{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T05:37:47Z" }, "path": "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 4, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 5640712.0, "entropy": 7.99, "size_bytes": 5640712.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 1.0 } }, "s": [ [ 664, "u8", ".rsrc" ], [ 3208, "u8", "kernel32.dll" ], [ 3224, "u8", "GetLogicalProcessorInformation" ], [ 3256, "u8", "user32.dll" ], [ 3270, "u8", "MessageBoxA" ], [ 3296, "u8", "SetGestureConfig" ], [ 3316, "u8", "CloseGestureInfoHandle" ], [ 3342, "u8", "GetGestureInfo" ], [ 3360, "u8", "SystemParametersInfoForDpi" ], [ 3390, "u8", "PhysicalToLogicalPoint" ], [ 3416, "u8", "GetWindowDisplayAffinity" ], [ 3444, "u8", "GetSystemMetricsForDpi" ], [ 3470, "u8", "GetDpiForWindow" ], [ 3488, "u8", "AreDpiAwarenessContextsEqual" ], [ 3520, "u8", "GetAwarenessFromDpiAwarenessContext" ], [ 3558, "u8", "GetWindowDpiAwarenessContext" ], [ 3590, "u8", "GetThreadDpiAwarenessContext" ], [ 3622, "u8", "SetThreadDpiAwarenessContext" ], [ 3654, "u8", "AdjustWindowRectExForDpi" ], [ 3680, "u8", "msimg32.dll" ], [ 3694, "u8", "TransparentBlt" ], [ 3712, "u8", "GradientFill" ], [ 3728, "u8", "AlphaBlend" ], [ 3756, "u8", "IsWow64Process" ], [ 3774, "u8", "ProcessIdToSessionId" ], [ 3798, "u8", "LocaleNameToLCID" ], [ 3818, "u8", "GetTimeZoneInformationForYear" ], [ 3850, "u8", "GetTickCount64" ], [ 3868, "u8", "GetNativeSystemInfo" ], [ 3890, "u8", "GetSystemTimes" ], [ 3908, "u8", "GetProcessMitigationPolicy" ], [ 3936, "u8", "advapi32.dll" ], [ 3952, "u8", "RegDeleteKeyExW" ], [ 3982, "u8", "UuidCreate" ], [ 3994, "u8", "windowscodecs.dll" ], [ 4014, "u8", "WICConvertBitmapSource" ], [ 4038, "u8", "shell32.dll" ], [ 4052, "u8", "SHDoDragDrop" ], [ 4068, "u8", "SHCreateItemFromParsingName" ], [ 4096, "u8", "uxtheme.dll" ], [ 4110, "u8", "BufferedPaintRenderAnimation" ], [ 4142, "u8", "EndBufferedAnimation" ], [ 4166, "u8", "BeginBufferedAnimation" ], [ 4192, "u8", "BufferedPaintStopAllAnimations" ], [ 4226, "u8", "BufferedPaintSetAlpha" ], [ 4250, "u8", "EndBufferedPaint" ], [ 4270, "u8", "BeginBufferedPaint" ], [ 4292, "u8", "BufferedPaintUnInit" ], [ 4314, "u8", "BufferedPaintInit" ], [ 4334, "u8", "DrawThemeTextEx" ], [ 4352, "u8", "OpenThemeDataForDpi" ], [ 4372, "u8", "imm32.dll" ], [ 4384, "u8", "ImmSetCompositionWindow" ], [ 4410, "u8", "ImmSetCompositionFontW" ], [ 4436, "u8", "ImmSetOpenStatus" ], [ 4456, "u8", "ImmSetConversionStatus" ], [ 4482, "u8", "ImmGetConversionStatus" ], [ 4508, "u8", "ImmGetCompositionStringW" ], [ 4536, "u8", "ImmAssociateContextEx" ], [ 4560, "u8", "ImmReleaseContext" ], [ 4580, "u8", "ImmGetContext" ], [ 4596, "u8", "ImmIsIME" ], [ 4606, "u8", "DWMAPI.DLL" ], [ 4620, "u8", "DwmInvalidateIconicBitmaps" ], [ 4650, "u8", "DwmSetIconicLivePreviewBitmap" ], [ 4682, "u8", "DwmSetIconicThumbnail" ], [ 4706, "u8", "DwmSetWindowAttribute" ], [ 4730, "u8", "DwmIsCompositionEnabled" ], [ 4756, "u8", "DwmGetWindowAttribute" ], [ 4780, "u8", "DwmGetColorizationColor" ], [ 4806, "u8", "DwmExtendFrameIntoClientArea" ], [ 4838, "u8", "DwmDefWindowProc" ], [ 4856, "u8", "Shcore.dll" ], [ 4870, "u8", "GetDpiForMonitor" ], [ 4890, "u8", "GetProcessDpiAwareness" ], [ 4916, "u8", "GetScaleFactorForMonitor" ], [ 