{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.2229924, "rte": "az", "prob": 0.2229924 }, { "cls": 0, "raw": 0.17744648, "rte": "az/native", "prob": 0.17744648 }, { "cls": 0, "raw": 0.11295918, "rte": "az/pe", "prob": 0.11295918 } ], "prob": 0.2229924, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.222992405295372 } ], "version": "v18.18", "analyzed_at": "2026-06-12T03:34:02Z" }, "path": "ebcdf0ea7146fac2e4d68409c125892102c8b65c97321d7a57e1386ce69d5e09.exe", "raw": { "v": "7", "tv": "e31a3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zo", "l": 0, "n": [ { "c": 3, "d": "PE binary has trailing overlay data", "i": "metadata/binary/layout::has-overlay", "o": 0, "z": 25 } ], "x": true }, { "b": "t2UF4=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lga\u003emkfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOI", "l": 29504, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 29520, "z": 128 } ], "x": true }, { "b": "rSAa107/QOm6n\u003c:F^RLUlq{Gy0rrc2000003\u0026*ncB$$W7", "l": 51088, "n": [ { "c": 2, "d": ".NET Assembly (mscoree.dll)", "i": "metadata/binary/framework::dotnet-assembly", "o": 51104, "z": 4 } ], "x": true }, { "b": "v]u(DwmY=Yp\u0026ZF!A:-!+q*ACawO\u003c53x(mE1Cxkxaz/PYo07H)Ez2!A]v@Dy7x\u003c}6vD2[7sz2^vvygQ)%08@", "l": 53374, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 53416, "z": 8 }, { "c": 2, "d": "Windows Forms UI framework", "i": "metadata/lang/compiler/managed::winforms-ui", "o": 53390, "z": 20 } ], "x": true }, { "b": "wPz\u003caz/d\u003c.BAh88B-.f{q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026wB.LwLBAzLqvS=^707c", "l": 55031, "n": [ { "c": 2, "d": "Runtime interop services", "i": "metadata/lang/compiler/managed::runtime-interop", "o": 55047, "z": 30 } ], "x": true }, { "b": "C#OH1y?k[OBAh88B-.f{q*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@q!oC", "l": 55308, "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 55324, "z": 15 } ], "x": true }, { "b": "x(v(*xMw3nA@*/.e=*GQq*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fRGq!oDYA+PSvp?sV:x(!ufz/d\u003c.BAh88B-.gCaz(gfz/PVdvK@T5wPz\u003caz/dY[e?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH}xDvMckOhdFH4f/.3DwIu876-?nn5l0vUA8{K\u003c", "l": 96093, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 96109, "z": 128 } ], "x": true }, { "b": "AZ+j:o\u003c}:N0bV^!z/PA2e[w^m000000rjtBav2]b00000", "l": 96325, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 96341, "z": 4 } ], "x": true }, { "b": "0000000000008u!gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv", "l": 96846, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 96862, "z": 15 } ], "x": true }, { "b": "fAr{fvGn7Z001?Q3ig8blJz38z2!IPve$fBC(QOtve$cAwDhYg003H", "l": 97066, "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 97082, "z": 11 } ], "x": true }, { "b": "Bo2.Hx-J2J002y!4GDIfmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6U", "l": 97118, "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 97134, "z": 15 } ], "x": true }, { "b": "Bo31PzVBUP001$U3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.", "l": 97186, "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 97202, "z": 11 } ], "x": true }, { "b": "e=W:eg5}pO001LI1][V7nDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE001.N", "l": 97242, "n": [ { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 97258, "z": 12 } ], "x": true }, { "b": "zVB[WA@Vgu001?Q1][V7pxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE", "l": 97370, "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 97386, "z": 16 } ], "x": true }, { "b": "e=YC.CMqpP001XM2lj=8pYLIozVBqFBPt[KBo25ove$cAwDhYg003Q", "l": 97422, "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 97438, "z": 11 } ], "x": true }, { "b": "Dh}HRzu6Up002aY3JHhcpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP000", "l": 97470, "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 97486, "z": 14 } ], "x": true }, { "b": "000000000000000000000fviY3\u0026*ncu]v#+0000000000000", "l": 97776, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 97792, "z": 6 } ], "x": true }, { "b": "vruj4zzrK[ci:ML1oPqVo\u003e!9Tz/Y\u0026eBrA}?wmV(Zx\u003eIr$zF77*lQq?IfFLpo9V2nvf!