{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.8981485, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T01:31:23Z" }, "path": "17488", "raw": { "v": "4", "fs": [ { "f": "KO₈(As₁₀C₃DyAl₂Er₃IPPr)H₆(Cm₄CrDb₃Os₃Po₃Ti)Md₃(PaSiBi₃)", "x": 88, "id": 0, "is": [ "GetProcAddress", "WaitForSingleObject", "GetOverlappedResult", "GetVersionExW", "InitializeCriticalSectionAndSpinCount", "DeleteCriticalSection", "RaiseException", "CreateEventW", "OpenProcess", "GetExitCodeProcess", "ResetEvent", "WaitForMultipleObjects", "SetEvent", "GetComputerNameW", "ReleaseMutex", "CreateMutexW", "CreateNamedPipeW", "ConnectNamedPipe", "WaitNamedPipeW", "Sleep", "CancelIo", "CreateWaitableTimerW", "SetWaitableTimer", "GetModuleHandleW", "SetErrorMode", "DecodePointer", "GetEnvironmentStringsW", "GetCurrentProcessId", "GetModuleFileNameW", "InterlockedDecrement", "InterlockedIncrement", "GetCurrentProcess", "LocalFree", "CreateDirectoryW", "GetFileAttributesW", "WriteFile", "ReadFile", "CreateFileW", "CloseHandle", "FindResourceExW", "SizeofResource", "LockResource", "LoadResource", "FindResourceW", "GetProcessHeap", "WideCharToMultiByte", "MultiByteToWideChar", "HeapSize", "HeapReAlloc", "HeapFree", "HeapAlloc", "QueryPerformanceCounter", "FlushFileBuffers", "lstrlenA", "SetEndOfFile", "LoadLibraryW", "WriteConsoleW", "SetFilePointerEx", "GetConsoleMode", "FreeEnvironmentStringsW", "GetConsoleCP", "FreeLibrary", "SetEnvironmentVariableA", "ReadConsoleW", "SetStdHandle", "GetTimeZoneInformation", "UnregisterWaitEx", "HeapDestroy", "CancelWaitableTimer", "GetLastError", "QueryDepthSList", "InterlockedFlushSList", "InterlockedPushEntrySList", "GetFileType", "InterlockedPopEntrySList", "InitializeSListHead", "ReleaseSemaphore", "VirtualProtect", "VirtualFree", "VirtualAlloc", "GetModuleHandleA", "FreeLibraryAndExitThread", "GetThreadTimes", "IsDebuggerPresent", "OutputDebugStringW", "EnterCriticalSection", "LeaveCriticalSection", "GetCurrentThreadId", "DuplicateHandle", "GetCurrentThread", "GetExitCodeThread", "GetSystemTimeAsFileTime", "EncodePointer", "GetStringTypeW", "IsProcessorFeaturePresent", "ExitProcess", "GetModuleHandleExW", "GetCommandLineW", "RtlUnwind", "CreateTimerQueue", "WaitForSingleObjectEx", "SignalObjectAndWait", "SwitchToThread", "CreateThread", "SetThreadPriority", "GetThreadPriority", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "GetLogicalProcessorInformation", "CreateTimerQueueTimer", "ChangeTimerQueueTimer", "DeleteTimerQueueTimer", "GetNumaHighestNodeNumber", "GetProcessAffinityMask", "SetThreadAffinityMask", "RegisterWaitForSingleObject", "UnregisterWait", "GetCPInfo", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "SetLastError", "TerminateProcess", "GetStartupInfoW", "GetTickCount", "CreateSemaphoreW", "ExitThread", "LoadLibraryExW", "GetDateFormatW", "GetTimeFormatW", "CompareStringW", "LCMapStringW", "GetLocaleInfoW", "IsValidLocale", "GetUserDefaultLCID", "EnumSystemLocalesW", "GetStdHandle", "IsValidCodePage", "GetACP", "GetOEMCP", "RegCloseKey", "InitializeSecurityDescriptor", "CryptDeriveKey", "CryptDestroyHash", "CryptHashData", "CryptCreateHash", "RegDeleteKeyW", "RegSetValueExW", "RegCreateKeyExW", "RegEnumValueW", "RegEnumKeyExW", "RegQueryValueExW", "RegOpenKeyExW", "IsValidSid", "ConvertSidToStringSidW", "CryptReleaseContext", "CryptDestroyKey", "CryptDecrypt", "CryptEncrypt", "CryptExportKey", "CryptDuplicateKey", "CryptGenKey", "CryptImportKey", "CryptAcquireContextW", "LookupAccountNameW", "SetSecurityDescriptorDacl", "SHGetFolderPathW", "CoCreateInstance", "CoInitializeSecurity", "CoSetProxyBlanket", "CoInitializeEx", "CoUninitialize", "ORDINAL 2", "ORDINAL 150", "ORDINAL 7", "ORDINAL 6", "ORDINAL 9", "PathAppendW", "PathCombineA", "PathCombineW", "PathFileExistsW", "CryptStringToBinaryA", "CryptBinaryToStringA", "WinHttpOpen", "WinHttpConnect", "WinHttpOpenRequest", "WinHttpReceiveResponse", "WinHttpQueryHeaders", "WinHttpCloseHandle", "WinHttpReadData", "WinHttpSendRequest", "WinHttpQueryDataAvailable", "VerQueryValueW", "GetFileVersionInfoW", "GetFileVersionInfoSizeW" ], "ms": { "pe": { "signer": "Thawte Timestamping CA, Symantec Time Stamping Services CA - G2, TimeStamp-2048-1, Symantec Time Stamping Services Signer - G4, TimeStamp-2048-2, VeriSign Class 3 Code Signing 2010 CA, Assist Point, VeriSign Class 3 Public Primary Certification Authority - G5, VeriSignMPKI-2-8", "machine": 332.0, "checksum": 609422.0, "rsrc_size": 3584.0, "subsystem": 2.0, "timestamp": 1433677334.0, "image_base": 4194304.0, "rsrc_entropy": 4.17, "signing_time": 1433677335.0, "entry_section": ".text", "has_signature": true, "size_of_image": 569344.0, "timestamp_day": 7.0, "checksum_valid": true, "file_alignment": 512.0, "primary_signer": "Assist Point", "resource_count": 3.0, "signature_type": "developer", "timestamp_year": 2015.0, "characteristics": 258.0, "entry_point_rva": 152288.0, "size_of_headers": 1024.0, "timestamp_month": 6.