{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.72237444, "class": 0 }, { "m": "az/pe", "prob": 0.020304568, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T12:10:27Z" }, "path": "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe", "raw": { "v": "5", "fs": [ { "f": "O(Dy)H(Po)", "x": 10, "ff": { "i": [ [ "kernel32", "AcquireSRWLockExclusive" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "CompareStringW" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "CreateThread" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "EnumSystemLocalesW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "ExitThread" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindFirstFileExW" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "FlsAlloc" ], [ "kernel32", "FlsFree" ], [ "kernel32", "FlsGetValue" ], [ "kernel32", "FlsSetValue" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "FreeLibraryAndExitThread" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "GetConsoleOutputCP" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "GetExitCodeThread" ], [ "kernel32", "GetFileSizeEx" ], [ "kernel32", "GetFileType" ], [ "kernel32", "GetLastError" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetModuleHandleExW" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapFree" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "HeapSize" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "InitializeCriticalSectionEx" ], [ "kernel32", "InitializeSListHead" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "LCMapStringEx" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "QueryPerformanceFrequency" ], [ "kernel32", "RaiseException" ], [ "kernel32", "ReadConsoleW" ], [ "kernel32", "ReadFile" ], [ "kernel32", "ReleaseSRWLockExclusive" ], [ "kernel32", "RtlCaptureContext" ], [ "kernel32", "RtlLookupFunctionEntry" ], [ "kernel32", "RtlPcToFileHeader" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "RtlUnwindEx" ], [ "kernel32", "RtlVirtualUnwind" ], [ "kernel32", "SetEndOfFile" ], [ "kernel32", "SetEnvironmentVariableW" ], [ "kernel32", "SetFilePointerEx" ], [ "kernel32", "SetLastError" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "Sleep" ], [ "kernel32", "SleepConditionVariableSRW" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsFree" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TryAcquireSRWLockExclusive" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "WaitForSingleObjectEx" ], [ "kernel32", "WakeAllConditionVariable" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "WriteFile" ] ], "m": { "pe": { "has_cfg": 0.0, "checksum": 5356379.0, "has_manifest": 1.0, "checksum_valid": 1.0, "resource_count": 2.0, "has_version_info": 1.0, "computed_checksum": 5356379.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 11.0, "base_relocation_entry_count": 1207.0 }, "file": { "size": 5298176.0, "entropy": 7.81, "size_bytes": 5298176.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.9, "data_entropy": 2.79, "string_count": 48281.0, "entropy_variance": 2.08, "avg_string_length": 4.81, "max_string_length": 1168.0, "code_to_data_ratio": 1.0, "string_length_stddev": 5.75, "largest_section_ratio": 0.66, "sentence_string_count": 101.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 3.0 }, "imports": { "count": 98.0 }, "sections": { "count": 9.0, "code_size": 1700352.0, "entropy_max": 8.0, "entropy_mean": 5.26, "name_entropy": 3.87, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 3.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode.$" ], [ 384, "u8", ".text" ], [ 463, "u8", "@.data" ], [ 504, "u8", ".pdata" ], [ 543, "u8", "@.gxfg" ], [ 623, "u8", "@.reloc" ], [ 663, "u8", "B.tcp" ], [ 703, "u8", "@.rsrc" ], [ 1536, "u8", "AWAVAUATVWUSH" ], [ 14768, "u8", "UAWAVAUATVWSH" ], [ 15554, "u8", "40fk" ], [ 79232, "u8", "VWSH" ], [ 79372, "u8", "3e u" ], [ 641008, "u8", "UAVVWSH" ], [ 642658, "u8", "uzLi" ], [ 650331, "u8", "8GQC" ], [ 667159, "u8", "I X7" ], [ 699239, "u8", "w2p1" ], [ 699407, "u8", "WQGL" ], [ 699611, "u8", "vpXw" ], [ 701813, "u8", "jmCu" ], [ 706366, "u8", "/aZa" ], [ 711056, "u8", "DRpFvzrP" ], [ 711135, "u8", "4zg9GjwD" ], [ 711251, "u8", "G49V" ], [ 711309, "u8", "FCOW" ], [ 711546, "u8", "qJkm" ], [ 711715, "u8", "ZW_9" ], [ 715792, "u8", "QSGZ" ], [ 715919, "u8", "GJGI" ], [ 719568, "u8", "O5GQ" ], [ 719662, "u8", "AFHE" ], [ 719817, "u8", "ghUh" ], [ 