+Qwgbg:AgbR5", "l": 102295, "n": [ { "c": 2, "d": "Microsoft code-signing certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "o": 102311, "z": 31 } ], "x": true }, { "b": "dnsI^A=l2qw]]d[z/o.ulUgpWx\u003ez6?vru66l3mo.z/PMlC{1\u003c@f!\u003eu", "l": 103841, "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 103857, "z": 11 } ], "x": true }, { "b": "eI/ZFl[]#wbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)+.fOfJvfOfD5PAtk@", "l": 106622, "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 106638, "z": 28 } ], "x": true }, { "b": "vruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kGW)gCyNsi5JADhu", "l": 106800, "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 106816, "z": 29 } ], "x": true } ], "mol": "Md₂(BiSi)", "sha": "ebcdf0ea7146fac2e4d68409c125892102c8b65c97321d7a57e1386ce69d5e09", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 0.0, "has_overlay": 1.0, "overlay_end": 102016.0, "overlay_size": 3712.0, "checksum_valid": 0.0, "overlay_offset": 98304.0, "resource_count": 1.0, "cert_table_size": 10144.0, "overlay_padding": 10560.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 160903.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.66, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 21594.0, "version.identity_symbol_ratio": 0.0, "clr.managed_resource_max_entropy": 7.98 }, "file": { "size": 119008.0, "entropy": 6.14, "size_bytes": 119008.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.65, "overlay_size": 20704.0, "string_count": 2905.0, "overlay_ratio": 0.17, "overall_entropy": 6.14, "overlay_entropy": 7.85, "entropy_variance": 5.13, "avg_string_length": 15.47, "max_string_length": 200.0, "code_to_data_ratio": 1.0, "string_length_stddev": 10.69, "largest_section_ratio": 0.81, "sentence_string_count": 19.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 96256.0, "entropy_max": 5.65, "entropy_mean": 2.83, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 96256, 5.65, "r-x" ], [ ".rsrc", 96768, 1024, 2.75, "r--" ], [ ".reloc", 97792, 512, 0.1, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 29520, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 29677, "u8", "hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD" ], [ 29846, "u8", "QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" ], [ 29934, "u8", "System.Drawing.Bitmap" ], [ 29960, "u8", "Data" ], [ 29996, "u8", "IHDR" ], [ 30173, "u8", "rr6rrL" ], [ 31446, "u8", "0E6xrE" ], [ 33068, "u8", "lI n" ], [ 33572, "u8", "cu8s" ], [ 35899, "u8", "Y9mpq" ], [ 38655, "u8", "AZJQ5" ], [ 38822, "u8", "WIRV6KI" ], [ 39632, "u8", "Pjwk" ], [ 40158, "u8", "zKpt" ], [ 41271, "u8", "WYA79" ], [ 41882, "u8", "AVVR" ], [ 43109, "u8", "H_G5" ], [ 43437, "u8", "joRj" ], [ 43680, "u8", "wc9i" ], [ 50704, "u8", "FITR" ], [ 51093, "u8", "IEND" ], [ 51104, "u8", "BSJB" ], [ 53325, "u8", "\u003cModule\u003e" ], [ 53340, "u8", "MusicExpressMain" ], [ 53357, "u8", "MusicExpress" ], [ 53370, "u8", "MusicReader" ], [ 53382, "u8", "Program" ], [ 53390, "u8", "System.Windows.Forms" ], [ 53411, "u8", "Form" ], [ 53416, "u8", "mscorlib" ], [ 53425, "u8", "System" ], [ 53432, "u8", "Object" ], [ 53439, "u8", "TextBox" ], [ 