{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 1.0, "class": 2 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:58:40Z" }, "path": "32137", "raw": { "v": "4", "fs": [ { "f": "O₂(CAs)H(Cm)Md₂(BiSi)", "k": { "hash.imp": "dd70e7d15b9356dabeb2a38b28041b9d", "pe.timestamp": 1189436270, "hash.authenti": "cefb71cb908addf985c14364f5d3e38e65a55c9eeaae4d97e84acfe48254d6dc", "hash.rich_header": "e51bbc6bda604cdb88eda52ba3f965556d3f1d522976fda041b95a9abbf52c82", "build.target_arch": "x86", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_MENU", "pe.resource_types[2]": "RT_DIALOG", "pe.resource_types[3]": "RT_STRING", "pe.resource_types[4]": "RT_GROUP_ICON", "pe.resource_types[5]": "RT_VERSION", "pe.resource_types[6]": "RT_MANIFEST", "pe.rich_header.xor_key": "0x43023da9", "pe.manifest.description": "AutoIt v3", "pe.data_directories[0].rva": 653556, "pe.data_directories[1].rva": 626688, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 784, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 26868, "pe.rich_header_compids[0].count": 2, "pe.rich_header_compids[1].count": 36, "pe.rich_header_compids[2].count": 9, "pe.rich_header_compids[3].count": 192, "pe.rich_header_compids[4].count": 53, "pe.rich_header_compids[5].count": 27, "pe.rich_header_compids[6].count": 470, "pe.rich_header_compids[7].count": 55, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.rich_header_compids[0].compid": 8307863, "pe.rich_header_compids[1].compid": 8242727, "pe.rich_header_compids[2].compid": 6229955, "pe.rich_header_compids[3].compid": 7194151, "pe.rich_header_compids[4].compid": 7259687, "pe.rich_header_compids[5].compid": 6098883, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[7].compid": 7521831, "pe.rich_header_compids[8].compid": 8177191, "pe.rich_header_compids[9].compid": 7915047, "pe.version_info.file_description": "6\u000b\u0001Virus.Name.", "pe.rich_header_compids[6].product": "Unknown", "pe.manifest.assembly_identity.name": "AutoIt3", "pe.manifest.assembly_identity.type": "win32", "pe.section_characteristics[0].name": "UPX0", "pe.section_characteristics[1].name": "UPX1", "pe.section_characteristics[2].name": ".rsrc", "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.rich_header.entries[0].use_count": 2, "pe.rich_header.entries[1].use_count": 36, "pe.rich_header.entries[2].use_count": 9, "pe.rich_header.entries[3].use_count": 192, "pe.rich_header.entries[4].use_count": 53, "pe.rich_header.entries[5].use_count": 27, "pe.rich_header.entries[6].use_count": 470, "pe.rich_header.entries[7].use_count": 55, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.manifest.dependencies[0].language": "*", "pe.rich_header.entries[0].product_id": 126, "pe.rich_header.entries[1].product_id": 125, "pe.rich_header.entries[2].product_id": 95, "pe.rich_header.entries[3].product_id": 109, "pe.rich_header.entries[4].product_id": 110, "pe.rich_header.entries[5].product_id": 93, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 114, "pe.rich_header.entries[8].product_id": 124, "pe.rich_header.entries[9].product_id": 120, "pe.manifest.assembly_identity.version": "3.0.0.0", "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[0].build_number": 50327, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 50727, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 4035, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 50727, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 