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 9.0, "manifest_present": true, "signing_time_day": 7.0, "certificate_count": 1.0, "computed_checksum": 609422.0, "section_alignment": 4096.0, "signing_time_year": 2015.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "signing_time_month": 6.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 12.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 7440.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 368128.0, "file_size": 548112.0, "entry_point": 152288.0, "code_entropy": 6.63, "data_entropy": 4.67, "import_count": 196.0, "string_count": 1184.0, "has_signature": true, "section_count": 5.0, "avg_complexity": 7.48, "function_count": 1722.0, "import_density": 0.55, "max_complexity": 384.0, "string_density": 3.29, "overall_entropy": 5.34, "avg_basic_blocks": 11.6, "avg_section_size": 107929.6, "dependency_count": 9.0, "entropy_variance": 1.04, "function_density": 4.79, "avg_function_size": 384.61, "avg_string_length": 47.7, "complexity_per_kb": 0.02, "max_string_length": 629.0, "wide_string_count": 355.0, "writable_sections": 1.0, "avg_string_entropy": 3.51, "code_to_data_ratio": 2.15, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.67, "total_basic_blocks": 19970.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 80.4, "largest_section_ratio": 0.67, "sentence_string_count": 129.0, "sentence_string_ratio": 0.11, "behavioral_import_ratio": 0.07, "function_analysis_depth": 2.0, "high_complexity_functions": 27.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".rsrc" ], [ 655, "@.reloc" ], [ 11811, "LSVW" ], [ 14497, "SVWP" ], [ 17024, "PQVW" ], [ 22387, "XSVW" ], [ 24867, "TSVW" ], [ 27904, "PSVW" ], [ 34559, "WPWS" ], [ 34901, "AQWV" ], [ 37808, "PQSVW" ], [ 42192, "5T0H" ], [ 42403, "QSVW" ], [ 51677, "RSA1" ], [ 62585, "PVWS" ], [ 63050, "PVSW" ], [ 74369, "5 2H" ], [ 87791, "PPSW" ], [ 88966, "5T1H" ], [ 95179, "5P1H" ], [ 95263, "5D1H" ], [ 95576, "5X1H" ], [ 96130, "5H1H" ], [ 96236, "5L1H" ], [ 108901, "48CV" ], [ 109092, "VPVQ" ], [ 109717, "4XGV" ], [ 109944, "6QPQW" ], [ 121317, "AQPQ" ], [ 125043, "8SVW" ], [ 128962, "6t3h" ], [ 129201, "VWPR" ], [ 136056, "6PWQ" ], [ 163508, "WVPS" ], [ 164156, "PRSW" ], [ 165813, "QQSV" ], [ 166489, "YYPW" ], [ 166601, "8RCC" ], [ 166609, "8MOC" ], [ 171786, "RWPR" ], [ 180479, "SVW3" ], [ 184652, "HHtVHHt" ], [ 185838, "RPWQ" ], [ 187045, "5ntel" ], [ 189754, "SVAW" ], [ 196351, "PSQR" ], [ 197570, "HHtXHHt" ], [ 205156, "f90t" ], [ 205189, "f97t" ], [ 209248, "WVS3" ], [ 220703, "PWWV" ], [ 222842, "v6j0" ], [ 223027, "PRSQ" ], [ 228729, "GDQSP" ], [ 228797, "OHPSQ" ], [ 229114, "OHSSVSSW" ], [ 236798, "QQS3" ], [ 239581, "QVW3" ], [ 241581, "QQSVW" ], [ 252959, "NHB3" ], [ 255199, "QQVW" ], [ 256941, "f90u" ], [ 256959, "RVSQSWV" ], [ 257874, "9E W" ], [ 258690, "UVWS" ], [ 264789, "/PjSW" ], [ 274718, "PWWWWV" ], [ 274873, "PSSSSV" ], [ 279068, "VPRQ" ], [ 280169, "UQPXY]Y[" ], [ 281024, "WVU3" ], [ 289068, "9vdu" ], [ 319370, "Huzj" ], [ 324100, "HAO8" ], [ 330722, "KHVW3" ], [ 340538, "PRQW" ], [ 346480, "582H" ], [ 370416, "wide", "ERROR : Unable to initialize critical section in CAtlBaseModule" ], [ 370604, "device or resource busy" ], [ 370628, "invalid argument" ], [ 370648, "no such process" ], [ 370664, "not enough memory" ], [ 370684, "operation not permitted" ], [ 370708, "resource deadlock would occur" ], [ 370740, "resource unavailable try again" ], [ 372192, "permission denied" ], [ 372212, "file exists" ], [ 372224, "no such device" ], [ 372240, "filename too long" ], [ 372260, "io error" ], [ 372272, "directory not empty" ], [ 372292, "no space on device" ], [ 372312, "no such file or directory" ], [ 372340, "function not supported" ], [ 372364, "no lock available" ], [ 372384, "cross device link" ], [ 372404, "operation canceled" ], [ 372424, "too many files open" ], [ 372444, "permission_denied" ], [ 372464, "address_in_use" ], [ 372480, "address_not_available" ], [ 372504, "address_family_not_supported" ], [ 372536, "connection_already_in_progress" ], [ 372568, "bad_file_descriptor" ], [ 372588, "connection_aborted" ], [ 372608, "connection_refused" ], [ 372628, "connection_reset" ], [ 372648, "destination_address_required" ], [ 372680, "bad_address" ], [ 372692, "host_unreachable" ], [ 372712, "operation_in_progress" ], [ 372736, "interrupted" ], [ 372748, "invalid_argument" ], [ 372768, "already_connected" ], [ 372788, "too_many_files_open" ], [ 372808, "message_size" ], [ 372824, "filename_too_long" ], [ 372844, "network_down" ], [ 372860, "network_reset" ], [ 372876, "network_unreachable" ], [ 372896, "no_buffer_space" ], [ 372912, "no_protocol_option" ], [ 372932, "not_connected" ], [ 372948, "not_a_socket" ], [ 