53447, "u8", "textBox1" ], [ 53456, "u8", "RichTextBox" ], [ 53468, "u8", "richTextBox1" ], [ 53481, "u8", "textBox2" ], [ 53490, "u8", "textBox3" ], [ 53499, "u8", "Button" ], [ 53506, "u8", "button1" ], [ 53514, "u8", "button2" ], [ 53522, "u8", "button3" ], [ 53530, "u8", "button4" ], [ 53538, "u8", "button5" ], [ 53546, "u8", "button6" ], [ 53554, "u8", "button7" ], [ 53562, "u8", "button8" ], [ 53570, "u8", "button9" ], [ 53578, "u8", "button10" ], [ 53587, "u8", "button11" ], [ 53596, "u8", "button12" ], [ 53605, "u8", "button13" ], [ 53614, "u8", "button14" ], [ 53623, "u8", "button15" ], [ 53632, "u8", "button16" ], [ 53641, "u8", "button17" ], [ 53650, "u8", "button18" ], [ 53659, "u8", "button19" ], [ 53668, "u8", "button20" ], [ 53677, "u8", "button21" ], [ 53686, "u8", "button22" ], [ 53695, "u8", "button23" ], [ 53704, "u8", "button24" ], [ 53713, "u8", "button25" ], [ 53722, "u8", "button26" ], [ 53731, "u8", "button27" ], [ 53740, "u8", "button28" ], [ 53749, "u8", "button29" ], [ 53758, "u8", "button30" ], [ 53767, "u8", "button31" ], [ 53776, "u8", "button32" ], [ 53785, "u8", "button33" ], [ 53794, "u8", "button34" ], [ 53803, "u8", "button35" ], [ 53812, "u8", "button36" ], [ 53821, "u8", "button37" ], [ 53830, "u8", "button38" ], [ 53839, "u8", "textBox4" ], [ 53848, "u8", "button39" ], [ 53857, "u8", "button40" ], [ 53866, "u8", "button41" ], [ 53875, "u8", "button42" ], [ 53884, "u8", "button43" ], [ 53893, "u8", "button44" ], [ 53902, "u8", "button45" ], [ 53911, "u8", "button46" ], [ 53920, "u8", "button47" ], [ 53929, "u8", "button48" ], [ 53938, "u8", "button49" ], [ 53947, "u8", "button50" ], [ 53956, "u8", "button51" ], [ 53965, "u8", "button52" ], [ 53974, "u8", "button53" ], [ 53983, "u8", "button54" ], [ 53992, "u8", "button55" ], [ 54001, "u8", "button56" ], [ 54010, "u8", "button57" ], [ 54019, "u8", "button58" ], [ 54028, "u8", "button59" ], [ 54037, "u8", "button60" ], [ 54046, "u8", "button61" ], [ 54055, "u8", "button62" ], [ 54064, "u8", "button63" ], [ 54073, "u8", "button64" ], [ 54082, "u8", "textBox5" ], [ 54091, "u8", "textBox6" ], [ 54100, "u8", "textBox7" ], [ 54109, "u8", "button65" ], [ 54118, "u8", "button66" ], [ 54127, "u8", "button67" ], [ 54136, "u8", "button68" ], [ 54145, "u8", "button69" ], [ 54154, "u8", "button70" ], [ 54163, "u8", "button71" ], [ 54172, "u8", "button72" ], [ 54181, "u8", "button73" ], [ 54190, "u8", "button74" ], [ 54199, "u8", "button75" ], [ 54208, "u8", "button76" ], [ 54217, "u8", "CheckBox" ], [ 54226, "u8", "checkBox1" ], [ 54236, "u8", "checkBox2" ], [ 54246, "u8", "checkBox3" ], [ 54256, "u8", "checkBox4" ], [ 54266, "u8", "checkBox5" ], [ 54276, "u8", "checkBox6" ], [ 54286, "u8", "checkBox7" ], [ 54296, "u8", "checkBox8" ], [ 54306, "u8", "checkBox9" ], [ 54316, "u8", "checkBox10" ], [ 54327, "u8", "textBox8" ], [ 54336, "u8", "textBox9" ], [ 54345, "u8", "textBox10" ], [ 54355, "u8", "textBox11" ], [ 54365, "u8", "textBox12" ], [ 54375, "u8", "textBox13" ], [ 54385, "u8", "textBox14" ], [ 54395, "u8", "textBox15" ], [ 54405, "u8", "textBox16" ], [ 54415, "u8", "textBox17" ], [ 54425, "u8", "textBox18" ], [ 54435, "u8", "textBox19" ], [ 54445, "u8", "textBox20" ], [ 54455, "u8", "textBox21" ], [ 54465, "u8", "textBox22" ], [ 54475, "u8", "Label" ], [ 54481, "u8", "label1" ], [ 54488, "u8", "label2" ], [ 54495, "u8", "label3" ], [ 54502, "u8", "label4" ], [ 54509, "u8", "label5" ], [ 54516, "u8", "label6" ], [ 54523, "u8", "label7" ], [ 54530, "u8", "label8" ], [ 54537, "u8", "label9" ], [ 54544, "u8", "label10" ], [ 54552, "u8", "label11" ], [ 54560, "u8", "label12" ], [ 54568, "u8", "label13" ], [ 54576, "u8", "label14" ], [ 