{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9313873648643494 } ], "prob": 0.93138736, "models": [ { "m": "az", "prob": 0.93138736, "class": 0 }, { "m": "az/native", "prob": 0.3539519, "class": 0 }, { "m": "az/pe", "prob": 0.12561576, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-03T20:14:23Z" }, "path": "e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e.exe", "raw": { "v": "6", "fs": [ { "f": "O₂(DyEr)H(Po)Md(Bi)", "x": 10, "ff": { "i": [ [ "winmm", "waveOutGetVolume" ], [ "winmm", "waveInReset" ], [ "winmm", "waveInUnprepareHeader" ], [ "winmm", "waveInClose" ], [ "winmm", "waveInOpen" ], [ "winmm", "waveInPrepareHeader" ], [ "winmm", "waveInAddBuffer" ], [ "winmm", "waveInStart" ], [ "winmm", "waveOutSetVolume" ], [ "winmm", "mixerOpen" ], [ "winmm", "mixerGetLineInfoA" ], [ "winmm", "mixerClose" ], [ "winmm", "mixerGetLineControlsA" ], [ "winmm", "mixerGetControlDetailsA" ], [ "winmm", "mixerSetControlDetails" ], [ "winmm", "mciGetErrorStringA" ], [ "comctl32", "ORDINAL 17" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "IsBadCodePtr" ], [ "kernel32", "IsBadReadPtr" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "SetConsoleCtrlHandler" ], [ "kernel32", "OutputDebugStringA" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "GetTimeZoneInformation" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "InterlockedExchange" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "GetStringTypeA" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "EnumSystemLocalesA" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "GetDateFormatA" ], [ "kernel32", "GetTimeFormatA" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "CompareStringA" ], [ "kernel32", "CompareStringW" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "GetStartupInfoA" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "RaiseException" ], [ "kernel32", "HeapFree" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "VirtualProtect" ], [ "kernel32", "GetSystemInfo" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "LCMapStringA" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "GetLastError" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "SetEnvironmentVariableA" ], [ "kernel32", "SetLastError" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetCurrentThread" ], [ "kernel32", "TlsFree" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "FatalAppExitA" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "HeapDestroy" ], [ "kernel32", "HeapCreate" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "IsBadWritePtr" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "FreeEnvironmentStringsA" ], [ "kernel32", "GetEnvironmentStrings" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "SetHandleCount" ], [ "kernel32", "GetFileType" ], [ "kernel32", "HeapSize" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "GetLocaleInfoA" ], [ "user32", "LoadIconA" ], [ "user32", "DialogBoxParamA" ], [ "user32", "SendMessageA" ], [ "user32", "EndDialog" ], [ "user32", "GetDlgItem" ], [ "user32", "GetClientRect" ], [ "user32", "GetDC" ], [ "user32", "ReleaseDC" ], [ "user32", "GetDlgCtrlID" ], [ "user32", "ShowWindow" ], [ "user32", "MessageBoxA" ], [ "gdi32", "DeleteDC" ], [ "gdi32", "CreateCompatibleDC" ], [ "gdi32", "CreateCompatibleBitmap" ], [ "gdi32", "CreateSolidBrush" ], [ "gdi32", "DeleteObject" ], [ "gdi32", "SelectObject" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_safe_seh": 1.0, "checksum_valid": 0.0, "resource_count": 5.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 308148.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 274432.0, "entropy": 4.99, "size_bytes": 274432.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.44, "data_entropy": 1.97, "string_count": 1436.0, "overall_entropy": 4.99, "entropy_variance": 1.89, "avg_string_length": 9.46, "max_string_length": 175.0, "code_to_data_ratio": 0.83, "string_length_stddev": 12.06, "largest_section_ratio": 0.48, "sentence_string_count": 64.