372964, "operation_not_supported" ], [ 372988, "protocol_not_supported" ], [ 373012, "wrong_protocol_type" ], [ 373032, "timed_out" ], [ 373044, "operation_would_block" ], [ 373068, "address family not supported" ], [ 373100, "address in use" ], [ 373116, "address not available" ], [ 373140, "already connected" ], [ 373160, "argument list too long" ], [ 373184, "argument out of domain" ], [ 373208, "bad address" ], [ 373220, "bad file descriptor" ], [ 373240, "bad message" ], [ 373252, "broken pipe" ], [ 373264, "connection aborted" ], [ 373284, "connection already in progress" ], [ 373316, "connection refused" ], [ 373336, "connection reset" ], [ 373356, "destination address required" ], [ 373388, "executable format error" ], [ 373412, "file too large" ], [ 373428, "host unreachable" ], [ 373448, "identifier removed" ], [ 373468, "illegal byte sequence" ], [ 373492, "inappropriate io control operation" ], [ 373528, "invalid seek" ], [ 373544, "is a directory" ], [ 373560, "message size" ], [ 373576, "network down" ], [ 373592, "network reset" ], [ 373608, "network unreachable" ], [ 373628, "no buffer space" ], [ 373644, "no child process" ], [ 373664, "no link" ], [ 373672, "no message available" ], [ 373696, "no message" ], [ 373708, "no protocol option" ], [ 373728, "no stream resources" ], [ 373748, "no such device or address" ], [ 373776, "not a directory" ], [ 373792, "not a socket" ], [ 373808, "not a stream" ], [ 373824, "not connected" ], [ 373840, "not supported" ], [ 373856, "operation in progress" ], [ 373880, "operation not supported" ], [ 373904, "operation would block" ], [ 373928, "owner dead" ], [ 373940, "protocol error" ], [ 373956, "protocol not supported" ], [ 373980, "read only file system" ], [ 374004, "result out of range" ], [ 374024, "state not recoverable" ], [ 374048, "stream timeout" ], [ 374064, "text file busy" ], [ 374080, "timed out" ], [ 374092, "too many files open in system" ], [ 374124, "too many links" ], [ 374140, "too many symbolic link levels" ], [ 374172, "value too large" ], [ 374188, "wrong protocol type" ], [ 374232, "bad allocation" ], [ 374308, "bad function call" ], [ 374632, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 375036, "Unknown exception" ], [ 375090, "wide", "Bmscoree.dll" ], [ 375116, "CorExitProcess" ], [ 375180, "Lock already taken" ], [ 375364, "pEvents" ], [ 375382, "wide", "Bkernel32.dll" ], [ 375412, "SetThreadGroupAffinity" ], [ 375436, "GetThreadGroupAffinity" ], [ 375460, "GetCurrentProcessorNumberEx" ], [ 375488, "GetLogicalProcessorInformationEx" ], [ 376976, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 377360, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 377600, "bad exception" ], [ 377616, "FlsAlloc" ], [ 377628, "FlsFree" ], [ 377636, "FlsGetValue" ], [ 377648, "FlsSetValue" ], [ 377660, "InitializeCriticalSectionEx" ], [ 377688, "CreateEventExW" ], [ 377704, "CreateSemaphoreExW" ], [ 377724, "SetThreadStackGuarantee" ], [ 377748, "CreateThreadpoolTimer" ], [ 377772, "SetThreadpoolTimer" ], [ 377792, "WaitForThreadpoolTimerCallbacks" ], [ 377824, "CloseThreadpoolTimer" ], [ 377848, "CreateThreadpoolWait" ], [ 377872, "SetThreadpoolWait" ], [ 377892, "CloseThreadpoolWait" ], [ 377912, "FlushProcessWriteBuffers" ], [ 377940, "FreeLibraryWhenCallbackReturns" ], [ 377972, "GetCurrentProcessorNumber" ], [ 378000, "GetLogicalProcessorInformation" ], [ 378032, "CreateSymbolicLinkW" ], [ 378052, "SetDefaultDllDirectories" ], [ 378080, "EnumSystemLocalesEx" ], [ 378100, "CompareStringEx" ], [ 378116, "GetDateFormatEx" ], [ 378132, "GetLocaleInfoEx" ], [ 378148, "GetTimeFormatEx" ], [ 378164, "GetUserDefaultLocaleName" ], [ 378192, "IsValidLocaleName" ], [ 378212, "LCMapStringEx" ], [ 378228, "GetCurrentPackageId" ], [ 378248, "GetTickCount64" ], [ 378264, "GetFileInformationByHandleExW" ], [ 378296, "SetFileInformationByHandleW" ], [ 378324, "RoInitialize" ], [ 378340, "wide", "combase.dll" ], [ 378364, "RoUninitialize" ], [ 384876, "wide", "az-az-cyrl" ], [ 384900, "wide", "az-az-latn" ], [ 384960, "wide", "bs-ba-latn" ], [ 385092, "wide", "div-mv" ], [ 385828, "wide", "kok-in" ], [ 386096, "wide", "quz-bo" ], [ 386112, "wide", "quz-ec" ], [ 386128, "wide", "quz-pe" ], [ 386240, "wide", "sma-no" ], [ 386256, "wide", "sma-se" ], [ 386272, "wide", "smj-no" ], [ 386288, "wide", "smj-se" ], [ 386304, "wide", "smn-fi" ], [ 386320, "wide", "sms-fi" ], [ 386348, "wide", "sr-ba-cyrl" ] ], "sz": 548112, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Thawte Timestamping CA", "e": [ "Thawte Timestamping CA" ], "i": "metadata/signed/developer::thawte-timestamping-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Symantec Time Stamping Services CA - G2", "e": [ "Symantec Time Stamping Services CA - G2" ], "i": "metadata/signed/developer::symantec-time-stamping-services-ca---g2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: TimeStamp-2048-1", "e": [ "TimeStamp-2048-1" ], "i": "metadata/signed/developer::timestamp-2048-1", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Symantec Time Stamping Services Signer - G4", "e": [ "Symantec Time Stamping Services Signer - G4" ], "i": "metadata/signed/developer::symantec-time-stamping-services-signer---g4", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: TimeStamp-2048-2", "e": [ "TimeStamp-2048-2" ], "i": "metadata/signed/developer::timestamp-2048-2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Code Signing 2010 CA", "e": [ "VeriSign Class 3 Code Signing 2010 CA" ], "i": "metadata/signed/developer::verisign-class-3-code-signing-2010-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Assist Point", "e": [ "Assist Point" ], "i": "metadata/signed/developer::assist-point", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Public Primary Certification Authority - G5", "e": [ "VeriSign Class 3 Public Primary Certification Authority - G5" ], "i": "metadata/signed/developer::verisign-class-3-public-primary-certification-authority---g5", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSignMPKI-2-8", "e": [ "VeriSignMPKI-2-8" ], "i": "metadata/signed/developer::verisignmpki-2-8", "l": 2 }, { "c": 1.0, "d": "Signed by Assist Point", "e": [ "Assist Point" ], "i": "metadata/signed/leaf::assist-point", "l": 3 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Create WinHTTP HTTP request handle", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client::winhttp-open-request", "l": 3, "m": "C0002" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "d": "COMPUTERNAME environment variable", "e": [ "GetComputerNameW" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "c": 0.75, "d": "CreateTimerQueue import (rare, common padding symbol)", "e": [ "CreateTimerQueue" ], "i": "metadata/binary/anomaly::import-padding-timer-queue", "l": 1 }, { "c": 0.8999999761581421, "d": "Encode binary to base64/hex via CryptoAPI", "e": [ "CryptBinaryToStringA" ], "i": "micro-behaviors/crypto/library::crypt-binary-to-string", "l": 3 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.63)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 196.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 548112.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Hash data using crypto provider", "e": [ "CryptHashData" ], "i": "micro-behaviors/crypto/library::crypt-hash-data", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 11264)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateTimerQueueTimer symbol", "e": [ "CreateTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::create-timer-queue-timer-sym", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1433677334.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.9800000190734863, "d": "DarkGate embedded C2 endpoint 12.114.130.55:45834", "e": [ "12.114.130.55:45834" ], "i": "well-known/malware/trojan/darkgate::c2-ip-45834", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "5c b0 45 00", "00 b3 45 00", "fc b0 45 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "Close WinHTTP handle object", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client::winhttp-close-handle", "l": 3, "m": "C0002" }, { "c": 0.8199999928474426, "d": "Set COM proxy security", "e": [ "CoSetProxyBlanket" ], "i": "micro-behaviors/os/com/invoke::co-set-proxy-blanket", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "Connect", "GetFolder", "Connect" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ ".?AVResourceManager@details@Concurrency@@", ".?AUIResourceManager@Concurrency@@" ], "i": "micro-behaviors/data/embedded/payload::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library::crypt-release-context", "l": 2 }, { "c": 0.8999999761581421, "d": "DeleteTimerQueueTimer symbol", "e": [ "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::delete-timer-queue-timer-sym", "l": 2 }, { "c": 0.9200000166893005, "d": "Registry write API text references", "e": [ "RegSetValueExW" ], "i": "objectives/command-and-control/dropper/staging::registry-write-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "Query WinHTTP response headers", "e": [ "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client::winhttp-query-headers", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 569344.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.7799999713897705, "d": "Combine filesystem paths via Shlwapi", "e": [ "PathCombineW" ], "i": "micro-behaviors/fs/path/construct::path-combine", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8799999952316284, "d": "ATL module RTTI markers", "e": [ "CAtlException@ATL@@" ], "i": "metadata/binary/framework::atl-module-rtti", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Initialize WinHTTP session", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client::winhttp-open", "l": 3, "m": "C0002" }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1722.