719869, "u8", "rrVv" ], [ 719901, "stack", "7\\G(" ], [ 719945, "u8", "abpe" ], [ 720387, "u8", "hi1q" ], [ 720457, "stack", "^aw2" ], [ 723328, "u8", "AVVWUSH" ], [ 730296, "u8", "3BOJ" ], [ 730442, "u8", "Sy}[" ], [ 730638, "stack", "wGMr" ], [ 730670, "u8", "AQ_8" ], [ 730965, "stack", "u[58" ], [ 745440, "stack", "_.Fu" ], [ 745486, "u8", "zFak" ], [ 745555, "u8", "W4E8" ], [ 747506, "u8", "Bgle" ], [ 747550, "u8", "acPa" ], [ 747775, "u8", "2azb" ], [ 747794, "u8", "Q4DA" ], [ 747832, "u8", "FF6A" ], [ 747986, "stack", "PQ?0" ], [ 782784, "u8", "AVVWSH" ], [ 806016, "u8", "UVPH" ], [ 813999, "u8", "lz42" ], [ 814054, "stack", "#D\\3" ], [ 814133, "u8", "H_21" ], [ 814214, "u8", "/Cqe" ], [ 814284, "u8", "kvRd" ], [ 814447, "u8", "NDTV" ], [ 825189, "stack", "u)A," ], [ 827931, "u8", "\u003e+!~lw`;:#iV" ], [ 828041, "u8", "/6Gh" ], [ 829682, "u8", "PS\u003c\u003c" ], [ 829694, "u8", "zd.o" ], [ 829842, "stack", "w(w'" ], [ 829849, "u8", "8GWD" ], [ 846694, "u8", "DRSW" ], [ 856960, "u8", "VWUSH" ], [ 871640, "u8", "SR3N" ], [ 871729, "stack", "rBc@" ], [ 874304, "u8", "8r1j" ], [ 874405, "u8", "JK_R" ], [ 874421, "u8", "G4S_" ], [ 874462, "u8", "ZVVD" ], [ 874562, "u8", "H 62" ], [ 874812, "u8", "gozqoDsc" ], [ 875146, "u8", "fXig" ], [ 875277, "u8", "EMHP" ], [ 875326, "stack", "Dw\u003eL" ], [ 875455, "u8", "XXBV" ], [ 875584, "u8", "ykkr75bD" ], [ 896337, "u8", "E50W" ], [ 904978, "u8", "9w2t" ], [ 931368, "u8", "wz1aL" ], [ 955723, "u8", "Kful" ], [ 960981, "u8", "DTBA" ], [ 980952, "u8", "Z0MA" ], [ 994410, "u8", "n2se" ], [ 1021556, "u8", "a9u1" ], [ 1025600, "u8", "UVWSH" ], [ 1037205, "u8", "O jp" ], [ 1037536, "u8", "heOf" ], [ 1049896, "u8", "2VGI" ], [ 1051470, "u8", "xo6e" ], [ 1051523, "stack", "gjg9" ], [ 1064841, "stack", "]m:B" ], [ 1092396, "u8", "t8 z" ], [ 1094600, "u8", "pRcu" ], [ 1112154, "u8", "lKeqD" ], [ 1112162, "stack", "lKeq" ], [ 1112743, "u8", "kKeq" ], [ 1113315, "u8", "lKeq" ], [ 1120521, "u8", "L$(H)" ], [ 1152647, "u8", "73JUA" ], [ 1154905, "u8", "F5_Z" ], [ 1173444, "u8", "uv3u" ], [ 1189817, "u8", "M8H1" ], [ 1195918, "u8", "yv}{" ], [ 1224689, "u8", "CMFK" ], [ 1244444, "u8", "aNsr" ], [ 1282876, "u8", "hHgi" ], [ 1293518, "u8", "Vtie" ], [ 1293570, "u8", "v7 5" ], [ 1293585, "u8", "7u4i" ], [ 1293927, "u8", "EAL1" ], [ 1294143, "u8", "L15P" ], [ 1332916, "u8", "guHv" ], [ 1332960, "u8", "Qovn" ], [ 1334824, "u8", "M9YV" ], [ 1335014, "u8", "/1mr" ], [ 1335049, "u8", "jPpr" ], [ 1335206, "u8", "Lxwe" ], [ 1335221, "u8", "K4OG" ], [ 1335288, "stack", "KKC=" ], [ 1335323, "u8", "2eed" ], [ 1335428, "u8", "EE2J" ], [ 1335483, "u8", "ccJj" ], [ 1335553, "u8", "tRti" ], [ 1335623, "u8", "twUe" ], [ 1335638, "u8", "6h2e" ], [ 1335693, "u8", "ZTZ7" ], [ 1335865, "u8", "cNup" ], [ 1336180, "u8", "56bd" ], [ 1336232, "u8", "cu.c" ], [ 1336375, "stack", "'R\\x" ], [ 1336538, "stack", "|jw`" ], [ 1422396, "u8", "EYRM" ], [ 1422740, "u8", "7b8t" ], [ 1423004, "u8", "/Xkh" ], [ 1423178, "u8", "euWq" ], [ 1423381, "u8", "PPJF" ], [ 1444712, "u8", "bifu" ], [ 1445657, "stack", "ACf%" ], [ 1495697, "u8", "GTTA" ], [ 1506390, "stack", "U*OD" ], [ 1506504, "stack", "/\"9'" ], [ 1534567, "u8", "uxHc" ], [ 1536557, "u8", "UVWH" ], [ 1536969, "u8", "x AVH" ], [ 1539593, "u8", "x ATAVAWH" ], [ 1540519, "u8", "t$ UWAVH" ], [ 1540991, "u8", "taL9Chu" ], [ 1541721, "u8", "MOH3" ], [ 1542072, "u8", "t$ WAVAWH" ], [ 1542262, "u8", "VWAVH" ], [ 1543797, "u8", "tpH91uk" ], [ 1544658, "u8", "t59o" ], [ 1546067, "u8", "l$ VWAVH" ], [ 1547102, "u8", "UWAVH" ], [ 1547125, "stack", "ineIntel" ], [ 1547128, "u8", "ineIA" ], [ 1547135, "u8", "ntelD" ], [ 1547160, "stack", "Genu" ], [ 1547163, "u8", "Genu" ], [ 1549208, "u8", "sH9.tgH" ], [ 1552081, "u8", "x AVD" ], [ 1556929, "u8", "s WATAUAVAWH" ], [ 1559326, "u8", "N0E3" ], [ 1564847, "u8", "HcC H" ], [ 1564893, "u8", "x UAVAWH" ], [ 1565328, "u8", "@USVWATAVAWH" ], [ 1568988, "u8", "|$ UATAUAVAWH" ], [ 1577092, "u8", "@USVWATAUAVAWH" ], [ 1578256, "u8", "L$ SUVWH" ], [ 1578874, "u8", "\\$ UVWATAUAVAWH" ], [ 1581961, "u8", "UVWATAUAVAWH" ], [ 1585749, "u8", "xOHcC" ], [ 1590867, "u8", "L$ VWAVH" ], [ 1592325, "u8", "p AWH" ], [ 1592515, "u8", "L$ UVWATAUAVAWH" ], [ 1594486, "u8", "HcS H" ], [ 1595344, "u8", "t$ WATAUAVAWH" ], [ 1595908, "u8", "E0E3" ], [ 1597087, "u8", "t$ UWAUAVAWH" ], [ 1603304, "u8", "tRLcY" ], [ 1604044, "u8", "wwH9Q" ], [ 