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 1.0 }, "imports": { "count": 115.0 }, "sections": { "count": 5.0, "code_size": 102400.0, "entropy_max": 5.44, "entropy_mean": 3.55, "name_entropy": 2.97, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 224, "u8", "Rich" ], [ 496, "u8", ".text" ], [ 575, "u8", "@.data" ], [ 616, "u8", ".idata" ], [ 656, "u8", ".rsrc" ], [ 7059, "u8", "SUVW" ], [ 7686, "u8", "SUVWP" ], [ 14387, "u8", "L$ QRP" ], [ 15948, "u8", "QQSVWd" ], [ 16907, "u8", "SVWUj" ], [ 21178, "u8", "RPWS" ], [ 22894, "u8", "BBFFf" ], [ 22919, "u8", "AABBf" ], [ 22938, "u8", "LSVWj" ], [ 23404, "u8", "E SSSS" ], [ 26994, "u8", "9x4t" ], [ 27004, "u8", "9x0t" ], [ 27498, "u8", "SVWU" ], [ 29275, "u8", "uiSj" ], [ 36924, "u8", "QSVW" ], [ 37963, "u8", "QQSVW3" ], [ 39786, "u8", "wLVWP" ], [ 40054, "u8", "FVWS" ], [ 43117, "u8", "VWj Y" ], [ 43377, "u8", "SVWj ^" ], [ 46599, "u8", "6PWS" ], [ 46743, "u8", "WWWWVSW" ], [ 46780, "u8", "t2WWVPVSW" ], [ 47953, "u8", "tBHt0" ], [ 48069, "u8", "HHteHHtPHt+H" ], [ 50302, "u8", "FDPjG" ], [ 50319, "u8", "FHPjH" ], [ 50336, "u8", "FLPjI" ], [ 50356, "u8", "FPPjJ" ], [ 50373, "u8", "FTPjK" ], [ 50390, "u8", "FXPjL" ], [ 51481, "u8", "QQSV3" ], [ 51493, "u8", "WuO95" ], [ 52210, "u8", "QSV3" ], [ 52454, "u8", "C PjPVj" ], [ 52588, "u8", "C.PjRVj" ], [ 63130, "u8", "u8SS3" ], [ 66796, "u8", "tCNun" ], [ 66956, "u8", "HHtjHHtF" ], [ 68304, "u8", "QQSVW" ], [ 68796, "u8", "f958" ], [ 68864, "u8", "PVVWV" ], [ 68976, "u8", "VVVVVUWUUj" ], [ 68996, "u8", "VVVVVj" ], [ 72743, "u8", "VVVVj" ], [ 72923, "u8", "PVPWW" ], [ 106528, "u8", "f2npmsW8GlatqcSYCpSrlQzGzQhHdbUtUKIxkDcFyF3B79TaWJEsiFHDQWu1De6W" ], [ 106844, "u8", "0x%08X returned!" ], [ 106876, "u8", "ERROR 0x%08X: %s" ], [ 106932, "u8", "Close" ], [ 106944, "u8", "Open" ], [ 106952, "u8", "Error starting record! -- %08X" ], [ 106992, "u8", "Error queueing WAVEHDR 2! -- %08X" ], [ 107036, "u8", "Error queueing WAVEHDR 1! -- %08X" ], [ 107080, "u8", "Error preparing WAVEHDR 2! -- %08X" ], [ 107124, "u8", "Error preparing WAVEHDR 1! -- %08X" ], [ 107168, "u8", "ERROR: Can't allocate memory for WAVE buffer!" ], [ 107224, "u8", "Can't open WAVE In Device!" ], [ 107256, "u8", "Error unable to set recording WAVEOUT device" ], [ 107312, "u8", "OK GOOGLE)))" ], [ 107328, "u8", "reglagesepare" ], [ 107344, "u8", "nygNeFT}dF8~g4wvh9ye@FMAgNmS94?SkFb7O8eXZnw?3by|j~2LBCNR2EjoMnghG2A~Z}v3GXa" ], [ 107460, "u8", "bad allocation" ], [ 107536, "u8", "Unknown exception" ], [ 107705, "u8", "700WP" ], [ 107721, "u8", "`h````" ], [ 107756, "wide", "(null)" ], [ 107772, "u8", "(null)" ], [ 107830, "u8", "GAIsProcessorFeaturePresent" ], [ 107860, "u8", "KERNEL32" ], [ 108191, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 108288, "u8", "LC_TIME" ], [ 108296, "u8", "LC_NUMERIC" ], [ 108308, "u8", "LC_MONETARY" ], [ 108320, "u8", "LC_CTYPE" ], [ 108332, "u8", "LC_COLLATE" ], [ 108344, "u8", "LC_ALL" ], [ 108432, "u8", "FlsFree" ], [ 108440, "u8", "FlsSetValue" ], [ 108452, "u8", "FlsGetValue" ], [ 108464, "u8", "FlsAlloc" ], [ 108476, "u8", "kernel32.dll" ], [ 108652, "u8", "CorExitProcess" ], [ 108668, "u8", "mscoree.dll" ], [ 108692, "u8", "runtime error" ], [ 108712, "u8", "TLOSS error" ], [ 108728, "u8", "SING error" ], [ 108744, "u8", "DOMAIN error" ], [ 108760, "u8", "R6029\r\n- This application cannot run using the active version of the Microsoft .NET Runtime\nPlease contact the application's sup" ], [ 108767, "u8", "- This application cannot run using the active version of the Microsoft .NET Runtime" ], [ 108852, "u8", "Please contact the application's support team for more information." ], [ 108924, "u8", "R6028\r\n- unable to initialize heap" ], [ 108931, "u8", "- unable to initialize heap" ], [ 108964, "u8", "R6027\r\n- not enough space for lowio initialization" ], [ 108971, "u8", "- not enough space for lowio initialization" ], [ 109020, "u8", "R6026\r\n- not enough space for stdio initialization" ], [ 109027, "u8", "- not enough space for stdio initialization" ], [ 109076, "u8", "R6025\r\n- pure virtual function call" ], [ 109083, "u8", "- pure virtual function call" ], [ 109116, "u8", "R6024\r\n- not enough space for _onexit/atexit table" ], [ 109123, "u8", "- not enough space for _onexit/atexit table" ], [ 109172, "u8", "R6019\r\n- unable to open console device" ], [ 109179, "u8", "- unable to open console device" ], [ 109216, "u8", "R6018\r\n- unexpected heap error" ], [ 109223, "u8", "- unexpected heap error" ], [ 109252, "u8", "R6017\r\n- unexpected multithread lock error" ], [ 109259, "u8", "- unexpected