{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9987504482269287, "class": 1 } ], "prob": 0.99875045, "class": 1, "oprob": 0.99875045, "models": [ { "m": "az", "prob": 0.9957052, "class": 0 }, { "m": "az/native", "prob": 0.99875045, "class": 0 }, { "m": "az/pe", "prob": 0.98705137, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T03:12:01Z" }, "path": "43129", "raw": { "v": "4", "fs": [ { "f": "O₄(As₁₀C₆Er₆S)H₄(DsPoCmOs)Md₄(Bi₇PtSiPa)", "k": { "pe.timestamp": 1071417432, "hashes.imphash": "5a498eee87e4d89512a84502f500181f", "build.target_arch": "x86", "pe.linker_version": "2.50", "pe.resource_types[0]": "RT_VERSION", "pe.inflated_sections[0]": ".data", "pe.inflated_sections[1]": ".rsrc", "pe.inflated_sections[2]": ".tls", "pe.inflated_sections[3]": ".CRT", "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "5.1.2600.0", "pe.version_info.product_name": "Microsoft® Windows® Operating System", "pe.version_info.internal_name": "svchost.exe", "pe.version_info.legal_copyright": "© Microsoft Corporation. All rights reserved.", "pe.version_info.product_version": "5.1.2600.0", "pe.version_info.file_description": "Generic Host Process for Win32 Services", "pe.version_info.original_filename": "svchost.exe" }, "x": 44, "id": 0, "is": [ "GetProcAddress", "GetModuleHandleA", "LoadLibraryA" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 512.0, "subsystem": 2.0, "timestamp": 1071417432.0, "image_base": 4194304.0, "rsrc_entropy": 0.73, "entry_section": ".sdata", "size_of_image": 217088.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "timestamp_year": 2003.0, "characteristics": 270.0, "entry_point_rva": 204801.0, "size_of_headers": 1024.0, "timestamp_month": 12.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 542448.0, "section_alignment": 4096.0, "number_of_sections": 11.0, "resource_timestamp": 0.0, "linker_major_version": 2.0, "linker_minor_version": 50.0, "version_info_present": true, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false, "max_section_inflation_ratio": 8.0, "entry_in_nonstandard_section": true }, "file": { "size": 488258.0 }, "binary": { "entry_point": 204801.0, "has_overlay": true, "data_entropy": 5.2, "import_count": 3.0, "overlay_size": 441154.0, "string_count": 213.0, "overlay_ratio": 0.9, "section_count": 11.0, "overall_entropy": 3.15, "overlay_entropy": 7.99, "avg_section_size": 4189.09, "dependency_count": 1.0, "entropy_variance": 3.41, "avg_string_length": 6.65, "max_string_length": 80.0, "wide_string_count": 17.0, "avg_string_entropy": 2.21, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.06, "high_entropy_regions": 2.0, "string_length_stddev": 8.61, "largest_section_ratio": 0.06, "sentence_string_count": 6.0, "sentence_string_ratio": 0.03, "behavioral_import_ratio": 0.67, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 416, ".bss" ], [ 456, ".exc" ], [ 496, ".data" ], [ 536, ".rsrc" ], [ 576, ".idata" ], [ 616, ".tls" ], [ 656, ".CRT" ], [ 696, ".reloc" ], [ 736, ".sdata" ], [ 5305, "PX5D" ], [ 6868, "NHRF" ], [ 7142, "v4a0" ], [ 7189, "COKP" ], [ 17770, "b7f2" ], [ 23970, "DDCMV" ], [ 24411, "AQEU" ], [ 24704, "`_*`" ], [ 25448, "Redl" ], [ 26836, "3SH1R" ], [ 31144, "O1FP" ], [ 31291, "UT7N" ], [ 32849, "6H8M" ], [ 35082, "i7wr" ], [ 35777, "PCC4" ], [ 36099, "/c\tA" ], [ 42600, "PQVS" ], [ 45668, "kernel32.dll" ], [ 45681, "VirtualAlloc" ], [ 45694, "VirtualFree" ], [ 45706, "VirtualProtect" ], [ 45721, "ExitProcess" ], [ 45737, "user32.dll" ], [ 45748, "MessageBoxA" ], [ 45760, "wsprintfA" ], [ 45770, "LOADER ERROR" ], [ 45783, "The procedure entry point %s could not be located in the dynamic link library %s" ], [ 45864, "The ordinal %u could not be located in the dynamic link library %s" ], [ 45963, "GetProcAddress" ], [ 45980, "GetModuleHandleA" ], [ 45999, "LoadLibraryA" ], [ 46058, "wide", "VS_VERSION_INFO" ], [ 46150, "wide", "StringFileInfo" ], [ 46210, "wide", "CompanyName" ], [ 46236, "wide", "Microsoft Corporation" ], [ 46286, "wide", "FileDescription" ], [ 46320, "wide", "Generic Host Process for Win32 Services" ], [ 46406, "wide", "FileVersion" ], [ 46462, "wide", "InternalName" ], [ 46488, "wide", "svchost.exe" ], [ 