{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.5419355, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-30T17:54:35Z" }, "path": "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe", "raw": { "v": "5", "fs": [ { "f": "Md(Bi₃)", "x": 4, "ff": { "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 1318666.0, "bss_like_section_count": 0.0, "section_overflow_count": 3.0, "misaligned_section_count": 0.0 }, "file": { "size": 1301859.0, "entropy": 7.97, "size_bytes": 1301859.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.97, "string_count": 14798.0, "entropy_variance": 14.12, "avg_string_length": 4.63, "max_string_length": 145.0, "code_to_data_ratio": 1.0, "string_length_stddev": 1.59, "largest_section_ratio": 1.62, "sentence_string_count": 2.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "sections": { "count": 3.0, "code_size": 2113536.0, "entropy_max": 7.97, "entropy_mean": 2.66, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 5679, "u8", "*.sP" ], [ 22305, "u8", "X/( y#dI(" ], [ 22421, "u8", "X/( Q#dI(" ], [ 24177, "u8", "X/( G\"dI(" ], [ 28318, "u8", "*.s5" ], [ 36667, "u8", "g)dI(" ], [ 36691, "u8", "u)dI(" ], [ 42649, "u8", "b+a\tafeffefeefef m" ], [ 42671, "u8", "Y\tXffefeeffefea" ], [ 42714, "u8", "a\taffeeffefeefa" ], [ 42824, "u8", "a\tafeffefefe" ], [ 42874, "u8", "Y\tYffefeeffefea" ], [ 42899, "u8", "X\tXfefefeffe" ], [ 43590, "u8", "Xfefeffeefhah" ], [ 43627, "u8", "Yffefeeffehah" ], [ 43905, "u8", "Xfeffeefeffea" ], [ 43973, "u8", "Yfeffefefe_-" ], [ 44281, "u8", "Xfefefeffea" ], [ 47150, "u8", "*.sB" ], [ 47519, "u8", "*.sn" ], [ 49467, "xor", "BmQC:\\CAEdlCgki" ], [ 51385, "u8", "ffefefeeffe" ], [ 51404, "u8", "ffeeffeefef" ], [ 51421, "u8", "@\"ffeeffeeffe" ], [ 51441, "u8", "]ffefeeffe" ], [ 51470, "u8", "affeefefeffe" ], [ 51661, "u8", "feffefefe" ], [ 51677, "u8", "]ffeefeffeef" ], [ 51695, "u8", "@\"feffefefe" ], [ 51714, "u8", "ffeeffefe" ], [ 51728, "u8", "affeefeffefe" ], [ 51936, "u8", "RFfeffeeffeefa(" ], [ 51978, "u8", "AffeefeffeefYa*" ], [ 51997, "u8", "Fo+fefefeffeY" ], [ 52016, "u8", "feffefefeXa*^" ], [ 52036, "u8", "ffefeeffeY" ], [ 52250, "u8", "fefeffeefefa" ], [ 52318, "u8", "ffefeeffe(" ], [ 66903, "u8", "Yfe AIG" ], [ 67191, "u8", "+uuI c" ], [ 67264, "u8", "ae Qz" ], [ 68147, "u8", "aefa" ], [ 68797, "u8", "X 1Z" ], [ 68810, "u8", "Yf c" ], [ 69482, "u8", "Xefeo" ], [ 69619, "u8", "aefo" ], [ 70194, "u8", "af 30" ], [ 70207, "u8", "ae 6" ], [ 70765, "u8", "Xe BD" ], [ 70828, "u8", "afeo" ], [ 70857, "u8", "a ${H'Ye u" ], [ 70966, "u8", "t Yf" ], [ 71131, "u8", "Ye r" ], [ 71181, "u8", "Xf b" ], [ 71188, "u8", "Yf vo" ], [ 71405, "u8", "c Pj" ], [ 71653, "u8", "afefe" ], [ 71860, "u8", "a Qy" ], [ 72295, "u8", "Y ]i (X 7[z" ], [ 72307, "u8", "aef rF" ], [ 72601, "u8", "a Hr" ], [ 72772, "u8", "afef" ], [ 72864, "u8", "Yef E" ], [ 73269, "u8", "Ye u" ], [ 73313, "u8", "fefeYE" ], [ 73698, "u8", "Xefe" ], [ 73778, "u8", "A*ae gp" ], [ 74058, "u8", "aefef" ], [ 74208, "u8", "Yefa" ], [ 74386, "u8", "c Sr" ], [ 74398, "u8", "YefYE" ], [ 74494, "u8", "aefe wJ" ], [ 74598, "u8", "aefe" ], [ 74661, "u8", "afe Z" ], [ 75251, "u8", "Yefe" ], [ 81692, "u8", "aeeYE" ], [ 82592, "u8", "feoc" ], [ 82651, "u8", "Vm a %3" ], [ 82689, "u8", "Xeoc" ], [ 84012, "u8", "Y bCj" ], [ 86884, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 87041, "u8", "PADPADP" ], [ 87201, "u8", "Guuuuuuuuw" ], [ 87405, "u8", "PWW5" ], [ 87499, "u8", "2YQtDW" ], [ 87678, "u8", "TEIC8" ], [ 88418, "u8", "Wiun" ], [ 89025, "u8", "aguWF" ], [ 90610, "u8", "OWJO" ], [ 91343, "u8", "nOjj" ], [ 91444, "u8", "INXI" ], [ 92258, "u8", "oDer" ], [ 92616, "u8", "4Rxn0" ], [ 93023, "u8", "Rzbl" ], [ 94449, "u8", "8b6XQ" ], [ 94866, "u8", "ZB9M" ], [ 96113, "u8", "2SDhq" ], [ 96828, "u8", "yxL7G" ], [ 98649, "u8", "iJqwR" ], [ 98961, "u8", "/JSD" ], [ 101858, "u8", "K9RM" ], [ 