54584, "u8", "label15" ], [ 54592, "u8", "button77" ], [ 54601, "u8", "button78" ], [ 54610, "u8", "button79" ], [ 54619, "u8", "button80" ], [ 54628, "u8", "button81" ], [ 54637, "u8", "button82" ], [ 54646, "u8", "button83" ], [ 54655, "u8", "button84" ], [ 54664, "u8", "button85" ], [ 54673, "u8", "button86" ], [ 54682, "u8", "button87" ], [ 54691, "u8", "button88" ], [ 54700, "u8", "button89" ], [ 54709, "u8", "button90" ], [ 54718, "u8", "button91" ], [ 54727, "u8", "button92" ], [ 54736, "u8", "button93" ], [ 54745, "u8", "button94" ], [ 54754, "u8", "button95" ], [ 54763, "u8", "button96" ], [ 54772, "u8", "button97" ], [ 54781, "u8", "button98" ], [ 54790, "u8", "button99" ], [ 54799, "u8", "button100" ], [ 54809, "u8", "textBox23" ], [ 54819, "u8", "System.ComponentModel" ], [ 54841, "u8", "IContainer" ], [ 54852, "u8", "components" ], [ 54863, "u8", ".ctor" ], [ 54869, "u8", "InitializeComponent" ], [ 54889, "u8", "init" ], [ 54894, "u8", "Browse" ], [ 54901, "u8", "GetMusic" ], [ 54910, "u8", "Play" ], [ 54915, "u8", "EventArgs" ], [ 54925, "u8", "MusicExpressMain_Load" ], [ 54947, "u8", "get_Path" ], [ 54956, "u8", "_getPath" ], [ 54965, "u8", "Path" ], [ 54970, "u8", "Main" ], [ 54975, "u8", "System.Reflection" ], [ 54993, "u8", "AssemblyFileVersionAttribute" ], [ 55022, "u8", "AssemblyVersionAttribute" ], [ 55047, "u8", "System.Runtime.InteropServices" ], [ 55078, "u8", "GuidAttribute" ], [ 55092, "u8", "ComVisibleAttribute" ], [ 55112, "u8", "AssemblyCultureAttribute" ], [ 55137, "u8", "AssemblyTrademarkAttribute" ], [ 55164, "u8", "AssemblyCopyrightAttribute" ], [ 55191, "u8", "AssemblyProductAttribute" ], [ 55216, "u8", "AssemblyCompanyAttribute" ], [ 55241, "u8", "AssemblyConfigurationAttribute" ], [ 55272, "u8", "AssemblyDescriptionAttribute" ], [ 55301, "u8", "AssemblyTitleAttribute" ], [ 55324, "u8", "System.Security.Permissions" ], [ 55352, "u8", "SecurityPermissionAttribute" ], [ 55380, "u8", "SecurityAction" ], [ 55395, "u8", "System.Runtime.CompilerServices" ], [ 55427, "u8", "CompilationRelaxationsAttribute" ], [ 55459, "u8", "RuntimeCompatibilityAttribute" ], [ 55491, "u8", "Control" ], [ 55499, "u8", "SuspendLayout" ], [ 55513, "u8", "System.Drawing" ], [ 55528, "u8", "Point" ], [ 55534, "u8", "set_Location" ], [ 55547, "u8", "set_Name" ], [ 55556, "u8", "Size" ], [ 55561, "u8", "set_Size" ], [ 55570, "u8", "set_TabIndex" ], [ 55583, "u8", "set_Text" ], [ 55592, "u8", "TextBoxBase" ], [ 55604, "u8", "set_Multiline" ], [ 55618, "u8", "ButtonBase" ], [ 55629, "u8", "set_UseVisualStyleBackColor" ], [ 55657, "u8", "set_AutoSize" ], [ 55670, "u8", "RightToLeft" ], [ 55682, "u8", "set_RightToLeft" ], [ 55698, "u8", "HorizontalAlignment" ], [ 55718, "u8", "set_TextAlign" ], [ 55732, "u8", "SystemColors" ], [ 55745, "u8", "Color" ], [ 55751, "u8", "get_ActiveCaptionText" ], [ 55773, "u8", "set_BackColor" ], [ 55787, "u8", "set_ClientSize" ], [ 55802, "u8", "ControlCollection" ], [ 55820, "u8", "get_Controls" ], [ 55837, "u8", "EventHandler" ], [ 55859, "u8", "ResumeLayout" ], [ 55872, "u8", "PerformLayout" ], [ 55886, "u8", "AppDomain" ], [ 55896, "u8", "get_CurrentDomain" ] ], "val": { "file.stem": "ebcdf0ea7146fac2e4d68409c125892102c8b65c97321d7a57e1386ce69d5e09", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1528736851, "file.basename": "ebcdf0ea7146fac2e4d68409c125892102c8b65c97321d7a57e1386ce69d5e09.exe", "pe.image_base": 4194304, "pe.image_size": 122880, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 104030, "pe.headers_size": 512, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "199ed2bfa0f1752dc08eec42321af2561f2fe1f4", "pe.version.company": "chieftain", "pe.image_hash.sha256": "94a83d03d5bdeb342befc54fedc57fb8714fa1c94650e27a4f90567cd163b4a2", "pe.image_hash.sha384": "b60d84d5e81cbe9d6cddb08adce4dfe05608db785ff7f8704d50315d0deb33d0b02c6a7551755aeea6209c8e5ae3e261", "pe.image_hash.sha512": "3758fed11c2bb7c5af545fd1f0e15a0888a90f1c64a766a130b1c7bcaf0d79464ee80343c1eb5e81dc811f8ffb51220c1827d84751b40b39ac1904a8dae76a1d", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "aluminium © gluttonous", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.version.description": "approximation", "pe.linker_major_version": 8, "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "33000002528b33aaf895f339db000000000252", "pe.version.file_version": "1.28.14.52", "pe.version.product_name": "frozen", "pe.signatures[0].subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.version.internal_name": "1.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 103944, "pe.data_directories[1].rva": 106496, "pe.data_directories[2].rva": 102016, "pe.data_directories[3].rva": 114688, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2022-09-01T18:32:59Z", "pe.version.product_version": "1.28.14.52", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 840, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 10144, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.signatures[0].not_before": "2021-09-02T18:32:59Z", "pe.version.original_filename": "1.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "8740df4acb749640ad318e4be842f72ec651ad80", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 2, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "c8361aec219d230e6aba29521f523e79cac271f3ce45418d80681438dcdbedc0", "pe.signatures[0].thumbprint_sha256": "2eb421fbb33bbf9c8f6b58c754b0405f40e02cb6328936aae39db7a24880ea21", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" } }, "find": [ { "id": "metadata/signed/unknown::microsoft-corporation", "conf": 1.0, "crit": 2, "desc": "Authenticode chain CN: Microsoft Corporation" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.949999988079071, "crit": 2, "desc": "Microsoft timestamp certificate chain" }, { "id": "metadata/binary/metrics/threshold::string-count-1000-plus", "conf": 1.0, "crit": 2, "desc": "Binary has 1000 or more strings" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "conf": 0.699999988079071, "crit": 1, "desc": "Reflection method namespace token" }, { "id": "micro-behaviors/data/text/keywords/lexicon::notification-config-word", "conf": 0.8600000143051147, "crit": 1, "desc": "notify/sender vocabulary word" }, { "id": "metadata/hardening/mitigation::pe-no-seh", "conf": 1.0, "crit": 2, "desc": "NO_SEH (SafeSEH not used)" }, { "id": "metadata/binary/framework::exe-extension", "conf": 0.8999999761581421, "crit": 1, "desc": "PE file uses .exe extension" }, { "id": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "conf": 0.8500000238418579, "crit": 2, "desc": "IPv4-like .NET assembly version" }, { "id": "metadata/lang/compiler/managed::winforms-ui", "conf": 0.800000011920929, "crit": 2, "desc": "Windows Forms UI framework" }, { "id": "metadata/file/extension::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" }, { "id": "metadata/binary/framework::is-binary", "conf": 1.0, "crit": 1, "desc": "File is a compiled binary" }, { "id": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url", "conf": 0.8199999928474426, "crit": 1, "desc": "Encoded Microsoft OCSP URL" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference" }, { "id": "metadata/lang/compiler/managed::runtime-interop", "conf": 0.75, "crit": 2, "desc": "Runtime interop services" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Binary has normal code entropy (\u003e5.5)" }, { "id": "metadata/binary/resource::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.949999988079071, "crit": 2, "desc": "Microsoft code-signing certificate chain" }, { "id": "metadata/binary/section/names::pe-runtime-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard runtime section" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in certificate data" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.699999988079071, "crit": 1, "desc": "PE import table has exactly one entry" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "metadata/package/versioning::pe-file-description-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE FileDescription field is populated" }, { "id": "objectives/anti-static/pack/section-anomaly::reloc-overhang-ratio-high", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "Reloc section mostly non-relocation bytes" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "atk": "T1027", "conf": 0.8999999761581421, "crit": 1, "desc": "High plaintext string count" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "objectives/anti-static/pack/upx::no-compression-grade-section", "atk": "T1027.002", "mbc": "F0001.008", "conf": 0.8999999761581421, "crit": 1, "desc": "No section reaches compression-grade entropy" }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.8999999761581421, "crit": 1, "desc": "SOCKS5 client greeting bytes" }, { "id": "metadata/package/files::exe-extension-basename", "conf": 0.949999988079071, "crit": 1, "desc": "Filename ends with .exe" }, { "id": "metadata/binary/anomaly/format::version-info-file-version-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE version info numeric fields present" }, { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4" }, { "id": "metadata/binary/resource::png-magic-in-text", "conf": 0.8999999761581421, "crit": 1, "desc": "PNG image magic in text section" }, { "id": "metadata/package/versioning::pe-productname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductName metadata field" }, { "id": "metadata/package/versioning::pe-product-name-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE ProductName field is populated" }, { "id": "metadata/binary/section/names::pe-resource-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE resource section" }, { "id": "metadata/lang/compiler/managed::system-namespace", "conf": 0.800000011920929, "crit": 2, "desc": "System namespace reference" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "conf": 0.6499999761581421, "crit": 1, "desc": "AppDomain class token" }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference" }, { "id": "metadata/binary/symbols/imports::pe-imports-max-six", "conf": 0.699999988079071, "crit": 1, "desc": "PE with six or fewer imports" }, { "id": "objectives/anti-static/obfuscation/payload/resource::clr-resource-high-entropy", "atk": "T1027.009", "conf": 0.699999988079071, "crit": 1, "desc": "High-entropy CLR managed resource present" }, { "id": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "conf": 1.0, "crit": 2, "desc": "Issued by a Microsoft Code Signing PCA" }, { "id": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "atk": "T1027", "mbc": "B0032", "conf": 0.8399999737739563, "crit": 1, "desc": "VB6 PE with three sections" }, { "id": "metadata/binary/section/metrics::tiny-rsrc-section", "conf": 0.8399999737739563, "crit": 1, "desc": "Minimal resource section footprint" }, { "id": "metadata/binary/layout::legacy-few-sections", "conf": 0.699999988079071, "crit": 2, "desc": "PE has few sections" }, { "id": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "atk": "T1027", "mbc": "B0032", "conf": 