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.51" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer-ex", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Check file existence via SHLWAPI", "e": [ "PathFileExistsW" ], "i": "micro-behaviors/fs/path/check::path-file-exists", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1184.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8799999952316284, "d": "Import encrypted key material", "e": [ "CryptImportKey" ], "i": "micro-behaviors/crypto/library::crypt-import-key", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2 }, { "c": 1.0, "d": "Uses named pipe IPC APIs", "e": [ "CreateNamedPipeW", "ConnectNamedPipe", "WaitNamedPipeW" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "l": 2 }, { "c": 0.8999999761581421, "d": "Decrypt buffer with CryptoAPI", "e": [ "CryptDecrypt" ], "i": "micro-behaviors/crypto/library::crypt-decrypt", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query computer/host name", "e": [ "GetComputerNameW" ], "i": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.9800000190734863, "d": "DarkGate embedded C2 endpoint 168.227.253.142:38056", "e": [ "168.227.253.142:38056" ], "i": "well-known/malware/trojan/darkgate::c2-ip-38056", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.34" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1722.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 150", "e": [ "ORDINAL 150" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-150", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "49", "48", "48", "46", "49", "49" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "WAdvapi32.dll", "ADVAPI32.dll", "Dadvapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.7799999713897705, "d": "Append child path via Shlwapi", "e": [ "PathAppendW" ], "i": "micro-behaviors/fs/path/construct::path-append", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Receive WinHTTP server response", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client::winhttp-receive-response", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8500000238418579, "d": "DarkGate C2 record with embedded key anchor", "e": [ "8bunz8" ], "i": "well-known/malware/trojan/darkgate::c2-record-key-anchor", "l": 1 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateNamedPipe API symbol", "e": [ "CreateNamedPipeW" ], "i": "objectives/privilege-escalation/hijack-execution-flow/named-pipe::create-named-pipe-symbol", "l": 1 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Read WinHTTP response body", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client::winhttp-read-data", "l": 3, "m": "C0002" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.48" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32", "e": [ "SHGetFolderPathW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-folder-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically pop entry from thread-safe list", "e": [ "InterlockedPopEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-pop-entry-slist", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 548112.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Encrypt buffer with CryptoAPI", "e": [ "CryptEncrypt" ], "i": "micro-behaviors/crypto/library::crypt-encrypt", "l": 2 }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Query WinHTTP buffered response bytes", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client::winhttp-query-data-available", "l": 3, "m": "C0002" }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.800000011920929, "d": "Dynamic API resolution str Bkernel32", "e": [ "Bkernel32.dll" ], "i": "objectives/anti-static/obfuscation/imports::bkernel32-dll", "l": 4 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Send WinHTTP request to server", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client::winhttp-send-request", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8399999737739563, "d": "Initialize COM security context", "e": [ "CoInitializeSecurity" ], "i": "micro-behaviors/os/com/invoke::co-initialize-security", "l": 3 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Create cryptographic hash object", "e": [ "CryptCreateHash" ], "i": "micro-behaviors/crypto/library::crypt-create-hash", "l": 2 }, { "d": "overflow keyword", "e": [ "_DebugMallocator\u003cT\u003e::allocate() - Integer overflow." ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 196.