102696, "u8", "y2aCN" ], [ 103430, "u8", "3n2u" ], [ 104727, "u8", "EgQYL" ], [ 105327, "u8", "g1qjW" ], [ 105940, "u8", "8vROA" ], [ 106356, "u8", "UwzW3" ], [ 108301, "u8", "i684J" ], [ 111681, "u8", "XpmKb" ], [ 112539, "u8", "EyjDe" ], [ 115506, "u8", "z2q4" ], [ 115534, "u8", "GV1R" ], [ 121666, "u8", "/mRk" ], [ 123546, "u8", "Ztee" ], [ 129969, "u8", "M0_G_" ], [ 130571, "u8", "jpIs" ], [ 133212, "u8", "O813" ], [ 133909, "u8", "XIT2m" ], [ 134198, "u8", "Z9PA" ], [ 135773, "u8", "dmHg/ M" ], [ 135913, "u8", "mBzs" ], [ 138275, "u8", "BBO2" ], [ 138769, "u8", "fBuHO" ], [ 140054, "u8", "q9f9" ], [ 140572, "u8", "nBNHc" ], [ 145053, "u8", "xoBd" ], [ 146348, "u8", "xyNQB" ], [ 151166, "u8", "avlm4s" ], [ 152853, "u8", "42ca" ], [ 152990, "u8", "p 3h" ], [ 154084, "u8", ";?4\u003c\u003c7nRZ" ], [ 154414, "u8", "5NLbf" ], [ 157476, "u8", "QZOF" ], [ 158452, "u8", "8jiy" ], [ 158617, "u8", "pJko" ], [ 158772, "u8", "uj6c" ], [ 159590, "u8", "wdqRG2" ], [ 160398, "u8", "wbK1R" ], [ 160620, "u8", "sZ eh" ], [ 161174, "u8", "TVOP" ], [ 167167, "u8", "QIXqp" ], [ 167799, "u8", "u0DPn" ], [ 169038, "u8", "mxFu" ], [ 172153, "u8", "3tRA3" ], [ 174959, "u8", "Urva" ], [ 175170, "u8", "EW1N" ], [ 176735, "u8", "W303" ], [ 180260, "u8", "OB 09" ], [ 180941, "u8", "3 8K" ], [ 181346, "u8", "cp 9" ], [ 183004, "u8", "Rilp" ], [ 183071, "u8", "9VSIfhl" ], [ 183308, "u8", "PSiaa" ], [ 183469, "u8", "8SAhI" ], [ 183697, "u8", "MONI" ], [ 183787, "u8", "46EE" ], [ 183909, "u8", "bdIy" ], [ 184754, "u8", "2CH0l" ], [ 184808, "u8", "KJSIeY" ], [ 185243, "u8", "liNp" ], [ 186454, "u8", "Ygks" ], [ 186646, "u8", "KIPK" ], [ 186675, "u8", "VRj1C" ], [ 188051, "u8", "W7ON" ], [ 189373, "u8", "z}k{" ], [ 190926, "u8", "hkQ7J" ], [ 191297, "u8", "@Dl sx" ], [ 194279, "u8", "rTCEkZHO" ], [ 194993, "u8", "HUEhAT" ], [ 195125, "u8", "PIpRnq" ], [ 198248, "u8", "nflYu" ], [ 200128, "u8", "yktpQ" ], [ 201057, "u8", "wwuMMO" ], [ 201124, "u8", "wuJe" ], [ 202042, "u8", "KM1ySBo" ], [ 203977, "u8", "1zEre" ], [ 204842, "u8", "8g2e" ], [ 207173, "u8", "q 3p1" ], [ 207724, "u8", "omyov8" ], [ 208060, "u8", "I6ull" ], [ 210315, "u8", "rVth" ], [ 213134, "u8", "lCejA" ], [ 216459, "u8", "dlLtI" ], [ 218189, "u8", "vcNOrM" ], [ 218575, "u8", "o6rp" ], [ 220543, "u8", "uaXy" ], [ 222100, "u8", "1w17F" ], [ 223522, "u8", "35bN6" ], [ 225690, "u8", "Nbeh" ], [ 226056, "u8", "/Z7VY" ], [ 226516, "u8", "fTZ1K" ], [ 227166, "u8", "Kic3v" ], [ 227589, "u8", "nAJ0r" ], [ 229573, "u8", "Fgum" ], [ 230604, "u8", "Zznt" ], [ 231470, "u8", "ZrbJ4" ], [ 231509, "u8", "ycjY2" ], [ 231981, "u8", "GScI7" ], [ 232404, "u8", "AH38" ], [ 233428, "u8", "4F0C" ], [ 234573, "u8", "JOA0" ], [ 234925, "u8", "V4YK" ], [ 237244, "u8", "RnAS8" ], [ 237707, "u8", "7yPDl" ], [ 238327, "u8", "8y7k" ], [ 240778, "u8", "EHK2" ], [ 242029, "u8", "YF1I" ], [ 242266, "u8", "awrNF" ], [ 246534, "u8", "JC6V" ], [ 248692, "u8", "27GcD" ], [ 252528, "u8", "iVedd" ], [ 253190, "u8", "7SXKA" ], [ 254778, "u8", "/LpHmu" ], [ 255539, "u8", "2YFG" ], [ 256234, "u8", "xG32K" ], [ 257125, "u8", "tOpr" ], [ 257958, "u8", "NMeG6" ], [ 258000, "u8", "ldV@.q" ], [ 258468, "u8", "bkTd" ], [ 260002, "u8", "NU8A" ], [ 260075, "u8", "HCSG" ], [ 263607, "u8", "hc[]" ], [ 263683, "u8", "igDs" ], [ 263755, "u8", "LimJp" ], [ 266178, "u8", "5L6at" ], [ 266635, "u8", "gZqv" ], [ 266746, "u8", "Y[]s" ], [ 269212, "u8", "RLXZ" ], [ 270491, "u8", "0Dijv" ], [ 275954, "u8", "rStmx" ], [ 276929, "u8", "BazrpJ" ], [ 277075, "u8", "yJB37" ], [ 277575, "u8", "10iRm" ], [ 278288, "u8", "OQ CC" ], [ 279458, "u8", "ZAT_" ], [ 279652, "u8", "Y66M" ], [ 280444, "u8", "CCNL" ], [ 280679, "u8", "E21D" ], [ 282420, "u8", "zpEx" ], [ 282925, "u8", "VE7P" ], [ 283619, "u8", "igJr" ], [ 284054, "u8", "goRb" ], [ 284388, "u8", "b40v" ], [ 286351, "u8", "ddiu" ], [ 286677, "u8", "AIzeW" ], [ 