46518, "wide", "LegalCopyright" ], [ 46548, "wide", "© Microsoft Corporation. All rights reserved." ], [ 46646, "wide", "OriginalFilename" ], [ 46710, "wide", "ProductName" ], [ 46736, "wide", "Microsoft® Windows® Operating System" ], [ 46818, "wide", "ProductVersion" ], [ 46878, "wide", "VarFileInfo" ], [ 46910, "wide", "Translation" ], [ 47977, "Qtcu" ], [ 48735, "BQ42ZC" ], [ 49611, "6p77p" ], [ 53392, "SZ6Q3" ], [ 53732, "Wt q" ], [ 53854, "/6Sk" ], [ 59246, "VF8Y" ], [ 60961, "/q7o" ], [ 62168, ".qel" ], [ 66753, "av3s" ], [ 71792, "q66h" ], [ 72934, "eorc" ], [ 75723, "RE9W" ], [ 77884, "6TCE" ], [ 78791, "Xzjhn" ], [ 80148, "/CXQ" ], [ 90007, "U5M0" ], [ 90750, "/9QX" ], [ 90776, "OA3D" ], [ 91488, "Kuyn" ], [ 95752, "LRR3" ], [ 96757, "Eghm" ], [ 101350, "/exb" ], [ 102923, "m6d7" ], [ 103404, "Fsiz" ], [ 103589, "BJCL" ], [ 105323, "INO4" ], [ 107631, "LLZW" ], [ 109604, "l8jla" ], [ 111565, "Hlxk" ], [ 113160, "YO5G" ], [ 113184, "XM1Y" ], [ 115331, "/qLrm" ], [ 116115, "CVK8" ], [ 119416, "07 f" ], [ 125897, "FR5V" ], [ 137563, "Zbyw" ], [ 153680, "4BW0A" ], [ 158763, "/2nS" ], [ 161879, "WU235" ], [ 162772, "Rmfd" ], [ 167548, "TVHNG" ], [ 177792, "Epat" ], [ 178096, "8JNL" ], [ 178663, "7SKP" ], [ 179960, "4NKK" ], [ 184980, "Qagh" ], [ 187641, "RPp-KFY" ], [ 192345, "TKAAF" ], [ 194054, "Wdyfvv" ], [ 196051, "/4AR" ], [ 198818, "ZURT" ], [ 201463, "YXSJ" ], [ 203689, "'2\u003eV" ], [ 204035, "5PDG" ], [ 205312, "/tD7" ], [ 205401, "946j" ], [ 206308, "I1 L" ], [ 211499, "2yzde" ], [ 214354, "Vge\u003c\u003c" ], [ 220793, "hq7ud1" ], [ 220839, "IHT8" ], [ 223645, "4E0C" ], [ 227956, "KFUT" ], [ 228157, "HHORU" ], [ 229073, "W0T2" ], [ 229179, "DRXB" ], [ 231667, "IMPWB" ], [ 235023, "bioc" ], [ 236195, "52lq" ], [ 240952, "SEQV" ], [ 242416, "`\u003c$?`" ], [ 244356, "Bhdd" ], [ 246221, "8M7K" ], [ 249739, "ck7e" ], [ 251039, "NZZ9" ], [ 252064, "10RQ" ], [ 253604, "RM7CV" ], [ 254752, "O9FV" ], [ 257982, "Ehxq" ], [ 258255, "KXZM" ], [ 261061, "qo 8l" ], [ 266650, "H63H" ], [ 270180, "/K62q" ], [ 272033, "Bgxm" ], [ 273723, "cip7c" ], [ 283985, "K yg" ], [ 284874, "IVS2" ], [ 296990, "U G1" ], [ 304127, "X3DUV" ], [ 304165, "8DEK" ], [ 312011, "ne53" ], [ 319629, "U4UV" ], [ 323340, "/4Vy" ], [ 323437, "AD1F" ], [ 328375, "7 6l" ], [ 335604, "*46Oy2\u003e" ], [ 336771, "NCYZ" ], [ 340709, "esax" ], [ 354179, "A14Y" ], [ 355318, "4CBS" ], [ 355410, "/VPJ" ], [ 357982, "H1 1" ], [ 364684, "3PLX" ], [ 365716, "Igty" ], [ 365742, "Amsv" ], [ 366982, "etla" ], [ 372070, "io6w" ], [ 374013, "e.63" ], [ 376141, "DOWL" ], [ 376565, "2 LT" ], [ 377557, "9uri" ], [ 381903, "3ZOD" ], [ 382151, "THF0" ], [ 385711, "46YD" ], [ 390963, "117w" ], [ 392214, "Arlc" ], [ 393064, "NUVH" ], [ 393500, "DQPX" ], [ 393688, "P8VX" ], [ 396228, "Gszqez" ], [ 398998, "egeb" ], [ 399749, "GU\u003c\u003cO|" ], [ 401152, "VU8E" ], [ 401602, "O 9E" ], [ 408159, "O0AD" ], [ 409595, "ezmv1o" ], [ 412890, "Pfkq" ], [ 417569, "44QE" ], [ 418052, "Enlj" ], [ 422539, "/OJl" ], [ 424244, "Ifwj" ], [ 426488, "/tuU" ], [ 432864, "Afif" ], [ 435564, "p7fu" ], [ 438874, "9HEZ" ], [ 438994, "/IkK" ], [ 441181, "Azfqb" ], [ 444926, "CTTP" ], [ 446057, "UN_9" ], [ 447226, "SPX3I" ], [ 448490, "Yhsr" ], [ 451167, "8apt" ], [ 451467, "j9hi" ], [ 453562, "Eulm" ], [ 455759, "Cigy" ], [ 455794, "Mzfo" ], [ 458179, "J40F" ], [ 458708, "..gg" ], [ 460015, "A2VV" ], [ 463492, "37is" ], [ 466484, "9i qyu" ], [ 474887, "u8rj" ], [ 484714, "T94YS" ] ], "sz": 488258, "ts": [ { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 7.99" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 2.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 3.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.99)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Small high-entropy writable .data section", "e": [ ".data (size: 5632, entropy: 7.89, perms: rw-)" ], "i": "metadata/binary/anomaly::small-high-entropy-data-section", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.15" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1036.005", "c": 0.800000011920929, "d": "svchost.exe process name", "e": [ "svchost.exe" ], "i": "objectives/evasion/masquerade/process/name::svchost-name", "l": 1, "m": "F0004" }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "Microsoft Corporation", "© Microsoft Corporation. All rights reserved." ], "i": "objectives/evasion/masquerade/dll/task-scheduler::microsoft-company-string", "l": 1 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 441154.