multithread lock error" ], [ 109300, "u8", "R6016\r\n- not enough space for thread data" ], [ 109307, "u8", "- not enough space for thread data" ], [ 109344, "u8", "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 109346, "u8", "This application has requested the Runtime to terminate it in an unusual way." ], [ 109496, "u8", "R6009\r\n- not enough space for environment" ], [ 109503, "u8", "- not enough space for environment" ], [ 109540, "u8", "R6008\r\n- not enough space for arguments" ], [ 109547, "u8", "- not enough space for arguments" ], [ 109584, "u8", "R6002\r\n- floating point not loaded" ], [ 109591, "u8", "- floating point not loaded" ], [ 109624, "u8", "Microsoft Visual C++ Runtime Library" ], [ 109668, "u8", "Runtime Error!\n\nProgram:" ], [ 109700, "u8", "\u003cprogram name unknown\u003e" ], [ 110594, "wide", "h(((( H" ], [ 111152, "u8", "dddd, MMMM dd, yyyy" ], [ 111172, "u8", "MM/dd/yy" ], [ 111192, "u8", "December" ], [ 111204, "u8", "November" ], [ 111216, "u8", "October" ], [ 111224, "u8", "September" ], [ 111236, "u8", "August" ], [ 111244, "u8", "July" ], [ 111252, "u8", "June" ], [ 111260, "u8", "April" ], [ 111268, "u8", "March" ], [ 111276, "u8", "February" ], [ 111288, "u8", "January" ], [ 111344, "u8", "Saturday" ], [ 111356, "u8", "Friday" ], [ 111364, "u8", "Thursday" ], [ 111376, "u8", "Wednesday" ], [ 111388, "u8", "Tuesday" ], [ 111396, "u8", "Monday" ], [ 111404, "u8", "Sunday" ], [ 111476, "u8", "040a" ], [ 111508, "u8", "1252" ], [ 111520, "u8", "040b" ], [ 111564, "u8", "040c" ], [ 111608, "u8", "040f" ], [ 111652, "u8", "041d" ], [ 111696, "u8", "042d" ], [ 111740, "u8", "080a" ], [ 111784, "u8", "080c" ], [ 112004, "u8", "100a" ], [ 112048, "u8", "100c" ], [ 112092, "u8", "140a" ], [ 112136, "u8", "140c" ], [ 112180, "u8", "180a" ], [ 112312, "u8", "200a" ], [ 112356, "u8", "240a" ], [ 112400, "u8", "280a" ], [ 112444, "u8", "2c0a" ], [ 112488, "u8", "300a" ], [ 112532, "u8", "340a" ], [ 112576, "u8", "380a" ], [ 112620, "u8", "3c0a" ], [ 112660, "u8", "Paraguay" ], [ 112672, "u8", "Uruguay" ], [ 112680, "u8", "Chile" ], [ 112688, "u8", "Ecuador" ], [ 112696, "u8", "Argentina" ], [ 112708, "u8", "Peru" ], [ 112716, "u8", "Colombia" ], [ 112728, "u8", "Venezuela" ], [ 112740, "u8", "Dominican Republic" ], [ 112760, "u8", "South Africa" ], [ 112776, "u8", "Panama" ], [ 112784, "u8", "Luxembourg" ], [ 112796, "u8", "Costa Rica" ], [ 112808, "u8", "Switzerland" ], [ 112820, "u8", "Guatemala" ], [ 112832, "u8", "Canada" ], [ 112840, "u8", "Spanish - Modern Sort" ], [ 112864, "u8", "Australia" ], [ 112876, "u8", "English" ], [ 112884, "u8", "Austria" ], [ 112892, "u8", "German" ], [ 112900, "u8", "Belgium" ], [ 112908, "u8", "Mexico" ], [ 112916, "u8", "Spanish" ], [ 112924, "u8", "Basque" ], [ 112932, "u8", "Sweden" ], [ 112940, "u8", "Swedish" ], [ 112948, "u8", "Iceland" ], [ 112956, "u8", "Icelandic" ], [ 112968, "u8", "France" ], [ 112976, "u8", "French" ], [ 112984, "u8", "Finland" ], [ 112992, "u8", "Finnish" ], [ 113000, "u8", "Spain" ], [ 113008, "u8", "Spanish - Traditional Sort" ], [ 113240, "u8", "united-states" ], [ 113256, "u8", "united-kingdom" ], [ 113272, "u8", "trinidad \u0026 tobago" ], [ 113292, "u8", "south-korea" ], [ 113304, "u8", "south-africa" ], [ 113320, "u8", "south korea" ], [ 113332, "u8", "south africa" ], [ 113348, "u8", "slovak" ], [ 113356, "u8", "puerto-rico" ], [ 113368, "u8", "pr-china" ], [ 113380, "u8", "pr china" ], [ 113396, "u8", "new-zealand" ], [ 113408, "u8", "hong-kong" ], [ 113420, "u8", "holland" ], [ 113428, "u8", "great britain" ], [ 113444, "u8", "england" ], [ 113460, "u8", "china" ], [ 113468, "u8", "britain" ], [ 113476, "u8", "america" ], [ 114028, "u8", "swedish-finland" ], [ 114044, "u8", "spanish-venezuela" ], [ 114064, "u8", "spanish-uruguay" ], [ 114080, "u8", "spanish-puerto rico" ], [ 114100, "u8", "spanish-peru" ], [ 114116, "u8", "spanish-paraguay" ], [ 114136, "u8", "spanish-panama" ], [ 114152, "u8", "spanish-nicaragua" ], [ 114172, "u8", "spanish-modern" ], [ 114188, "u8", "spanish-mexican" ], [ 114204, "u8", "spanish-honduras" ], [ 114224, "u8", "spanish-guatemala" ], [ 114244, "u8", "spanish-el salvador" ], [ 114264, "u8", "spanish-ecuador" ], [ 114280, "u8", "spanish-dominican republic" ], [ 114308, "u8", "spanish-costa