4942, "u8", "Crypt32.dll" ], [ 4956, "u8", "CryptDecodeObject" ], [ 4976, "u8", "PFXImportCertStore" ], [ 4998, "u8", "CertGetNameStringW" ], [ 5020, "u8", "CertNameToStrW" ], [ 5038, "u8", "CertFreeCertificateContext" ], [ 5068, "u8", "CertDuplicateCertificateContext" ], [ 5102, "u8", "CertCloseStore" ], [ 5120, "u8", "CertOpenSystemStoreW" ], [ 5144, "u8", "CertOpenStore" ], [ 5160, "u8", "CertFindChainInStore" ], [ 5184, "u8", "CertFindCertificateInStore" ], [ 5212, "u8", "gdiplus.dll" ], [ 5226, "u8", "GdiplusShutdown" ], [ 5244, "u8", "GdiplusStartup" ], [ 5816, "u8", "GetModuleHandleW" ], [ 5853, "u8", "MsgWaitForMultipleObjectsEx" ], [ 5902, "u8", "RegSetValueExW" ], [ 5919, "u8", "comctl32.dll" ], [ 5939, "u8", "ImageList_SetImageCount" ], [ 6232, "wide", "BOOKMARKICONS" ], [ 6262, "wide", "CDROM" ], [ 6274, "wide", "CLOSEDFOLDER\rCURRENTFOLDER\nEXECUTABLE" ], [ 6350, "wide", "FLOPPY" ], [ 6364, "wide", "HARD\tKNOWNFILE" ], [ 6394, "wide", "NETWORK\nOPENFOLDER" ], [ 6440, "wide", "SBDOWN\tSBDOWNDIS" ], [ 6474, "wide", "SBDOWNDN" ], [ 6492, "wide", "SBLEFT\tSBLEFTDIS" ], [ 6526, "wide", "SBLEFTDN" ], [ 6544, "wide", "SBRIGHT\nSBRIGHTDIS\tSBRIGHTDN" ], [ 6602, "wide", "SBUP" ], [ 6612, "wide", "SBUPDIS" ], [ 6628, "wide", "SBUPDN" ], [ 6642, "wide", "SPINDOWN" ], [ 6660, "wide", "SPINUP" ], [ 6674, "wide", "TEXTEDITORACTIVELINE" ], [ 6716, "wide", "TEXTEDITORBOOKMARKIMAGES" ], [ 6766, "wide", "TEXTEDITORMOUSEMOVESCROLL" ], [ 6818, "wide", "TEXTEDITORSYNCEDIT" ], [ 6856, "wide", "UNKNOWNFILE\nVT_MOVEALL\tVT_MOVEEW\tVT_MOVENS" ], [ 6942, "wide", "VT_XPBUTTONMINUS" ], [ 6976, "wide", "VT_XPBUTTONPLUS" ], [ 7008, "wide", "BBABORT" ], [ 7024, "wide", "BBABORT_DISABLED" ], [ 7058, "wide", "BBALL" ], [ 7070, "wide", "BBALL_DISABLED" ], [ 7100, "wide", "BBCANCEL" ], [ 7118, "wide", "BBCANCEL_DISABLED" ], [ 7154, "wide", "BBCLOSE" ], [ 7170, "wide", "BBCLOSE_DISABLED" ], [ 7204, "wide", "BBHELP" ], [ 7218, "wide", "BBHELP_DISABLED" ], [ 7250, "wide", "BBIGNORE" ], [ 7268, "wide", "BBIGNORE_DISABLED" ], [ 7304, "wide", "BBNO\rBBNO_DISABLED" ], [ 7342, "wide", "BBOK\rBBOK_DISABLED" ], [ 7380, "wide", "BBRETRY" ], [ 7396, "wide", "BBRETRY_DISABLED" ], [ 7430, "wide", "BBYES" ], [ 7442, "wide", "BBYES_DISABLED" ], [ 7472, "wide", "DBN_APPLYUPDATES" ], [ 7506, "wide", "DBN_APPLYUPDATES_20X\nDBN_CANCEL" ], [ 7570, "wide", "DBN_CANCELUPDATES" ], [ 7606, "wide", "DBN_CANCELUPDATES_20X" ], [ 7650, "wide", "DBN_CANCEL_20X\nDBN_DELETE" ], [ 7702, "wide", "DBN_DELETE_20X" ], [ 7732, "wide", "DBN_EDIT" ], [ 7750, "wide", "DBN_EDIT_20X\tDBN_FIRST\rDBN_FIRST_20X\nDBN_INSERT" ], [ 7846, "wide", "DBN_INSERT_20X" ], [ 7876, "wide", "DBN_LAST" ], [ 7894, "wide", "DBN_LAST_20X" ], [ 7920, "wide", "DBN_NEXT" ], [ 7938, "wide", "DBN_NEXT_20X" ], [ 7964, "wide", "DBN_POST" ], [ 7982, "wide", "DBN_POST_20X\tDBN_PRIOR\rDBN_PRIOR_20X" ], [ 8056, "wide", "DBN_REFRESH" ], [ 8080, "wide", "DBN_REFRESH_20X" ], [ 8120, "wide", "DVCLAL" ], [ 8134, "wide", "EULA" ], [ 8144, "wide", "EXECL" ], [ 8156, "wide", "EXECL64" ], [ 8172, "wide", "LIGHT\tMSG_ERROR" ], [ 8204, "wide", "MSG_INFO" ], [ 8222, "wide", "MSG_WARNING" ], [ 8254, "wide", "PLATFORMTARGETS\tTDLGABOUT" ], [ 8306, "wide", "TDLGMRUMGMT\nTDLGREGWIZ\rTDLG_EE_PREFS" ], [ 8380, "wide", "TLOGINDIALOG" ], [ 