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.21" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE overlay exceeds ninety percent", "e": [ "binary.overlay_ratio = 0.90" ], "i": "metadata/binary/layout::overlay-over-90pct", "l": 3 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 3.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 213.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.90" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 512.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "43129" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1140", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "Microsoft Corporation", "© Microsoft Corporation. All rights reserved." ], "i": "objectives/command-and-control/dropper/staging/encrypted::microsoft-company-string", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 3.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.8600000143051147, "d": "svchost target process name", "e": [ "svchost.exe" ], "i": "objectives/evasion/masquerade/dll/task-scheduler::svchost-target-name", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1071417432.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.15" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)", ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 217088.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "String claiming to be Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/identity/vendor::microsoft-corporation-string", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 3.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 7.99" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 441154.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "High entropy in data section", "e": [ ".data (entropy: 7.89)" ], "i": "metadata/binary/metrics/structural::high-entropy-data", "l": 1 }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".data (entropy: 7.89, perms: rw-)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Dynamic library loading via LoadLibraryA", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 11.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE has at most two functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::function-count-under-2", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.699999988079071, "d": "Large overlay relative to file", "e": [ "binary.overlay_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PE code-to-data ratio below 0.08", "e": [ "binary.code_to_data_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::code-data-ratio-below-008", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted data section (very high)", "e": [ ".data (entropy: 7.89)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 441154.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.90" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data (entropy: 7.89, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".data (entropy: 7.89)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-payload-section-cond-0--inline-29177", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links kernel32.dll (GetProcAddress, GetModuleHandleA, LoadLibraryA)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_entropy = 7.99", "binary.overlay_size = 441154.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00", "binary.has_signature = 0.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Binary with encrypted overlay payload", "e": [ "binary.has_overlay = 1.00", "binary.overlay_entropy = 7.99", "binary.overlay_size = 441154.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::binary-encrypted-overlay", "l": 4, "m": "B0032" } ], "sha": "f27a2a6ea6ebcadf5e06ccb5ff4f4d63dfcffa927c2fa822d895860fa2d26622", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/43129", "type": "pe" } ], "tv": "84923" } }