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve account name to SID", "e": [ "LookupAccountNameW" ], "i": "micro-behaviors/os/user/lookup::lookup-account-name", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "Initialize COM apartment model", "e": [ "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::co-initialize-ex", "l": 2 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.800000011920929, "d": "Convert SID to string representation", "e": [ "ConvertSidToStringSidW" ], "i": "micro-behaviors/os/group/lookup::convert-sid-to-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Transacted registry API name", "e": [ "RegCreateKeyTransactedW", "RegOpenKeyTransactedW" ], "i": "well-known/malware/trojan/elex::transacted-registry-api-name", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 19970.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library::crypt-acquire-context", "l": 2, "m": "C0027" }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Connect WinHTTP to remote host", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client::winhttp-connect", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 3584.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Decode base64/hex string via CryptoAPI", "e": [ "CryptStringToBinaryA" ], "i": "micro-behaviors/crypto/library::crypt-string-to-binary", "l": 3 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1722.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "OHSSVSSW" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1559", "c": 0.699999988079071, "d": "Wait for named pipe server", "e": [ "WaitNamedPipeW" ], "i": "micro-behaviors/communications/ipc/named-pipe::wait-named-pipe", "l": 3 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1184.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically push entry to thread-safe list", "e": [ "InterlockedPushEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-push-entry-slist", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1722.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1722.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1559", "c": 0.6499999761581421, "d": "ConnectNamedPipe API call", "e": [ "ConnectNamedPipe" ], "i": "micro-behaviors/communications/ipc/named-pipe::connect-named-pipe", "l": 3 }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "a": "T1087", "c": 0.8500000238418579, "d": "Convert SID to string form", "e": [ "ConvertSidToStringSidW" ], "i": "objectives/discovery/account/lookup::sid-string-conversion", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Derive symmetric key from hash", "e": [ "CryptDeriveKey" ], "i": "micro-behaviors/crypto/library::crypt-derive-key", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry open API lookup", "e": [ "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-transacted-name", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "8c b1 45 00", "00 b1 45 00", "a4 b0 45 00", "8c b1 45 00", "7c b0 45 00", "20 b2 45 00", "8c b1 45 00", "8c b1 45 00", "8c b1 45 00", "8c b1 45 00", "8c b1 45 00", "8c b1 45 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "Bkernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "168.227.253.142:38056", "12.114.130.55:45834" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1559", "c": 0.699999988079071, "d": "CreateNamedPipe API call", "e": [ "CreateNamedPipeW" ], "i": "micro-behaviors/communications/ipc/named-pipe::create-named-pipe", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1184.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1722.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.8199999928474426, "d": "Opaque token in version resource", "e": [ "BiclOTUkFSgjJzUBHgI4LTsTJBsSKyYfGxkQPAktADcxExY+HC8bJQIMITkOLQU0Hyk8CyESCzk1ORkuEzYVES8VIgQHHDUdMTIfID42PwkMJzoGCR8QPS43DQAAAFA=" ], "i": "metadata/package/versioning::pe-version-resource-opaque-token", "l": 3 }, { "a": "T1140", "c": 0.800000011920929, "d": "Large base64 encoded payload", "e": [ "aS4/ICQgIz0YLhAlGiA8IjUjBhg7ERooMwIjNjEwPRsBPRQIMBYMIhE4IhA+Dgk0AT0TBBgdIwItAScuBAAuMTw/IT87GCI7PhE4HAMfNQ8sHxs5FBwuBQcQBBM/CC0h", "JjglNQAhKS4tDQ8aMBQWADcvBz8yNB4BOhsvNQQeDyckIyMRJgYpPBEHCywqIBU0Hhg2BiIcLCMCMzELKQElFBUZIgYTKwYsDg4qOx4XNg03MysSOzk4Fww7BSAXExIX", "Cj0lIy8+Imdtc2Z0OTA4PyJlPSoyNy4/eT4yPyk8NXQ4MSs1NQ0OKxQkCA8KCBg9Kgw1PyonDiUZCj8+FAEEGiwzIgEEDgkxKxcBPT4RFgwTAggfODY/Pw8QAT8CCAsY", "Cj0lIy8+ImdtZWZ0NyRsfS1iciE2ciIpMzY0Jms9Ijc6MTQxMS4lJysFFAYeKBMMFDAMGwUvADQYIjooIhYCBi07Ly8kIxIjExMlAiUMMBEzCx8eKDAFNScwHR0CPhIS", "Cj0lIy8+ImdtZWZ0NyRsfQ1iciE2ciw5KzIuci88JDg3IickLCgkMAohEQEGCz0nFAkLMAARAxAUMRwbJgEZATwZHS0eHTcaMi4dCwo0BgIvNwQIAAcDKygjJDY3Oz4z", "YjgwJzw3CR44GjsTMAw9FCkrKysqKA8oDRI/Pj8VAT8fMTQSIwQlAhIjMCwkLiAQABkLBxwiAzoPPDsPNDMwBiUlEiY9HCMHIi4DAzQ0OCE7CAwqDAsVPAYOFwMTPzY3", "JjAyOTI5KikrJWEnMS5sOTgkICk7Jig5KnMyKjs8JCAzNGYkKmc6KDMnPXY5NDkmPSw9cj4+KyE4NSotInQmMS8iayE6ECMnNRogHAMoIhs/GQcuHgcEID86NSIZHiMz", "BDs7PSM+MTRqJDQnLHY/LjE3JmgvOzkjeXw1Pz46CRgdKAUDLy45DCM4PjUeNDgqAw42IQUNHQkfICYdIjsFHzQ4FyENMyQyECEZFBYkJSwhIDg8PwMGAQ8eJCQOEREf", "FTE3PGY/MDNqJid0LTg/MzcrNyx4OyM/PDQyIGsrJjoxNRYfKz0TJwc7