rica" ], [ 114328, "u8", "spanish-colombia" ], [ 114348, "u8", "spanish-chile" ], [ 114364, "u8", "spanish-bolivia" ], [ 114380, "u8", "spanish-argentina" ], [ 114400, "u8", "portuguese-brazilian" ], [ 114424, "u8", "norwegian-nynorsk" ], [ 114444, "u8", "norwegian-bokmal" ], [ 114464, "u8", "norwegian" ], [ 114476, "u8", "italian-swiss" ], [ 114492, "u8", "irish-english" ], [ 114508, "u8", "german-swiss" ], [ 114524, "u8", "german-luxembourg" ], [ 114544, "u8", "german-lichtenstein" ], [ 114564, "u8", "german-austrian" ], [ 114580, "u8", "french-swiss" ], [ 114596, "u8", "french-luxembourg" ], [ 114616, "u8", "french-canadian" ] ], "v": { "file.stem": "e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e", "pe.imphash": "8bce0ceba18a83e0ea1937abe2fbe328", "pe.machine": "i386", "pe.rich.key": 3151041949, "pe.rich.hash": "2f11aa7e1e06770753faba417472bb40", "pe.subsystem": "windows_gui", "pe.timestamp": 1598023720, "file.basename": "e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e.exe", "pe.image_base": 4194304, "pe.image_size": 278528, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "windows_nt_windows32", "build.username": "Mr.Anderson", "pe.entry_point": 17557, "pe.headers_size": 4096, "pe.version.type": "app", "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.debug.pdb.guid": "f6ab2923-39f3-4373-8aea-2a32198358ef", "pe.debug.pdb.path": "c:\\Users\\Mr.Anderson\\Desktop\\2003\\Emot\\Compressor_demo\\Compressor\\Release\\Compressor.pdb", "pe.debug.pdb.stem": "Compressor", "pe.file_alignment": 4096, "pe.image_hash.sha1": "c2e33e678df8bf9d26286c5097370e654612ce07", "pe.version.company": "Waikato University", "build.username_from": "pdb_path", "pe.load_config.size": 72, "pe.version.comments": "Modified by Cyril COMTE", "pe.image_hash.sha256": "65ac748fa874caa115bcfd2bc661c8cc7ca0e082c18963c8c177098e56d6e714", "pe.image_hash.sha384": "a6092512ab0828ccd70554d858585e5717b5cd3412d7be9ea2bfb6af28bfc3bdea79a4ae3edb700eb7f200006954676e", "pe.image_hash.sha512": "f15430fb1d82c634d2bb485289327f47f12686287d2c0074977ee7951c0674fcec9ac528dc514cbfae0f2237c8551fa74224dadc55bfe988fd75300ad6d7447a", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_RCDATA", "pe.resource_types[3]": "RT_GROUP_ICON", "pe.resource_types[4]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 2006", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.debug.pdb.basename": "Compressor.pdb", "pe.characteristics_raw": 271, "pe.debug.pdb.timestamp": 1598023720, "pe.version.description": "oscilloscope-compressor", "pe.linker_major_version": 7, "pe.linker_minor_version": 10, "pe.version.file_version": "2, 0, 0, 0", "pe.version.product_name": "Waikato University oscilloscope-compressor", "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "codeview", "pe.version.internal_name": "oscilloscope", "pe.data_directories[0].rva": 139264, "pe.data_directories[1].rva": 147456, "pe.data_directories[2].rva": 106496, "pe.data_directories[3].rva": 116256, "pe.data_directories[4].rva": 140152, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "2, 0, 0, 0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 127964, "pe.data_directories[2].name": "debug", "pe.data_directories[2].size": 28, "pe.data_directories[3].name": "load_config", "pe.data_directories[3].size": 72, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 768, "pe.debug.entries[0].type_id": 2, "pe.rich.entries[0].build_id": 105, "pe.rich.entries[1].build_id": 15, "pe.rich.entries[2].build_id": 95, "pe.rich.entries[3].build_id": 93, "pe.rich.entries[4].build_id": 25, "pe.rich.entries[5].build_id": 93, "pe.rich.entries[6].build_id": 1, "pe.rich.entries[7].build_id": 96, "pe.rich.entries[8].build_id": 94, "pe.rich.entries[9].build_id": 90, "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 23, "pe.rich.entries[2].use_count": 107, "pe.rich.entries[3].use_count": 2, "pe.rich.entries[4].use_count": 2, "pe.rich.entries[5].use_count": 7, "pe.rich.entries[6].use_count": 115, "pe.rich.entries[7].use_count": 15, "pe.rich.entries[8].use_count": 1, "pe.rich.entries[9].use_count": 1, "pe.version.original_filename": "oscilloscope.exe-\u003ecompressor", "pe.coff.dos_header_pe_pointer": 248, "pe.rich.entries[0].product_id": 2067, "pe.rich.entries[1].product_id": 3077, "pe.rich.entries[2].product_id": 