50727, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 4035, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 50727, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 50727, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 50727, "pe.rich_header.entries[9].product_name": "Cvtres_VS2008", "pe.section_characteristics[1].raw_size": 222208, "pe.section_characteristics[2].raw_size": 28160, "pe.section_characteristics[0].virtual_size": 397312, "pe.section_characteristics[1].virtual_size": 225280, "pe.section_characteristics[2].virtual_size": 28672, "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 401408, "pe.section_characteristics[2].virtual_address": 626688, "pe.section_characteristics[0].characteristics_hex": "e0000080", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.manifest.dependencies[0].processor_architecture": "*", "pe.manifest.assembly_identity.processor_architecture": "*" }, "x": 46, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "RegCloseKey", "ImageList_Remove", "GetSaveFileNameW", "LineTo", "WNetUseConnectionW", "CoInitialize", "ORDINAL 35", "DragFinish", "GetDC", "VerQueryValueW", "timeGetTime", "ORDINAL 19" ], "ms": { "pe": { "entry": 622992.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 28160.0, "subsystem": 2.0, "timestamp": 1189436270.0, "icon_count": 2.0, "image_base": 4194304.0, "has_manifest": true, "rsrc_entropy": 5.64, "entry_section": "UPX1", "size_of_image": 655360.0, "file_alignment": 512.0, "resource_count": 7.0, "resource_types": [ "RT_ICON", "RT_MENU", "RT_DIALOG", "RT_STRING", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "characteristics": 291.0, "has_rich_header": true, "overlay_padding": 7194.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 13.0, "computed_checksum": 317241.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 32768.0, "has_export_timestamp": false, "linker_major_version": 8.0, "bss_like_section_count": 1.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "api_hashing_indicator_count": 1.0, "entry_in_nonstandard_section": true }, "file": { "size": 261658.0 }, "binary": { "code_size": 222208.0, "func_count": 2.0, "has_overlay": true, "code_entropy": 3.96, "func_density": 0.01, "import_count": 18.0, "overlay_size": 10266.0, "string_count": 253.0, "avg_func_size": 224.5, "overlay_ratio": 0.04, "section_count": 3.0, "avg_complexity": 15.5, "import_density": 0.08, "max_complexity": 30.0, "string_density": 1.17, "overall_entropy": 4.52, "overlay_entropy": 7.97, "avg_basic_blocks": 28.0, "avg_section_size": 83456.0, "dependency_count": 13.0, "entropy_variance": 3.33, "wx_section_count": 2.0, "avg_string_length": 9.09, "complexity_per_kb": 0.07, "max_string_length": 73.0, "wide_string_count": 7.0, "avg_string_entropy": 2.55, "code_to_data_ratio": 7.89, "rsrc_to_file_ratio": 0.11, "total_basic_blocks": 56.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 9.13, "largest_section_ratio": 0.85, "sentence_string_count": 5.0, "sentence_string_ratio": 0.02, "writable_section_count": 3.0, "behavioral_import_ratio": 0.22, "entry_in_writable_region": true, "executable_section_count": 2.0, "nonstandard_section_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, "UPX0" ], [ 536, "UPX1" ], [ 576, ".rsrc" ], [ 987, "3.00" ], [ 1836, "/ECP" ], [ 2663, "J5A3" ], [ 3352, "AX9E" ], [ 7614, "Rhhph" ], [ 8254, "V8R 4" ], [ 11391, "HK56" ], [ 