1604124, "u8", "D$ I9P" ], [ 1604611, "u8", "IH9B" ], [ 1604616, "u8", "tEHcR" ], [ 1605119, "u8", "SVWATAUAVAWH" ], [ 1605652, "u8", "@SVWATAUAVAWH" ], [ 1610653, "u8", "HcK H" ], [ 1612438, "u8", "HcO H" ], [ 1612508, "u8", "HcG H" ], [ 1613442, "u8", "E E3" ], [ 1614716, "u8", "t1Lcc" ], [ 1616446, "u8", "wAtx" ], [ 1622216, "u8", "@SUVWATAVAWH" ], [ 1623052, "u8", "@UATAUAVAWH" ], [ 1625223, "u8", "l$ VWATAVAWH" ], [ 1629349, "u8", "tnHc" ], [ 1630317, "u8", "{ AUAVAWH" ], [ 1630634, "u8", "80tWD" ], [ 1630695, "u8", "gfffA" ], [ 1632152, "u8", "gfffffffH" ], [ 1632813, "u8", "s AWH" ], [ 1640798, "u8", "VWAUH" ], [ 1641016, "u8", "um9k" ], [ 1641803, "u8", "fB94Ou" ], [ 1643580, "u8", "ufD9v" ], [ 1643628, "u8", "fD94Au" ], [ 1643798, "u8", "fD94iu" ], [ 1644610, "u8", "tSf91tNH" ], [ 1645686, "u8", "fD91uTL9r" ], [ 1646392, "u8", "@USVWATAUAVH" ], [ 1649223, "u8", "f90t" ], [ 1649598, "u8", "tUH95" ], [ 1649733, "u8", "H95T" ], [ 1649769, "u8", "H950" ], [ 1649880, "u8", "xWI96tRI" ], [ 1650088, "u8", "C847u" ], [ 1655570, "u8", "VWAV" ], [ 1659037, "u8", "8HtyB" ], [ 1659506, "u8", "fA90u" ], [ 1672529, "u8", "vyfffff" ], [ 1672560, "u8", "ob0f" ], [ 1676963, "u8", "svDE3" ], [ 1681938, "u8", "L$ fff" ], [ 1688541, "u8", "s WAVAWH" ], [ 1693761, "u8", "M0H3" ], [ 1694502, "u8", "iygE3" ], [ 1695927, "u8", "USVWAVH" ], [ 1699313, "u8", "vKfffff" ], [ 1702576, "u8", "iostream stream error" ], [ 1707248, "u8", "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 1709264, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 1709648, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 1711023, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 1713173, "u8", "obwQ4" ], [ 1718968, "u8", "UTF-16LEUNICODE" ], [ 1727393, "u8", "TUUUU" ], [ 1736146, "u8", "bad cast" ], [ 1736155, "u8", "invalid vector subscript" ], [ 1736180, "u8", "ios_base::failbit set" ], [ 1736202, "u8", "ios_base::eofbit set" ], [ 1736223, "u8", "ios_base::badbit set" ], [ 1736247, "u8", "Unknown exception" ], [ 1736265, "u8", "invalid string position" ], [ 1736289, "u8", "iostream" ], [ 1736298, "u8", "bad array new length" ], [ 1736319, "u8", "vector too long" ], [ 1736335, "u8", "string too long" ], [ 1736351, "u8", "true" ], [ 1736356, "u8", "false" ] ], "v": { "file.stem": "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb", "pe.imphash": "500697a5eb94c2fffe714893c0005bdc", "pe.machine": "x86_64", "pe.subsystem": "windows_cui", "pe.timestamp": 1749666018, "file.basename": "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe", "pe.image_base": 5368709120, "pe.image_size": 5341184, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.version.os": "windows_nt_windows32", "pe.entry_point": 1553520, "pe.headers_size": 1536, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.image_hash.sha1": "7ff07476d051ac30f49f26d586c94991f323b973", "pe.version.company": "Microsoft Corporation", "pe.load_config.size": 320, "pe.image_hash.sha256": "fcc27f195c805271920ec1ea9911e6a0a20263cc2340dc039ee0def090b240e9", "pe.image_hash.sha384": "397628cf685e3a444f28289fcd74e164d0853e20db3ef766bee9461f5c599aebafeb3e514de1498e888eda1a99c4155a", "pe.image_hash.sha512": "9e2414fa8c8df4e46a7a44c6c15a8b8423a862ff22e6f3c0eaeb73900726b31666a05a78829843ed0c49fe11f98570f81c6d46a57d5a09dcababcb1e33ce1edb", "pe.resource_types[0]": "RT_VERSION", "pe.resource_types[1]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.version.copyright": "© Microsoft Corporation. All rights reserved.", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.manifest.dpi_aware": "true", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 34, "pe.version.description": "winrs", "pe.inflated_sections[0]": "_RDATA", "pe.linker_major_version": 14, "pe.manifest.description": "Windows Shell", "pe.version.file_version": "10.0.19041.1 (WinBuild.160101.0800)", "pe.version.product_name": "Microsoft® Windows® Operating System", "pe.version.internal_name": "winrs.exe", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 1758256, "pe.data_directories[1].rva": 5337088, "pe.data_directories[2].rva": 1789952, "pe.data_directories[3].rva": 1830912, "pe.data_directories[4].rva": 1740176, "pe.data_directories[5].rva": 1713552, "pe.data_directories[6].rva": 1759088, "pe.dll_characteristics_raw": 33120, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "10.0.19041.1", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2210, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 