3077, "pe.rich.entries[3].product_id": 2067, "pe.rich.entries[4].product_id": 9210, "pe.rich.entries[5].product_id": 2179, "pe.rich.entries[7].product_id": 3077, "pe.rich.entries[8].product_id": 3052, "pe.rich.entries[9].product_id": 3077, "pe.debug.entries[0].size_bytes": 113, "pe.load_config.security_cookie": 4321656, "pe.load_config.se_handler_count": 5, "pe.load_config.se_handler_table": 4313888, "pe.debug.entries[0].timestamp_unix": 1598023720 }, "id": "pe", "sc": [ [ ".text", 4096, 102400, 5.44, "r-x" ], [ ".rdata", 106496, 16384, 3.66, "r--" ], [ ".data", 122880, 12288, 1.44, "rw-" ], [ ".idata", 135168, 8192, 2.76, "rw-" ], [ ".rsrc", 143360, 131072, 4.43, "r--" ] ] }, "id": 0, "sz": 274432, "ts": [ { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "3cd16" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1436.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.44999998807907104, "d": "PDB in numbered directory (build artifacts)", "e": [ "c:\\Users\\Mr.Anderson\\Desktop\\2003\\Emot\\Compressor_demo\\Compressor\\Release\\Compressor.pdb" ], "i": "metadata/binary/debug::pdb-numbered-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "22400" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PDB path on Desktop", "e": [ "c:\\Users\\Mr.Anderson\\Desktop\\2003\\Emot\\Compressor_demo\\Compressor\\Release\\Compressor.pdb" ], "i": "metadata/binary/debug::pdb-desktop-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "22490" ] }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.99" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2, "el": [ "224c4" ] }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2, "el": [ "225b0" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2, "el": [ "2241c" ] }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014", "el": [ "223b0" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "1a7bc" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 12288)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Waikato University oscilloscope-compressor" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2, "el": [ "225b8" ] }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringA" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001", "el": [ "217c2" ] }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2, "el": [ "2252c" ] }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1, "el": [ "1c214" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "21e72" ] }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2, "el": [ "22420" ] }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "224f8" ] }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "224bc" ] }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "22508" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c0", "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "1b40", "1c71" ] }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2, "el": [ "1c1fc" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "224d0" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "22428" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2, "el": [ "2249c" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "Compressor.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "1ceac" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "224d4" ] }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2, "el": [ "21938" ] }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "223f0" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "22478" ] }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2, "el": [ "3cf96" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Explicit Desktop path token in content", "e": [ "Users\\Mr.Anderson\\Desktop\\" ], "i": "objectives/collection/stealer/wallet::desktop-path-token", "l": 1, "el": [ "1ceac" ] }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2, "el": [ "22520" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "224d8" ] }, { "c": 0.699999988079071, "d": "PDB path with user profile", "e": [ "c:\\Users\\Mr.Anderson\\Desktop\\2003\\Emot\\Compressor_demo\\Compressor\\Release\\Compressor.pdb" ], "i": "metadata/binary/debug::pdb-users-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2, "el": [ "223b8" ] }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadWritePtr anti-debug style probe", "e": [ "IsBadWritePtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-write-ptr", "l": 1, "m": "B0001", "el": [ "224f0" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "224cc" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "FlsSetValue", "TlsGetValue", "TlsSetValue", "FlsGetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "1a798", "21aac", "21a9e", "1a7a4" ] }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "22528" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "22410" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2006" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014", "el": [ "e675" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "3cebc" ] }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2, "el": [ "225ac" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "3cf1e" ] }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2, "el": [ "2247c" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "OutputDebugStringA", "GetEnvironmentStringsW", "CompareStringW", "GetStringTypeA", "GetEnvironmentStrings", "LCMapStringW", "GetStringTypeW", "CompareStringA", "StringFileInfo", "FreeEnvironmentStringsW", "LCMapStringA", "FreeEnvironmentStringsA", "mciGetErrorStringA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "217c2", "21c0e", "21e92", "21d14", "21bdc", "21a3e", "21d26", "21e80", "3cc92", "21bf4", "21a08", "21bc2", "2167a" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "1a87c" ] }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage/control::send-message-a", "l": 2, "el": [ "225a8" ] }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "22500" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "48", "41" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "5d00", "444e", "e744" ] }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "22498" ] }, { "c": 0.8500000238418579, "d": "COM Both threading model", "e": [ "Both" ], "i": "objectives/persistence/system/registry/com::threadingmodel-both-word", "l": 1, "el": [ "3c94e" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "224ec" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "3cc36" ] }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "sections.count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "224c0" ] }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "21e60", "21c84" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2, "el": [ "22474" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "oscilloscope-compressor" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "224fc" ] }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2, "el": [ "223fc" ] }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021", "el": [ "22498" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "3ce9a" ] }, { "c": 0.7599999904632568, "d": "Mixer line controls import", "e": [ "mixerGetLineControlsA" ], "i": "objectives/evasion/anti-av/import-pollution::mixer-line-controls", "l": 1, "el": [ "216c4" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "224c8" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Dense INT3 breakpoint instructions", "e": [ "CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC" ], "i": "objectives/anti-static/obfuscation/binary-structure::int3-padding-text", "l": 1, "el": [ "1096" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2, "el": [ "21980" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "224b0" ] }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload/compression::gzip-magic", "l": 2, "el": [ "b0e0" ] }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014", "el": [ "223ac" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "22514" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "7a3a" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2, "el": [ "225c8" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "2, 0, 0, 0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "3cd5e" ] }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2, "el": [ "21b90" ] }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "c:\\Users\\Mr.Anderson\\Desktop\\2003\\Emot\\Compressor_demo\\Compressor\\Release\\Compressor.