14372, "W49H" ], [ 14849, "N8JN" ], [ 15965, "j4ont" ], [ 17177, "DAPXO" ], [ 17346, "B6SX" ], [ 20598, "Kn.x" ], [ 23065, "KV4W" ], [ 24174, "Q4W3" ], [ 24308, "NBWB" ], [ 26355, "BA81" ], [ 27265, "hF@GG.r" ], [ 27449, "UH8L" ], [ 27620, "H24V" ], [ 34089, "/Qmj" ], [ 34970, "aiqye" ], [ 35214, "i5u6" ], [ 36447, "/WPS" ], [ 38320, "FP_P" ], [ 42350, "4PDH" ], [ 44197, "71QDYH" ], [ 49472, "W_1X" ], [ 52546, "E SwJPQ" ], [ 53766, "Q739" ], [ 56015, "QHK8" ], [ 59165, "FF1R" ], [ 59708, "CGS8" ], [ 67636, "oV.h@i" ], [ 69405, "UYPX" ], [ 69793, "Shdh" ], [ 73048, "F444" ], [ 74061, "h2te" ], [ 75175, "ZT02" ], [ 78571, "HPXQ" ], [ 82603, "W0W3" ], [ 93278, "XGVS" ], [ 93554, "54 p" ], [ 96243, "sY,Jj[u0kZ_NW" ], [ 97459, "Mbup" ], [ 97755, "Q0H_" ], [ 98388, "LLA0G" ], [ 100120, "SYW3" ], [ 101477, "ZWPF" ], [ 103163, "HD0N" ], [ 103426, "7G5I" ], [ 106682, "IHCM" ], [ 109231, "l38j" ], [ 111600, "40AF" ], [ 114637, "Nzfh" ], [ 115570, "CCXNK" ], [ 117789, "YP2U" ], [ 118994, "Rdni" ], [ 120324, "WDWK" ], [ 121846, "RG7Q" ], [ 126988, "96QQ" ], [ 129735, "w9576" ], [ 134769, "g73u" ], [ 135509, "euan" ], [ 135672, "YA3PD" ], [ 137574, "62OJ" ], [ 140809, "ERCP" ], [ 141668, "LWD9" ], [ 145130, "PQRJL" ], [ 152780, "GOJBN" ], [ 154503, "2ENI" ], [ 155736, "O wn" ], [ 156481, "ev53" ], [ 156797, "AU0P" ], [ 161009, "XLJW" ], [ 162490, "7J3V" ], [ 163370, "Elehmd" ], [ 164362, "Apam" ], [ 164851, "BESA" ], [ 168006, "WR06Y" ], [ 169436, "4MYYW" ], [ 169685, "46SI" ], [ 170637, "OuN\u003c\u003c" ], [ 173604, "GCRS" ], [ 174623, "f9.6" ], [ 174749, "/2QF" ], [ 175555, "B2 X" ], [ 179559, "NKMJ" ], [ 180730, "3R8B" ], [ 181631, "QW_J" ], [ 182701, "4PWY" ], [ 185591, "UHXF" ], [ 187622, "PX2WJ" ], [ 193684, "WSYG" ], [ 195102, "V2\u003et4vAK" ], [ 198579, "FP1SW" ], [ 199995, "?IsDebuggerPresentnumb" ], [ 200022, "is too big" ], [ 200050, "cognized/with an" ], [ 200075, "zWsupportT" ], [ 200110, "followb" ], [ 200179, "toNEWLI" ], [ 200383, "maxi" ], [ 200776, "R[+-]digits" ], [ 201211, "THEN" ], [ 201216, "SKIPPRUN" ], [ 201229, "FAIL2COMMITa" ], [ 201245, "ACCEP" ], [ 201536, "anaelugua" ], [ 201552, "i_Legb@M." ], [ 201683, "lkoew_" ], [ 201772, "Zosh" ], [ 201827, "Gurmuk" ], [ 201859, "eorg" ], [ 202584, "jklmn%" ], [ 202594, "qrstuvwxyz[\\V" ], [ 202771, "GHIJKLMNO\\ll" ], [ 203090, "scopo" ], [ 203125, ".mixc" ], [ 203244, "SING" ], [ 203742, "la jTzZ.a" ], [ 203904, "506X" ], [ 203935, "to1bpx" ], [ 205295, "owStI.U" ], [ 205342, "ageBoxbUSE[" ], [ 205504, "Type" ], [ 205677, "RTTI" ], [ 206216, "RR7H" ], [ 206351, "Xura" ], [ 206498, ".gux" ], [ 206893, "ow64" ], [ 207282, "d7c8" ], [ 207307, "evS.WINU0%" ], [ 207363, "_XBUTTON2" ], [ 207388, "NCH_APP2" ], [ 207435, "PREVNEXT" ], [ 207444, "VOLUM" ], [ 207478, "FAJRTIES'" ], [ 207516, "BACK_" ], [ 207595, "7654" ], [ 207661, "34GHTGG2" ], [ 207803, "Input" ], [ 208157, "YwlJ=7EwD'UJwh{" ], [ 208216, "Toolhelp" ], [ 208469, "LNDWK" ], [ 208580, "EA0602X/" ], [ 208672, "GKF2" ], [ 209858, "/GAA0Q" ], [ 210982, "t/rjkkw" ], [ 211085, "CngDisk" ], [ 211131, "Recyc" ], [ 211759, "Icmp" ], [ 212164, "/cji" ], [ 213693, "D8BW" ], [ 213738, "Moni" ], [ 213931, "/qJi" ], [ 214714, "sinu" ], [ 216458, "/Mli" ], [ 216918, "h.h,v 1.1 2004" ], [ 216941, "9:50:3" ], [ 217227, "bcdefgy" ], [ 217236, "yhijkm" ], [ 217677, "2cla" ], [ 217849, "eODSCcFYxp(Gd" ], [ 219688, "Copy" ], [ 219776, "y03k" ], [ 220481, "Fjsh" ], [ 220490, "Buff" ], [ 221194, "eamOnHi" ], [ 221579, "ipboa" ], [ 221612, "2RGT" ], [ 221710, "4NQW" ], [ 223013, "XPTPSW" ], [ 224680, "wwwwwwwwwwwp" ], [ 227645, "bb`_ywwttus" ], [ 227693, "aSSQRMONKLef|{zz" ], [ 227889, "74tv" ], [ 228557, "2AAA@??