289376, "u8", "vOVcmj" ], [ 289448, "u8", "ywzJx0" ], [ 290545, "u8", "/EMfV" ], [ 292707, "u8", "B9EY" ], [ 294231, "u8", "o6lKU" ], [ 294321, "u8", "rRAqv" ], [ 296966, "u8", "PzDSU" ], [ 297541, "u8", "R4P9" ] ], "v": { "file.stem": "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1687660274, "file.basename": "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe", "pe.image_base": 4194304, "pe.image_size": 2138112, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 2121598, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 270, "pe.linker_major_version": 6, "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "no_seh", "pe.dll_characteristics[4]": "terminal_server_aware", "pe.data_directories[0].rva": 2121512, "pe.data_directories[1].rva": 2121728, "pe.data_directories[2].rva": 2129920, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34144, "pe.number_of_rva_and_sizes": 16, "pe.overflowing_sections[0]": ".text", "pe.overflowing_sections[1]": ".rsrc", "pe.overflowing_sections[2]": ".reloc", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1536, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 512, 2113536, 7.97, "r-x" ], [ ".rsrc", 2114048, 1536, 0.0, "r--" ], [ ".reloc", 2115584, 512, 0.0, "r--" ] ] }, "id": 0, "sz": 1301859, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 14798.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 14798.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KG token", "e": [ " KG" ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-kg", "l": 1, "m": "B0007.003", "el": [ "0xee5d5" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Large near-high entropy .text section", "e": [ ".text (size: 2113536, entropy: 7.97, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-large-near-high-entropy-text-raw", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.97)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 14798.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x15364" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 7.97, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.97" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.97" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x9b8c" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "cc", "c8" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0x835be", "0x6b5ff" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload/compression::gzip-magic", "l": 2, "el": [ "0x15438" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x3527" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x15364" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x74d2" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 14798.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "4a", "4d" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x26fc6", "0xcd6e5" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 14798.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x15364" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 2113536, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 14798.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 1.0, "d": "LZMA header nonzero size pos 3", "e": [ "02 01 00" ], "i": "micro-behaviors/data/embedded/payload/compression::lzma-sized-nonzero-3", "l": 1, "el": [ "0x8394" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 14798.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 14798.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.97" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.63" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 7.97, perms: r-x)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.62" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" } ], "sha": "ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-07/ef84da91369283a447067206cd00439e34d4d97f1e087d72ec44325ef8f691dc.exe", "type": "pe" } ], "tv": "ca5ef" } }