KQMPMxkfIRobKyIJABECKxMxFD4QGSIqPTAkGjsxLjk/FR0gOwMQGh4bPR8ZPiEgABwTHzAo", "NCAkNSc9ZSI4Oy4mEDsBGQcJHScMEyYSDj0bBhgsFh85BiE0ESEHHRUOCB0cEQYAJQ4wICkEOjc5EBojLB4XPRYTIhAMIQgsMgYHDCMiPQcXKCMOKCABFgUKBDskEgkD", "IzUiMWY1NzUlOwAAEic/IzsDIRAfEw8GKSY1JgQfBCAwOgwxDAA4JiwhKTAZCRoDCCkaNj8YPjkCBjERPwQcFwEjIjcQGBsNGzAYKCEBKDkaOS8CHSIdHC8xMx0EBwQl", "LjolJSA2LCQjLC8geDspNz83KzgcPR4MKAcOHyYPDxoyIBMGIBcALhA5DjE/ORcCIQEBEBUBGB0QMCwYDR8YPxQxJAU/DQwDGw8KEgk3OQY0PhkCNQMhCw4yDi4eEjcq", "Sl43KikxKTQCATEODz48CT4vOzEoHiYYChYzJggXIgMFMSEbLwUMMA0uDgwBGzk0GA4qPTcsKjA+BzMyLTkOHA8UDi0QDSsHITQ7KhkjHgo3GhUiNzUvAjM4BDM+KAc+", "egQdNgwmAjQAHyITLAQ8KR0DFysaGgACCgACIwQ9KR0SIzwbLQk5Bg8/EBUNGDY1KA8ZNSc9DzgjJhE0PTEQNAIKAywbOwc4HgIkHQUEICQ2GD4cEjA5FQYaBRkAHCAG", "aDsuGxIjCCYEMyYCIBk1AxcKEwUQHicJMREbECMLBD8lKQIHFyUOMQo5Ch4rChsDNwQMMCwaGyENETs7Hy0lExcbLzEcOxA4ADsEADsOFzs+MykOFDgtJS8bMz4kEw4Z", "YmYUFjMqNT0hHgIgLiMPLT0JGwUuPiUoEgsjJjsDHQc7BisbMgICBSwwEgweCzgnNDIdBik+DwAQJxwNPyIkFxQbAiwIPi4hFzEIEz8dMCUfAQkHMgUcMB8QMSAxMyk8" ], "i": "micro-behaviors/data/encode/payload::large-base64-payload", "l": 3, "m": "C0043" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SetThreadGroupAffinity", "GetThreadGroupAffinity", "GetCurrentProcessorNumberEx", "GetLogicalProcessorInformationEx", "InitializeCriticalSectionEx", "SetThreadStackGuarantee", "WaitForThreadpoolTimerCallbacks", "FlushProcessWriteBuffers", "FreeLibraryWhenCallbackReturns", "GetCurrentProcessorNumber", "GetLogicalProcessorInformation", "SetDefaultDllDirectories", "EnumSystemLocalesEx", "GetUserDefaultLocaleName", "GetCurrentPackageId", "GetFileInformationByHandleExW" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "168.227.253.142:38056", "12.114.130.55:45834" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry delete API lookup", "e": [ "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-delete-key-transacted-name", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry create API lookup", "e": [ "RegCreateKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-transacted-name", "l": 3 }, { "c": 0.8999999761581421, "d": "Set thread CPU affinity", "e": [ "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::set-thread-affinity-mask", "l": 3 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathAppendW, PathCombineA, PathCombineW, PathFileExistsW)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links CRYPT32.dll (CryptStringToBinaryA, CryptBinaryToStringA)", "e": [ "CRYPT32.dll" ], "i": "metadata/dylib::crypt32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINHTTP.dll (WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, WinHttpReceiveResponse, WinHttpQueryHeaders, ... +4 more)", "e": [ "WINHTTP.dll" ], "i": "metadata/dylib::winhttp/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey, InitializeSecurityDescriptor, CryptDeriveKey, CryptDestroyHash, CryptHashData, ... +21 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetProcAddress, WaitForSingleObject, GetOverlappedResult, GetVersionExW, InitializeCriticalSectionAndSpinCount, ... +136 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 2, ORDINAL 150, ORDINAL 7, ORDINAL 6, ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetFolderPathW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, CoInitializeSecurity, CoSetProxyBlanket, CoInitializeEx, CoUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "EnumSystemLocalesW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-fingerprinting-imports", "l": 2 }, { "a": "T1559", "c": 0.8199999928474426, "d": "Named pipe server and client wait", "e": [ "CreateNamedPipeW", "WaitNamedPipeW", "ConnectNamedPipe" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-client-server", "l": 3 }, { "c": 0.8999999761581421, "d": "Timer queue create + delete lifecycle", "e": [ "CreateTimerQueueTimer", "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback::timer-queue-lifecycle", "l": 2 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 196.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "WinHTTP request response data flow", "e": [ "WinHttpReadData", "WinHttpSendRequest", "WinHttpReceiveResponse", "WinHttpQueryDataAvailable", "WinHttpOpenRequest", "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client::winhttp-request-flow", "l": 3, "m": "C0002" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleExW", "GetModuleHandleA", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "VS_VERSION_INFO", "FileVersion", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.800000011920929, "d": "Signed versioned temp handoff context", "e": [ "VS_VERSION_INFO", "Thawte Timestamping CA", "VeriSignMPKI-2-8", "TimeStamp-2048-2", "TimeStamp-2048-1", "Symantec Time Stamping Services CA - G2", "VeriSign Class 3 Code Signing 2010 CA", "VeriSign Class 3 Public Primary Certification Authority - G5", "Assist Point", "Symantec