0.9900000095367432, "crit": 1, "desc": "PE version resource text" }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.8999999761581421, "crit": 2, "desc": "mscorlib reference" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "conf": 0.8199999928474426, "crit": 1, "desc": "Type.InvokeMember reflection token" }, { "id": "well-known/malware/worm/ludbaruma::metric-section-count-3", "conf": 0.9900000095367432, "crit": 1, "desc": "Exactly three sections" }, { "id": "metadata/binary/section/names::reloc-section-presence", "conf": 0.8999999761581421, "crit": 2, "desc": "PE .reloc section presence" }, { "id": "metadata/binary/layout::cert-table-present", "conf": 0.8999999761581421, "crit": 1, "desc": "PE certificate table entry populated" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/threshold::many-strings-2000", "conf": 1.0, "crit": 1, "desc": "Binary has 2000+ strings" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "conf": 0.6000000238418579, "crit": 1, "desc": "AppDomain.CurrentDomain accessor" }, { "id": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "atk": "T1105", "mbc": "B0022", "conf": 0.8999999761581421, "crit": 1, "desc": "Dominant high entropy overlay" }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/pack/runtime::dotnet-interop-services-string", "atk": "T1027.002", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 1, "desc": "Embedded System.Runtime.InteropServices name" }, { "id": "objectives/command-and-control/dropper/staging/embedded::createinstance-token", "atk": "T1140", "mbc": "B0030", "conf": 0.8399999737739563, "crit": 1, "desc": "CreateInstance activation token" }, { "id": "metadata/package/versioning::pe-legal-copyright-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE LegalCopyright field is populated" }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileDescription metadata field" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE CompanyName metadata field" }, { "id": "metadata/hardening/mitigation::pe-aslr", "conf": 1.0, "crit": 2, "desc": "ASLR enabled (DYNAMIC_BASE)" }, { "id": "metadata/package/versioning::pe-originalfilename-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE OriginalFilename metadata field" }, { "id": "objectives/evasion/masquerade/identity/fabricated::identity-nondegenerate-entropy", "atk": "T1036.005", "conf": 0.6000000238418579, "crit": 1, "desc": "identity nondegenerate entropy" }, { "id": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "atk": "T1620", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "mscoree DLL string reference" }, { "id": "metadata/hardening/mitigation::pe-dep", "conf": 1.0, "crit": 2, "desc": "DEP / NX enabled (NX_COMPAT)" }, { "id": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "conf": 0.8999999761581421, "crit": 1, "desc": "PE has under ten imports" }, { "id": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "atk": "T1027", "mbc": "B0032", "conf": 0.699999988079071, "crit": 1, "desc": "Code section dominates file layout" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "metadata/binary/section/names::pe-code-data-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard code/data section" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "conf": 0.6200000047683716, "crit": 1, "desc": "Assembly Load method token" }, { "id": "metadata/signed/certificate::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE InternalName metadata field" }, { "id": "objectives/command-and-control/infrastructure/config::max-sections-4", "conf": 1.0, "crit": 1, "desc": "Binary has 4 or fewer sections" }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "conf": 0.8999999761581421, "crit": 1, "desc": "Binary