12852, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 2516, "pe.data_directories[4].name": "tls", "pe.data_directories[4].size": 40, "pe.data_directories[5].name": "load_config", "pe.data_directories[5].size": 320, "pe.data_directories[6].name": "iat", "pe.data_directories[6].size": 792, "pe.manifest.dependencies[0]": "Microsoft.Windows.Common-Controls@6.0.0.0", "pe.version.original_filename": "winrs.exe", "pe.coff.dos_header_pe_pointer": 120, "pe.load_config.security_cookie": 5370483584, "pe.base_relocations.block_count": 11, "pe.base_relocations.entry_count": 1207, "pe.base_relocations.padding_count": 7, "pe.manifest.assembly_identity.name": "Microsoft.Windows.Shell.runonce", "pe.manifest.assembly_identity.version": "5.1.0.0", "pe.manifest.requested_execution_level": "asInvoker", "pe.load_config.guard_cf_check_function_pointer": 5370467056, "pe.load_config.guard_cf_dispatch_function_pointer": 5370467064 }, "id": "pe", "sc": [ [ ".text", 1536, 1700352, 6.9, "r-x" ], [ ".rdata", 1701888, 64512, 4.96, "r--" ], [ ".data", 1766400, 5120, 2.79, "rw-" ], [ ".pdata", 1771520, 13312, 5.74, "r--" ], [ ".gxfg", 1784832, 9216, 5.05, "r--" ], [ "_RDATA", 1794048, 512, 4.22, "r--" ], [ ".reloc", 1794560, 2560, 5.42, "r--" ], [ ".tcp", 1797120, 3498496, 8.0, "r--" ], [ ".rsrc", 5295616, 2560, 4.29, "r--" ] ] }, "id": 0, "sz": 5298176, "ts": [ { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 48281.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "0x1ad858" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x50cf8a" ] }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x179ce0" ] }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock release", "e": [ "ReleaseSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-release", "l": 2, "el": [ "0x1ad9a8" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 48281.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "0x1ada40" ] }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2, "el": [ "0x1ad898" ] }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2, "el": [ "0x1ad790" ] }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2, "el": [ "0x1ad8d8" ] }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2, "el": [ "0x1ad8b0" ] }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-core-string-l1-1-0", "api-ms-", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-file-l1-2-4", "api-ms-win-core-sysinfo-l1-2-1" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1, "el": [ "0x1ab780", "0x1ab7d8", "0x1ab680", "0x1ab900", "0x1ab9f0", "0x1ab810", "0x1ab860", "0x1ab6c0", "0x1ab740", "0x1ab8b0", "0x1ab608", "0x1ab700", "0x1aba40", "0x1ab940", "0x1ab590", "0x1ab640" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "10.0.19041.1 (WinBuild.160101.0800)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8500000238418579, "d": "Inline MZ header validation constant", "e": [ "B8 4D 5A 00 00" ], "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "l": 1, "el": [ "0x176a5b" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5120)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0x50d532" ] }, { "a": "T1497.003", "c": 0.699999988079071, "d": "QueryPerformanceFrequency timing", "e": [ "QueryPerformanceFrequency" ], "i": "micro-behaviors/time/timing/check::query-performance-frequency", "l": 2, "m": "B0003.003", "el": [ "0x1ad988" ] }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2, "el": [ "0x1ad8e8" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2, "el": [ "0x1ad9d0" ] }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x1ad8b8" ] }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2, "el": [ "0x1ad7d0" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1129", "c": 0.6499999761581421, "d": "Condition variable wait", "e": [ "SleepConditionVariableSRW" ], "i": "micro-behaviors/process/threading/advanced-sync::condition-variable-wait", "l": 2, "el": [ "0x1ada18" ] }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0x1ac52e" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x1a8a70" ] }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock acquisition", "e": [ "AcquireSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-acquire", "l": 2, "el": [ "0x1ad770" ] }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "0x1ada70" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2, "el": [ "0x1ad850" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x1ad900" ] }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "0x1ad848" ] }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2, "el": [ "0x1ad7c8" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x50cea6" ] }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x1ad7b0" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x1ad908" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x50d249" ] }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2, "el": [ "0x1ad9b0" ] }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2, "el": [ "0x1ad7b8" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x1ada10" ] }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "0x1ad9f8" ] }, { "a": "T1027.002", "c": 0.8999999761581421, "d": "CorExitProcess decoy string", "e": [ "CorExitProcess" ], "i": "well-known/malware/trojan/guloader::corexitprocess-decoy", "l": 1, "m": "F0001", "el": [ "0x1a8698" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x1ad838", "0x1ad840" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x1aa168" ] }, { "c": 0.9700000286102295, "d": "Microsoft ImageHlp company metadata", "e": [ "Microsoft Corporation" ], "i": "well-known/lib/microsoft-imagehlp::imagehlp-company", "l": 2, "el": [ "value:pe.version.company" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x1ac58e" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "winrs" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "0x1ac51c" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2, "el": [ "0x1ad9c0" ] }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 98.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1, "el": [ "0x1a0cf0" ] }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "0x1ad8a0" ] }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2, "el": [ "0x1ad930" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x1ad910" ] }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2, "el": [ "0x1ac332", "0x1a84b0" ] }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "0x1ad860" ] }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2, "el": [ "0x1ac2d2" ] }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004", "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2, "el": [ "0x1ada00" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x1ad8a8" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"Microsoft.Windows.Shell.runonce\",\"vers" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 98.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x50d0da" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2, "el": [ "0x1ada28" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2, "el": [ "0x1ad9d8" ] }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2, "el": [ "0x1ad960" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.90)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2, "el": [ "0x1ad9e0" ] }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2, "el": [ "0x1ad9c8" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x1ada38" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 48281.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x1a8ba0" ] }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2, "el": [ "0x1ad7e0" ] }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1, "el": [ "0x18be2a" ] }, { "c": 0.9800000190734863, "d": "GetFileSizeEx import symbol", "e": [ "GetFileSizeEx" ], "i": "metadata/binary/symbols/imports::getfilesizeex-import", "l": 1, "el": [ "0x1ad880" ] }, { "a": "T1027.002", "c": 0.8799999952316284, "d": "Unknown exception decoy string", "e": [ "Unknown exception" ], "i": "well-known/malware/trojan/guloader::unknown-exception-decoy", "l": 1, "m": "F0001", "el": [ "0x1a7e37" ] }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionEx", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x1ad928", "0x1ad920" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x1ad788" ] }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2, "el": [ "0x1ad7f8" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "0x1ad8a0" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "0x1ad868" ] }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x1ada08" ] }, { "c": 0.8500000238418579, "d": "Locale-aware string mapping", "e": [ "LCMapStringEx" ], "i": "micro-behaviors/os/env/access::lcmap-string-ex", "l": 