Time Stamping Services Signer - G4", "binary.import_count = 196.00" ], "i": "objectives/command-and-control/dropper/execution/loader::signed-versioned-temp-handoff-profile", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.8999999761581421, "d": "COM proxy setup for WMI automation", "e": [ "CoSetProxyBlanket", "CoCreateInstance", "CoInitializeSecurity", "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::wmi-com-proxy-setup", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExW", "RegCreateKeyExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceExW", "LockResource", "FindResourceW", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "ExitProcess", "GetLastError", "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Semaphore coordination with wait logic", "e": [ "CreateSemaphoreW", "ReleaseSemaphore", "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::coordinated-semaphore-wait", "l": 2, "m": "C0042" }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "FindResourceExW", "LoadResource", "FindResourceW", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 1 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedPushEntrySList", "InterlockedFlushSList", "InterlockedPopEntrySList", "InitializeSListHead" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "c": 0.9300000071525574, "d": "Small version resource with opaque blobs", "e": [ "BiclOTUkFSgjJzUBHgI4LTsTJBsSKyYfGxkQPAktADcxExY+HC8bJQIMITkOLQU0Hyk8CyESCzk1ORkuEzYVES8VIgQHHDUdMTIfID42PwkMJzoGCR8QPS43DQAAAFA=", "FileVersion", "pe.rsrc_size = 3584.00", "VS_VERSION_INFO", "ProductVersion" ], "i": "metadata/package/versioning::compact-opaque-version-resource", "l": 4 }, { "c": 0.8799999952316284, "d": "CryptoAPI key setup from derived or imported material", "e": [ "CryptImportKey", "CryptDeriveKey", "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library::capi-key-material-setup", "l": 2 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "CreateMutexW", "OHSSVSSW" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Query and modify CPU affinity", "e": [ "GetProcessAffinityMask", "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::affinity-mask-control", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry API fallback chain", "e": [ "RegDeleteKeyTransactedW", "RegCreateKeyTransactedW", "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::registry-transacted-api-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetCommandLineW", "GetCurrentThreadId", "GetUserDefaultLCID", "GetLocaleInfoW", "EnumSystemLocalesW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "a": "T1140", "c": 0.8500000238418579, "d": "CryptoAPI file decryption loader markers", "e": [ "CreateFileW", "CryptDecrypt", "ReadFile", "CryptImportKey", "VirtualProtect", "CryptAcquireContextW", "CreateThread" ], "i": "objectives/command-and-control/dropper/staging::capi-file-payload-decrypt-loader", "l": 3, "m": "B0023" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetLocaleInfoW", "FreeEnvironmentStringsW", "EnumSystemLocalesW", "GetEnvironmentStringsW", "GetUserDefaultLCID", "EnumSystemLocalesEx" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 2, "m": "E1082" }, { "a": "T1559", "c": 0.800000011920929, "d": "Named pipe server creation", "e": [ "CreateNamedPipeW", "ConnectNamedPipe" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-server", "l": 3 }, { "a": "T1087", "c": 0.9399999976158142, "d": "Resolve Windows accounts and SID strings", "e": [ "LookupAccountNameW", "ConvertSidToStringSidW" ], "i": "objectives/discovery/account/lookup::sid-account-resolution", "l": 3 }, { "c": 0.8999999761581421, "d": "CryptoAPI key setup with buffer encryption operations", "e": [ "CryptImportKey", "CryptDeriveKey", "CryptEncrypt", "CryptDecrypt", "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library::capi-keyed-buffer-crypto-chain", "l": 3 }, { "a": "T1071.001", "c": 0.9399999976158142, "d": "WinHTTP C2 with staged loader host integration profile", "e": [ "GetLastError", "WinHttpReadData", "SizeofResource", "CryptDeriveKey", "WinHttpSendRequest", "RegOpenKeyExW", "CryptDecrypt", "CryptAcquireContextW", "FindResourceW", "LoadResource", "CryptImportKey", "FindResourceExW", "LockResource", "CryptEncrypt", "WinHttpQueryDataAvailable", "WinHttpReceiveResponse" ], "i": "objectives/command-and-control/backdoor/binary::winhttp-staged-loader-profile", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "EnumSystemLocalesW", "GetSystemTimeAsFileTime", "EnumSystemLocalesEx", "GetLocaleInfoW", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetCommandLineW", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 2, "m": "E1082" } ], "sha": "e6a3b91789945659eb5b22d267b58af1dcb91aa49339c9b99ad3b3edd12207f5", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/17488", "type": "pe" } ], "tv": "2a0fe" } }