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "2240c" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "218bc" ] }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadReadPtr anti-debug style probe", "e": [ "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "l": 1, "m": "B0001", "el": [ "22408" ] }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2, "el": [ "225a4" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 115.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "22514", "22518", "22510" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2, "el": [ "224a0" ] }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "224e0" ] }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2, "el": [ "3cdb6" ] }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2, "el": [ "2245c" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "3cdee" ] }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage/control::release-dc", "l": 2, "el": [ "225bc" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "22424" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2, "el": [ "22460" ] }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2, "el": [ "22438" ] }, { "c": 0.7799999713897705, "d": "Wave input reset import", "e": [ "waveInReset" ], "i": "objectives/evasion/anti-av/import-pollution::wave-in-reset", "l": 1, "el": [ "21788" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.99" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "22504" ] }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2, "el": [ "225c4" ] }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2, "el": [ "22480" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "41", "48", "46" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "e744", "444e", "5d00" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "22484" ] }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.66)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2, "el": [ "1a87c" ] }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "2248c" ] }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2, "el": [ "223bc" ] }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "22518" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "3ce48" ] }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2, "el": [ "223f4" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "219ae" ] }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2, "el": [ "1a86c" ] }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2, "el": [ "224b4" ] }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2, "el": [ "3cc36" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "22504" ] }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2, "el": [ "21cdc" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1436.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2, "el": [ "2244c" ] }, { "d": "Visual Studio build path", "e": [ "c:\\Users\\Mr.Anderson\\Desktop\\2003\\Emot\\Compressor_demo\\Compressor\\Release\\Compressor.pdb" ], "i": "metadata/binary/debug::pdb-visual-studio", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2, "el": [ "22470" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "1917b" ] }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1, "el": [ "3cc36" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "UnhandledExceptionFilter", "MultiByteToWideChar", "SunMonTueWedThuFriSat", "WideCharToMultiByte", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetSystemTimeAsFileTime", "GetCurrentProcessId", "SetConsoleCtrlHandler", "GetModuleFileNameA", "InitializeCriticalSection", "GetTimeZoneInformation", "SetEnvironmentVariableA", "InitializeCriticalSectionAndSpinCount", "GetUserObjectInformationA", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "1c1fc", "21ba6", "219f2", "1c514", "21a18", "1c52c", "21e00", "21dea", "21e1a", "21b90", "21d64", "21e32", "21ea4", "1c1c4", "1c214", "21c54" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales callback API", "e": [ "EnumSystemLocalesA" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 1, "m": "E1106", "el": [ "22448" ] }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e\" != \"compressor\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2, "el": [ "224e8" ] }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "224f4" ] }, { "c": 0.8799999952316284, "d": "Large low-entropy PE resources", "e": [ ".rsrc (size: 131072, entropy: 4.43)" ], "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc", "l": 2 }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1, "el": [ "1a87c" ] }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2, "el": [ "22414" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1436.