\u003e\u003e\u003c[[88WW1/USb" ], [ 228605, "2211/U.RTONPL-ffJJdcb" ], [ 230841, "ZQO2PLKJ`_lk" ], [ 231259, "\u003c;U:987654SRQ~" ], [ 231289, "++)'HG\u0026FEDBA@\\[" ], [ 232632, "ysrqpnlj?i=" ], [ 232648, "0{PQMJIFCB\u003e" ], [ 232679, "uV4VW2TRzLGk" ], [ 248758, "wide", "VS_VERSION_INFO" ], [ 248850, "wide", "StringFileInfo" ], [ 248910, "wide", "FileDescription" ], [ 248950, "wide", "Virus.Name." ], [ 249006, "wide", "Nuyer........." ], [ 249102, "wide", "VarFileInfo" ], [ 249134, "wide", "Translation" ], [ 249168, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 249225, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 249300, "\u003cassemblyIdentity" ], [ 249320, "type=\"win32\"" ], [ 249339, "processorArchitecture=\"*\"" ], [ 249371, "version=\"3.0.0.0\"" ], [ 249421, "\u003cdescription\u003eAutoIt v3\u003c/description\u003e" ], [ 249462, "\u003c!-- Identify the application security requirements. --\u003e" ], [ 249521, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\"\u003e" ], [ 249576, "\u003csecurity\u003e" ], [ 249590, "\u003crequestedPrivileges\u003e" ], [ 249616, "\u003crequestedExecutionLevel" ], [ 249646, "level=\"asInvoker\"" ], [ 249670, "uiAccess=\"false\"/\u003e" ], [ 249695, "\u003c/requestedPrivileges\u003e" ], [ 249722, "\u003c/security\u003e" ], [ 249737, "\u003c/trustInfo\u003e" ], [ 249754, "\u003c!-- Identify the application dependencies. --\u003e" ], [ 249804, "\u003cdependency\u003e" ], [ 249819, "\u003cdependentAssembly\u003e" ], [ 249882, "name=\"Microsoft.Windows.Common-Controls\"" ], [ 249928, "version=\"6.0.0.0\"" ], [ 249951, "language=\"*\"" ], [ 250000, "publicKeyToken=\"6595b64144ccf1df\"" ], [ 250046, "\u003c/dependentAssembly\u003e" ], [ 250070, "\u003c/dependency\u003e" ], [ 250086, "\u003c/assembly\u003e" ], [ 250504, "KERNEL32.DLL" ], [ 250517, "ADVAPI32.dll" ], [ 250530, "COMCTL32.dll" ], [ 250543, "comdlg32.dll" ], [ 250556, "GDI32.dll" ], [ 250566, "MPR.dll" ], [ 250574, "ole32.dll" ], [ 250584, "OLEAUT32.dll" ], [ 250597, "SHELL32.dll" ], [ 250609, "USER32.dll" ], [ 250620, "VERSION.dll" ], [ 250632, "WINMM.dll" ], [ 250642, "WSOCK32.dll" ], [ 250656, "LoadLibraryA" ], [ 250670, "GetProcAddress" ], [ 250686, "VirtualProtect" ], [ 250702, "VirtualAlloc" ], [ 250716, "VirtualFree" ], [ 250730, "ExitProcess" ], [ 250744, "RegCloseKey" ], [ 250758, "ImageList_Remove" ], [ 250776, "GetSaveFileNameW" ], [ 250802, "WNetUseConnectionW" ], [ 250822, "CoInitialize" ], [ 250836, "DragFinish" ], [ 250856, "VerQueryValueW" ], [ 250872, "timeGetTime" ], [ 253530, "VXDN" ], [ 259264, "Owtk" ], [ 261385, "AU3!EA06276957785817268" ] ], "sz": 261658, "ts": [ { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1204", "c": 0.699999988079071, "d": "Virus reference", "e": [ "Virus" ], "i": "micro-behaviors/data/text/malware/terms::virus-marker", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.52" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 655360.