2, "el": [ "0x1ad958" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x1ac2a4" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x50d040" ] }, { "c": 0.9599999785423279, "d": "Microsoft company metadata", "e": [ "Microsoft Corporation" ], "i": "well-known/app/drivers::microsoft-company", "l": 2, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "0x1ad870" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "0x1ada30" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x1ad7c0" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x1ad8d0" ] }, { "c": 1.0, "d": "GUI binary declares DPI awareness", "e": [ "true" ], "i": "metadata/build/manifest::pe-dpi-aware", "l": 2, "el": [ "value:pe.manifest.dpi_aware" ] }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2, "el": [ "0x1ad888" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2, "el": [ "0x1ad7f0" ] }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2, "el": [ "0x1ad800" ] }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "0x1ada50" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x50cf3e" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x1ad7a0" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.90" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2, "el": [ "0x1ad9a0" ] }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2, "el": [ "0x1ad9f0" ] }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2, "el": [ "0x1ac72e" ] }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[Microsoft.Windows.Common-Controls@6.0.0.0]" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2, "el": [ "value:pe.manifest.dependencies" ] }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "0x1ad8e0" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "0x1ad810" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x2ff09" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1, "el": [ "0x1a14d0" ] }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2, "el": [ "0x1ad9b8" ] }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2, "el": [ "0x1ad8f8" ] }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2, "el": [ "0x1ad808" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2, "el": [ "0x1ad7a8" ] }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2, "el": [ "0x1ad7d8" ] }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2, "el": [ "0x1ad7e8" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x1aa168" ] }, { "c": 0.800000011920929, "d": "In-code MZ/PE compare immediate", "e": [ "MZf9\bu/HcH\u003cH\u0003ȁ9PE" ], "i": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x1ad968" ] }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2, "el": [ "0x1ab9a0", "0x1abaa0" ] }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1, "el": [ "0x50cf58" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform/defender::etw-blinding-patch-bytes", "l": 1, "el": [ "0x19e3af" ] }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2, "el": [ "0x1aa168" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x1ada78" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "0x1ad810", "0x1ad870" ] }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2, "el": [ "0x1a8698" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x1ad890" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x9c915" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "value too large", "FlsSetValue", "TlsGetValue", "FlsGetValue", "TlsSetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x1a8b80", "0x1a89f8", "0x1ac90e", "0x1a8a08", "0x1ac91c" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x50d116" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Microsoft® Windows® Operating System" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "0x1ad990" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x6adba" ] }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2, "el": [ "0x1ad818" ] }, { "a": "T1129", "c": 0.6499999761581421, "d": "Condition variable signal", "e": [ "WakeAllConditionVariable" ], "i": "micro-behaviors/process/threading/advanced-sync::condition-variable-signal", "l": 2, "el": [ "0x1ada60" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 48281.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "© Microsoft Corporation. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x50d026" ] }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014", "el": [ "0x1884e" ] }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-file-l1-2-2", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-file-l1-2-4", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-fibers-l1-1-1" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1, "el": [ "0x1ab608", "0x1ab640", "0x1ab700", "0x1ab900", "0x1ab780", "0x1ab810", "0x1ab8b0", "0x1ab590", "0x1ab940", "0x1ab740", "0x1ab6c0", "0x1ab680" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "4d", "48" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0xd6273", "0x17c53" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 48281.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetStringTypeW", "GetEnvironmentStringsW", "invalid string position", "api-ms-win-core-string-l1-1-0", "string too long", "LCMapStringEx", "CompareStringEx", "CompareStringW", "FreeEnvironmentStringsW", "LCMapStringW", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x1ac5d4", "0x1ac4c0", "0x1a7e49", "0x1ab780", "0x1a7e8f", "0x1a84f8", "0x1a8508", "0x1ac2b2", "0x1ac3da", "0x1ac706", "0x50cf02" ] }, { "c": 1.0, "d": "PE second resource is RT_MANIFEST", "e": [ "RT_MANIFEST" ], "i": "metadata/binary/resource::pe-resource-manifest-second", "l": 2, "el": [ "value:pe.resource_types[1]" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "0x1ad8f0" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c1" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x16797f" ] }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Windows operating system product string", "e": [ "Microsoft® Windows® Operating System" ], "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string", "l": 1, "el": [ "0x50d130" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8600000143051147, "d": "Uppercase _RDATA companion section", "e": [ "_RDATA" ], "i": "metadata/binary/section/metrics::uppercase-rdata-section", "l": 2 }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1, "el": [ "0x1aa168" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AppPolicyGetProcessTerminationMethod", "EnumSystemLocalesEx", "GetUserDefaultLocaleName", "AppPolicyGetThreadInitializationType", "GetCurrentProcessId", "InitializeSListHead", "GetModuleHandleExW", "FreeLibraryAndExitThread", "QueryPerformanceFrequency", "AcquireSRWLockExclusive", "GetSystemTimePreciseAsFileTime", "GetModuleFileNameW", "InitializeCriticalSectionAndSpinCount", "MultiByteToWideChar", "InitializeCriticalSectionEx", "GetSystemTimeAsFileTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x1a8c30", "0x1a84b0", "0x1a8aa0", "0x1a8a48", "0x1ac494", "0x1ac68e", "0x1ac558", "0x1ac402", "0x1ac770", "0x1ac28a", "0x1a8a80", "0x1ac52e", "0x1ac648", "0x1ac740", "0x1a84d8", "0x1ac5e6" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 48281.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 98.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation", "Microsoft Corporation." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1, "el": [ "0x50cf58", "0x50d078" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 48281.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x1aa180" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "GetTempPath2W name staged for runtime resolution", "e": [ "GetTempPath2W" ], "i": "micro-behaviors/os/api-resolution/manual::gettemppath2w-staged", "l": 1, "el": [ "0x1a8e00" ] }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001", "el": [ "0x1ac6a4" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x50d040" ] }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "0x1ada20" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x1ac2c4" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009", "el": [ "0x1ad940" ] }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 48281.