc, GetCurrentThreadId, GetCommandLineA, ... +56 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "QueryPerformanceCounter", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "00 90 01 10", "GetTickCount", "58 90 01 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 4 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Timing-based anti-debugging pattern", "e": [ "QueryPerformanceCounter", "IsDebuggerPresent", "IsDebuggerPresent", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug", "l": 2, "m": "B0003.003" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "GEtusErobJeCtinFoRmItAoFAoe\\USeROBjEcTIN \u003cxor\u003e", "WgtuserORnUkDE^v_f]yDu_JqoUXeCUro`jUctI \u003cxor\u003e", "GEtusErobJeCtinFoRm\ttAoFAoe\\USeROBjEcTIN \u003cxor\u003e", "EdvTqdpN`kgbvHlgmso`vhmoCFguWrur_bzestin \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor → base64", "e": [ "\u003cbinary data\u003e \u003cxor+base64\u003e" ], "i": "metadata/encoded-payload/xor-base64", "l": 3 } ], "sha": "e5e5f3da2db7b64d016fb5dee2577ca7dba4260a0c5ba5de153d6491c1464665", "path": "45911", "type": "pe" } ], "tv": "27ac5" } }