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"language\":\"*\",\"processor_architecture\":\"*\",\"pub" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "32137" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.55" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "PREVNEXT", "SKIPPRUN" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.55" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 19 (send)", "e": [ "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-19", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "timeGetTime multimedia timing", "e": [ "timeGetTime" ], "i": "micro-behaviors/time/timing/check::timegettime", "l": 2, "m": "B0003.003" }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "publicKeyToken=\"6595b64144ccf1df\"" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "6\u000b\u0001Virus.Name." ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"type\":\"win32\",\"processor_architecture\":\"*\",\"version\":\"3.0.0.0\",\"name\":\"AutoIt3\"},\"description\":\"AutoIt v3" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 1.0, "d": "virus word", "e": [ "Virus" ], "i": "objectives/impact/infect/lexicon::virus-word", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 7.97" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.52" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.85" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 253.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1189436270.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.9599999785423279, "d": "Compact RWX UPX1 payload section", "e": [ "UPX1 (size: 222208, entropy: 7.93, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::compact-rwx-upx1", "l": 4 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 18.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 222208, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "c": 0.7200000286102295, "d": "WSOCK32 Winsock DLL import", "e": [ "WSOCK32.dll" ], "i": "micro-behaviors/communications/socket/init::wsock32-dll-marker", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 18.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 32768.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.85" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links SHELL32.dll (DragFinish)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (LineTo)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WSOCK32.dll (ORDINAL 19)", "e": [ "WSOCK32.dll" ], "i": "metadata/dylib::wsock32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (ImageList_Remove)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comdlg32.dll (GetSaveFileNameW)", "e": [ "comdlg32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINMM.dll (timeGetTime)", "e": [ "WINMM.dll" ], "i": "metadata/dylib::winmm/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 35)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MPR.dll (WNetUseConnectionW)", "e": [ "MPR.dll" ], "i": "metadata/dylib::mpr/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDC)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/strings::misleading-upx-sections", "l": 1 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "UPX0", "binary.func_count = 2.00", "UPX1", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "pe.entry_in_nonstandard_section = 1.00" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00", "binary.has_signature = 0.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 2, "m": "B0032" } ], "sha": "f27e22dcd52d663f41e4e5e382e99ed81a8fb4a131880d8765085ec5b7017a51", "path": "32137", "type": "pe" } ], "tv": "46790" } }