has high overall entropy (packed/encrypted)" }, { "id": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token", "atk": "T1027.003", "mbc": "F0001.006", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET Bitmap type reference" }, { "id": "metadata/binary/layout::many-readable-strings", "conf": 0.699999988079071, "crit": 2, "desc": "PE has many readable strings" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-createinstance-token", "conf": 0.7200000286102295, "crit": 1, "desc": "Activator.CreateInstance instantiation token" }, { "id": "metadata/library/wpf::wpf-namespace-ref", "conf": 0.8999999761581421, "crit": 1, "desc": ".NET WPF namespace reference" }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "atk": "T1027.009", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET ResourceReader payload access" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "atk": "T1027.009", "mbc": "B0032", "conf": 0.800000011920929, "crit": 1, "desc": "High entropy overlay data" }, { "id": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "atk": "T1105", "mbc": "E1105", "conf": 0.800000011920929, "crit": 1, "desc": "Compact PE import table" }, { "id": "objectives/impact/services/stop::versioned-service-stop-context", "atk": "T1489", "conf": 0.699999988079071, "crit": 1, "desc": "Versioned service stop context" }, { "id": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "atk": "T1055", "mbc": "C0041", "conf": 0.9200000166893005, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/ui/controls/widget::winforms-button", "conf": 0.7200000286102295, "crit": 1, "desc": "WinForms Button control token" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "atk": "T1027", "mbc": "B0032", "crit": 1, "desc": "Binary has overlay data" }, { "id": "metadata/binary/framework::bsjb-marker", "conf": 1.0, "crit": 1, "desc": ".NET BSJB metadata marker" }, { "id": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "atk": "T1053.005", "mbc": "F0012", "conf": 0.8799999952316284, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "conf": 0.949999988079071, "crit": 1, "desc": "Filename has EXE extension" }, { "id": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "atk": "T1027", "conf": 0.800000011920929, "crit": 1, "desc": "Few PE resource entries" }, { "id": "micro-behaviors/ui/controls/widget::winforms-label", "conf": 0.7200000286102295, "crit": 1, "desc": "WinForms Label control token" }, { "id": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "Regex component marker" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)" }, { "id": "metadata/package/versioning::version-resource-metadata", "conf": 0.8999999761581421, "crit": 2, "desc": "PE version resource metadata" }, { "id": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "atk": "T1036.005", "conf": 0.9399999976158142, "crit": 1, "desc": "Two dotted-quad version strings" }, { "id": "metadata/package/versioning::version-number-ipv4-metadata", "conf": 0.949999988079071, "crit": 1, "desc": "PE version numbers look like IPv4" }, { "id": "metadata/binary/metrics/pe-details::dotnet-normal-entropy-profile", "conf": 0.699999988079071, "crit": 1, "desc": ".NET assembly with normal (unpacked) code entropy" }, { "id": "metadata/signed/platform::microsoft-certificate-chain", "conf": 1.0, "crit": 1, "desc": "Microsoft certificate chain markers" }, { "id": "metadata/package/versioning::dotnet-versioned-assembly", "conf": 0.699999988079071, "crit": 2, "desc": "Versioned .NET assembly structure" } ], "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-07/ebcdf0ea7146fac2e4d68409c125892102c8b65c97321d7a57e1386ce69d5e09.exe", "risk": 5, "size": 119008, "type": "pe" } ] } }