8406, "wide", "TPASSWORDDIALOG" ], [ 8438, "wide", "TWND_EE_DETECTSCAN" ], [ 8476, "wide", "TWND_EE_MAIN\nTWND_EE_PB" ], [ 8524, "wide", "TWND_EE_TLBVIEW\nTWND_EE_VT" ], [ 8586, "wide", "XML\rCAT_DRAG_COPY" ], [ 8622, "wide", "TEXTEDITORMOUSEMOVESCROLL0" ], [ 8676, "wide", "TEXTEDITORMOUSEMOVESCROLL1" ], [ 8730, "wide", "TEXTEDITORMOUSEMOVESCROLL2" ], [ 8784, "wide", "TEXTEDITORMOUSEMOVESCROLL3" ], [ 8838, "wide", "TEXTEDITORMOUSEMOVESCROLL4" ], [ 8892, "wide", "TEXTEDITORMOUSEMOVESCROLL5" ], [ 8946, "wide", "TEXTEDITORMOUSEMOVESCROLL6" ], [ 9000, "wide", "TEXTEDITORMOUSEMOVESCROLL7\nVT_MOVEALL" ], [ 9076, "wide", "VT_MOVEE\tVT_MOVEEW" ], [ 9114, "wide", "VT_MOVEN\tVT_MOVENE\tVT_MOVENS\tVT_MOVENW" ], [ 9192, "wide", "VT_MOVES\tVT_MOVESE\tVT_MOVESW" ], [ 9250, "wide", "VT_MOVEW" ], [ 9268, "wide", "MAINICON" ], [ 52570, "u8", "VqgmkX" ], [ 52888, "u8", "/UGu" ], [ 53180, "u8", "bUyx" ], [ 53564, "u8", "PbMqu" ], [ 53885, "u8", "cRjl" ], [ 54113, "u8", "IEND" ], [ 57389, "u8", "tcYv" ], [ 63888, "u8", "nx){" ], [ 64127, "u8", "g(r]" ], [ 77355, "u8", "3Guv8" ], [ 90769, "u8", "H6 D" ], [ 101038, "u8", "Yesn" ], [ 101256, "u8", "hLmv" ], [ 111233, "u8", "798h" ], [ 134437, "u8", "WLGH" ], [ 138165, "u8", "wy9PA" ], [ 180432, "u8", "s BnD" ], [ 189539, "u8", "qhvFQe" ], [ 192673, "u8", "Lgcy" ], [ 192750, "u8", "`xo`" ], [ 196369, "u8", "eHU72" ], [ 197503, "u8", "yPP8I" ], [ 197939, "u8", "kcQWW" ], [ 202978, "u8", "epQm" ], [ 207474, "u8", "KaYnk" ], [ 209178, "wide", "VS_VERSION_INFO" ], [ 209270, "wide", "StringFileInfo" ], [ 209306, "wide", "040904E4" ], [ 209330, "wide", "CompanyName" ], [ 209374, "wide", "FileDescription" ], [ 209408, "wide", "Executable File Explorer for OS/2, NE, PE32, PE32+ and VxD file types" ], [ 209554, "wide", "FileVersion" ], [ 209602, "wide", "LegalCopyright" ], [ 209632, "wide", "Copyright (c) 2006-2024, Michal Mutl" ], [ 209714, "wide", "LegalTrademarks" ], [ 209748, "wide", "All rights reserved" ], [ 209794, "wide", "ProductName" ], [ 209820, "wide", "EXE Explorer" ], [ 209854, "wide", "ProductVersion" ], [ 209906, "wide", "OriginalFilename" ], [ 209940, "wide", "EXE.exe" ], [ 209962, "wide", "BuildTimestamp" ], [ 209992, "wide", "2024-02-12 09:19:17" ], [ 210038, "wide", "VarFileInfo" ], [ 210070, "wide", "Translation" ], [ 210168, "u8", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 210225, "u8", "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\" xmlns:asmv3=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 210347, "u8", "\u003casmv3:application\u003e" ], [ 210369, "u8", "\u003casmv3:windowsSettings\u003e" ], [ 210397, "u8", "\u003cdpiAware xmlns=\"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\u003etrue/pm\u003c/dpiAware\u003e" ], [ 210494, "u8", "\u003cdpiAwareness xmlns=\"http://schemas.microsoft.com/SMI/2016/WindowsSettings\"\u003ePerMonitorV2\u003c/dpiAwareness\u003e" ], [ 210604, "u8", "\u003c/asmv3:windowsSettings\u003e" ], [ 210633, "u8", "\u003c/asmv3:application\u003e" ], [ 210657, "u8", "\u003cdependency\u003e" ], [ 210672, "u8", "\u003cdependentAssembly\u003e" ], [ 210696, "u8", "\u003cassemblyIdentity" ], [ 210720, "u8", "type=\"win32\"" ], [ 210741, "u8", "name=\"Microsoft.Windows.Common-Controls\"" ], [ 210790, "u8", "version=\"6.0.0.0\"" ], [ 