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "217d8" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1, "el": [ "3cebc" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "1a7bc" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "148.64.27.116:29901" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1, "el": [ "35bb9" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "22494" ] }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "58 24 42 00", "20 24 42 00", "dc 02 42 00", "b0 24 42 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1, "el": [ "e175", "10949", "6ab5", "5acf" ] }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "224f4" ] }, { "c": 0.949999988079071, "d": "links winmm (waveOutGetVolume, waveInReset, waveInUnprepareHeader, waveInClose, waveInOpen, ... +11 more)", "e": [ "winmm" ], "i": "metadata/dylib::winmm", "l": 2, "el": [ "16 symbols" ] }, { "c": 0.949999988079071, "d": "links comctl32 (ORDINAL 17)", "e": [ "comctl32" ], "i": "metadata/dylib::comctl32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, SetStdHandle, LoadLibraryA, ... +76 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "81 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (LoadIconA, DialogBoxParamA, SendMessageA, EndDialog, GetDlgItem, ... +6 more)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "11 symbols" ] }, { "c": 0.949999988079071, "d": "links gdi32 (DeleteDC, CreateCompatibleDC, CreateCompatibleBitmap, CreateSolidBrush, DeleteObject, ... +1 more)", "e": [ "gdi32" ], "i": "metadata/dylib::gdi32", "l": 2, "el": [ "6 symbols" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "22424", "22494" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2, "el": [ "22518", "22514" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesA", "GetLocaleInfoA", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2, "el": [ "2244c", "21cdc", "21c84", "21e60" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "oscilloscope-compressor", "Waikato University oscilloscope-compressor", "imports.count = 115.00", "Copyright © 2006" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "value:pe.version.description", "value:pe.version.product_name", "", "value:pe.version.copyright" ] }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2, "el": [ "3cf96", "3cc36", "3cdb6" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2, "el": [ "22528", "22508" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "SEH with bad pointer debug probes", "e": [ "IsBadReadPtr", "SetUnhandledExceptionFilter", "IsBadWritePtr", "OutputDebugStringA" ], "i": "objectives/anti-analysis/debugger-detect/check::seh-pointer-probe-anti-debug", "l": 2, "m": "B0001", "el": [ "22408", "22528", "224f0", "217c2" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetEnvironmentStringsW", "GetUserDefaultLCID", "GetLocaleInfoA", "EnumSystemLocalesA" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082", "el": [ "22514", "21e60", "22518", "2244c", "21c84", "21cdc" ] }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "IsBadWritePtr", "SetUnhandledExceptionFilter", "imports.count = 115.00", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "VS_VERSION_INFO", "c:\\Users\\Mr.Anderson\\Desktop\\2003\\Emot\\Compressor_demo\\Compressor\\Release\\Compressor.pdb", "OutputDebugStringA", "GetEnvironmentStrings", "IsBadReadPtr" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001", "el": [ "224f0", "22528", "", "22514", "22518", "3cc36", "value:pe.debug.pdb.path", "217c2", "22510", "22408" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetSystemTimeAsFileTime", "GetLocaleInfoA", "EnumSystemLocalesA", "GetEnvironmentStringsW", "GetCommandLineA", "GetLocaleInfoW", "GetUserDefaultLCID", "FreeEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082", "el": [ "22410", "21c84", "21cdc", "22518", "22484", "21e60", "2244c", "22514" ] } ], "sha": "e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-08/e845f1a02349f51c4cfc33e395c35a886c40879c46c604681693bbbe56c4872e.exe", "type": "pe" } ], "tv": "84adb" } }