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x1ad8c8" ] }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales callback API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 1, "m": "E1106", "el": [ "0x1ad7b8" ] }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "00 41 39 2d 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1, "el": [ "0x18e831" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.81" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "0x1ada20" ] }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032", "el": [ "0x1ad938" ] }, { "c": 0.949999988079071, "d": "links kernel32 (AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, ... +93 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "98 symbols" ] }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2, "el": [ "0x1ad898", "0x1ad8f8", "0x1ad7b8" ] }, { "a": "T1027.007", "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "imports.count = 98.00", "Microsoft Corporation", "Microsoft Corporation." ], "i": "objectives/anti-static/obfuscation/imports::benign-unsigned-microsoft-import-heavy-context", "l": 1, "m": "B0032.014", "el": [ "", "0x50cf58", "0x50d078" ] }, { "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "Microsoft Corporation.", "imports.count = 98.00", "Microsoft Corporation" ], "i": "metadata/binary/vendor::benign-unsigned-microsoft-import-heavy-context", "l": 1, "el": [ "0x50d078", "", "0x50cf58" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress", "GetModuleHandleExW", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x1ad8a8", "0x1ad8c8", "0x1ad8b0", "0x1ad8b8" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "imports.count = 98.00", "© Microsoft Corporation. All rights reserved.", "Microsoft® Windows® Operating System", "winrs" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "", "value:pe.version.copyright", "value:pe.version.product_name", "value:pe.version.description" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2, "el": [ "0x1ad810", "0x1ad870" ] }, { "a": "T1129", "c": 0.699999988079071, "d": "SRW lock operations", "e": [ "ReleaseSRWLockExclusive", "AcquireSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-ops", "l": 2, "el": [ "0x1ad9a8", "0x1ad770" ] }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsGetValue", "FlsSetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1, "el": [ "0x1ad7e8", "0x1ad7f8", "0x1ad800" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoW", "EnumSystemLocalesW", "GetUserDefaultLCID", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2, "el": [ "0x1ac51c", "0x1ac332", "0x1ad8f8", "0x1a84b0" ] }, { "a": "T1129", "c": 0.75, "d": "Advanced sync primitives", "e": [ "ReleaseSRWLockExclusive", "WakeAllConditionVariable", "AcquireSRWLockExclusive", "SleepConditionVariableSRW" ], "i": "micro-behaviors/process/threading/advanced-sync::advanced-sync-primitives", "l": 2, "el": [ "0x1ad9a8", "0x1ada60", "0x1ad770", "0x1ada18" ] }, { "a": "T1129", "c": 0.800000011920929, "d": "Advanced server infrastructure", "e": [ "WakeAllConditionVariable", "ReleaseSRWLockExclusive", "CloseHandle", "AcquireSRWLockExclusive", "SleepConditionVariableSRW" ], "i": "micro-behaviors/process/threading/advanced-sync::advanced-sync-server", "l": 2, "m": "E1030", "el": [ "0x1ada60", "0x1ad9a8", "0x1ac2a4", "0x1ad770", "0x1ada18" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2, "el": [ "0x1ada50", "0x1ada08" ] }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "EnumSystemLocalesW", "GetLocaleInfoW", "GetCommandLineA", "GetCommandLineW", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetCurrentThreadId", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082", "el": [ "0x1ad7b8", "0x1ad898", "0x1ad838", "0x1ad840", "0x1ad870", "0x1ad810", "0x1ad868", "0x1ad8f8" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetLocaleInfoW", "GetUserDefaultLCID", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082", "el": [ "0x1ac51c", "0x1ad8f8", "0x1ad870", "0x1ad810", "0x1ac332", "0x1a84b0" ] }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "FreeEnvironmentStringsW", "binary.string_count = 48281.00", "IsDebuggerPresent", "Microsoft Corporation", "IsProcessorFeaturePresent", "IsDebuggerPresent", "GetEnvironmentStringsW", "Microsoft Corporation", "imports.count = 98.00" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001", "el": [ "0x1ad810", "", "0x1ac6a4", "", "0x1ad940", "0x1ad938", "0x1ad870", "0x50cf58", "" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetCommandLineW", "GetLocaleInfoW", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetSystemTimeAsFileTime", "GetUserDefaultLCID", "GetCommandLineA", "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082", "el": [ "0x1ad840", "0x1ac51c", "0x1ad810", "0x1ad870", "0x1ad8f0", "0x1ad8f8", "0x1ad838", "0x1ac332", "0x1a84b0" ] } ], "sha": "f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-06/f36797d71416c5640f75738c0c7ce96b076a191be086d475b86a7784dcba99eb.exe", "type": "pe" } ], "tv": "ca5ef" } }