210816, "u8", "publicKeyToken=\"6595b64144ccf1df\"" ], [ 210858, "u8", "language=\"*\"" ], [ 210879, "u8", "processorArchitecture=\"*\"/\u003e" ], [ 210915, "u8", "\u003c/dependentAssembly\u003e" ], [ 210940, "u8", "\u003c/dependency\u003e" ], [ 210957, "u8", "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 211012, "u8", "\u003csecurity\u003e" ], [ 211027, "u8", "\u003crequestedPrivileges\u003e" ], [ 211055, "u8", "\u003crequestedExecutionLevel" ], [ 211088, "u8", "level=\"asInvoker\"" ], [ 211116, "u8", "uiAccess=\"false\"" ], [ 211154, "u8", "\u003c/requestedPrivileges\u003e" ], [ 211183, "u8", "\u003c/security\u003e" ], [ 211199, "u8", "\u003c/trustInfo\u003e" ], [ 211215, "u8", "\u003ccompatibility xmlns=\"urn:schemas-microsoft-com:compatibility.v1\"\u003e" ] ], "v": { "file.stem": "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1707725957, "file.basename": "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe", "pe.image_base": 4194304, "pe.image_size": 14315520, "pe.machine_id": 332, "pe.os_version": "5.1", "pe.entry_point": 14213120, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 11576, "pe.section_alignment": 4096, "pe.subsystem_version": "5.1", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 290, "pe.linker_major_version": 2, "pe.linker_minor_version": 25, "pe.signatures[0].issuer": "CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB", "pe.signatures[0].serial": "7fb2dc3c0f1d43e1d1fe625e055c1480", "pe.signatures[0].subject": "CN=ing. Michal Mutl,O=ing. Michal Mutl,ST=Praha\\, Hlavní město,C=CZ", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2025-02-20T23:59:59Z", "pe.signatures[0].not_before": "2022-02-21T00:00:00Z", "pe.coff.dos_header_pe_pointer": 256, "pe.signatures[0].thumbprint_sha1": "aceebdadaf8e139c5b5b62a835440bed74747edf", "pe.signatures[0].cert_chain_depth": 3, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "619a9c529896765bde065e35bc531ef828a5e1b8c03d46dac5372f27666594a7", "pe.signatures[0].thumbprint_sha256": "f2443bf7493dfec3958c203997fffe350ca80a7bd52bc39da9beb941d5de3df5", "pe.signatures[0].signature_algorithm": "sha384WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 5640712, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: ing. Michal Mutl", "e": [ "ing. Michal Mutl" ], "i": "metadata/signed/unknown::ing.-michal-mutl", "l": 2 }, { "c": 1.0, "d": "Signed by ing. Michal Mutl", "e": [ "ing. Michal Mutl" ], "i": "metadata/signed/leaf::ing.-michal-mutl", "l": 3 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.7799999713897705, "d": "Short CamelCase Run value token", "e": [ "SlBOn" ], "i": "objectives/persistence/login/registry/autostart::short-camel-on-run-value-token", "l": 1, "el": [ "0x3f1f0d" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz" ], "i": "micro-behaviors/dylib/library/family::xz-ref", "l": 2, "el": [ "0x50ecf7" ] }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "0x1c459f" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x55e5f8" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2, "el": [ "0xeac" ] }, { "c": 0.8500000238418579, "d": "Filters backup-style .bak targets", "e": [ ".bak" ], "i": "objectives/impact/infect/binary/rewrite::bak-extension-filter", "l": 1, "el": [ "0x230cd9" ] }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "35138b9a-5d96-4fbd-8e2d-a2440225f93a", "e2011457-1546-43c5-a5fe-008deee3d3f0", "1f676c76-80e1-4239-95bb-83d0f6d0da78", "4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38", "8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030", "el": [ "0x33a20", "0x339a5", "0x33b16", "0x33a9a", "0x33b91" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".bak", ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x230cd9", "0x33414" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x3311a" ] }, { "c": 1.0, "d": "Issued by Sectigo Code Signing CA", "e": [ "CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB" ], "i": "metadata/signed/certificate::pe-cert-issuer-sectigo", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xc88" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "RegSetValueExW" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x170e" ] }, { "d": "password keyword", "e": [ "TPASSWORDDIALOG" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1, "el": [ "0x20d6" ] }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value API string", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w-text", "l": 2, "el": [ "0x170e" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x33965" ] }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "RegSetValueExW" ], "i": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-4", "l": 1, "el": [ "0x170e" ] }, { "a": "T1041", "c": 0.8600000143051147, "d": "Notification config wording", "e": [ "NOTIFY" ], "i": "objectives/exfiltration/messaging/webhook::notification-config-word", "l": 1, "m": "B0030", "el": [ "0x5b1b6" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.9200000166893005, "d": "UHARC linker major version", "e": [ "2" ], "i": "metadata/binary/framework::uharc-linker-major", "l": 2, "el": [ "value:pe.linker_major_version" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoForDpi" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1, "el": [ "0xd20" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "ImmGetCompositionStringW", "CertGetNameStringW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x33176", "0x119c", "0x1386" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x332e0" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0xc88" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x33414" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 5640712 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "CloseGestureInfoHandle", "GetProcessMitigationPolicy", "GetTimeZoneInformationForYear", "GetWindowDpiAwarenessContext", "PhysicalToLogicalPoint", "GetSystemMetricsForDpi", "SetThreadDpiAwarenessContext", "AdjustWindowRectExForDpi", "GetWindowDisplayAffinity", "AreDpiAwarenessContextsEqual", "GetThreadDpiAwarenessContext", "GetLogicalProcessorInformation", "ProcessIdToSessionId", "GetNativeSystemInfo", "SystemParametersInfoForDpi", "GetAwarenessFromDpiAwarenessContext" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xcf4", "0xf44", "0xeea", "0xde6", "0xd3e", "0xd74", "0xe26", "0xe46", "0xd58", "0xda0", "0xe06", "0xc98", "0xebe", "0xf1c", "0xd20", "0xdc0" ] } ], "sha": "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a", "path": "e93580fda01d2c73aa398f3cae5d1bbc05313cceb2f6d83dc24fd76bcbf72a8a.exe", "type": "pe" } ], "tv": "52045" } }