{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.97384614, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T06:06:59Z" }, "path": "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 4, "ff": { "i": [ [ "user32", "GetThreadDesktop" ], [ "kernel32", "ResetEvent" ], [ "gdi32", "Chord" ], [ "gdi32", "CreateCompatibleDC" ], [ "gdi32", "CreateDiscardableBitmap" ], [ "winspool.drv", "ScheduleJob" ], [ "winmm", "mixerGetNumDevs" ], [ "msvbvm60", "ORDINAL 187" ], [ "msvbvm60", "ORDINAL 696" ], [ "msvbvm60", "ORDINAL 697" ], [ "msvbvm60", "ORDINAL 698" ], [ "msvbvm60", "ORDINAL 516" ], [ "msvbvm60", "ORDINAL 517" ], [ "msvbvm60", "ORDINAL 518" ], [ "msvbvm60", "ORDINAL 519" ], [ "msvbvm60", "ORDINAL 660" ], [ "msvbvm60", "ORDINAL 557" ], [ "msvbvm60", "ORDINAL 669" ], [ "msvbvm60", "ORDINAL 591" ], [ "msvbvm60", "ORDINAL 598" ], [ "msvbvm60", "ORDINAL 520" ], [ "msvbvm60", "ORDINAL 709" ], [ "msvbvm60", "ORDINAL 631" ], [ "msvbvm60", "ORDINAL 632" ], [ "msvbvm60", "ORDINAL 527" ], [ "msvbvm60", "ORDINAL 528" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 711" ], [ "msvbvm60", "ORDINAL 712" ], [ "msvbvm60", "ORDINAL 607" ], [ "msvbvm60", "ORDINAL 608" ], [ "msvbvm60", "ORDINAL 717" ], [ "msvbvm60", "ProcCallEngine" ], [ "msvbvm60", "ORDINAL 535" ], [ "msvbvm60", "ORDINAL 537" ], [ "msvbvm60", "ORDINAL 644" ], [ "msvbvm60", "ORDINAL 645" ], [ "msvbvm60", "ORDINAL 681" ], [ "msvbvm60", "ORDINAL 578" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "ORDINAL 579" ], [ "msvbvm60", "ORDINAL 614" ], [ "msvbvm60", "ORDINAL 616" ], [ "msvbvm60", "ORDINAL 617" ], [ "msvbvm60", "ORDINAL 618" ], [ "msvbvm60", "ORDINAL 619" ] ], "m": { "pe": { "checksum": 133830.0, "checksum_valid": 0.0, "computed_checksum": 99776.0, "bound_import_count": 6.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 1726800666.0 }, "file": { "size": 94208.0, "entropy": 4.84, "size_bytes": 94208.0 }, "binary": { "is_pie": 0.0, "code_entropy": 4.84, "string_count": 244.0, "entropy_variance": 0.0, "avg_string_length": 17.53, "max_string_length": 670.0, "code_to_data_ratio": 1.0, "string_length_stddev": 61.26, "largest_section_ratio": 0.74, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 47.0 }, "sections": { "count": 3.0, "code_size": 69632.0, "entropy_max": 4.87, "entropy_mean": 4.86, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 6.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 152, "u8", "Rich" ], [ 424, "u8", ".text" ], [ 504, "u8", ".rsrc" ], [ 600, "u8", "USER32.DLL" ], [ 611, "u8", "KERNEL32.DLL" ], [ 624, "u8", "GDI32.DLL" ], [ 634, "u8", "WINSPOOL.DRV" ], [ 647, "u8", "WINMM.DLL" ], [ 657, "u8", "MSVBVM60.DLL" ], [ 4664, "u8", "electrodepositable" ], [ 4683, "u8", ".tmp" ], [ 4688, "u8", "uncompassable" ], [ 4916, "u8", "Confed" ], [ 4923, "u8", "jwlcvgyu" ], [ 7312, "u8", "intrafoliaceous" ], [ 7656, "u8", "gdi32" ], [ 7668, "u8", "StrokeAndFillPath" ], [ 8803, "u8", "DQTY" ], [ 11488, "u8", "DdeNameService" ], [ 11884, "u8", "user32" ], [ 11896, "u8", "DestroyWindow" ], [ 11968, "u8", "GetMetaRgn" ], [ 12036, "u8", "kernel32" ], [ 12052, "u8", "GetConsoleMode" ], [ 12124, "u8", "winspool.drv" ], [ 12144, "u8", "EndPagePrinter" ], [ 12216, "u8", "PurgeComm" ], [ 12284, "u8", "HideCaret" ], [ 12352, "u8", "GlobalCompact" ], [ 12424, "u8", "CallWindowProcA" ], [ 12500, "u8", "VBA6.DLL" ], [ 12512, "u8", "WINMM" ], [ 12520, "u8", "mixerGetNumDevs" ], [ 12552, "u8", "ScheduleJob" ], [ 12576, "u8", "CreateCompatibleDC" ], [ 13368, "u8", "KERNEL32" ], [ 13380, "u8", "ResetEvent" ], [ 13392, "u8", "Chord" ], [ 13488, "u8", "USER32" ], [ 13496, "u8", "GetThreadDesktop" ], [ 13524, "u8", "CreateDiscardableBitmap" ], [ 13872, "wide", "info" ], [ 70810, "u8", "DllFunctionCall" ], [ 70828, "u8", "__vbaExceptHandler" ], [ 70850, "u8", "ProcCallEngine" ], [ 74442, "wide", "GKMNOQN1" ], [ 74460, "wide", "GKMNOQN2" ], [ 74478, "wide", "GKMNOQN3" ], [ 74496, "wide", "GKMNOQN4ǜ4" ], [ 74518, "wide", "VS_VERSION_INFO" ], [ 74610, "wide", "VarFileInfo" ], [ 74642, "wide", "Translation" ], [ 74678, "wide", "StringFileInfo" ], [ 74714, "wide", "040904B0" ], [ 74738, "wide", "ProductName" ], [ 74764, "wide", "lapithae" ], [ 74790, "wide", "FileVersion" ], [ 74816, "wide", "0.40" ], [ 74834, "wide", "ProductVersion" ], [ 74882, "wide", "InternalName" ], [ 74908, "wide", "Confed" ], [ 74930, "wide", "OriginalFilename" ], [ 74964, "wide", "Confed.exe" ], [ 77272, "wide", "/ P6pL" ], [ 77630, "u8", ")))\u003eDKLKLKD?\u003e\u003e?KKKDSSLLD\u003e,01#" ], [ 77686, "u8", "{mfgfor{nss~{~~{febjC" ], [ 77725, "u8", "8YYddkmnmofffgfksnnnn{" ], [ 77773, "u8", "\u003e\u003e\u003e\u003eblmlb\u003e\u003e\u003e\u003e\u003eVemnmmkkljmed^KL" ], [ 77821, "u8", "ffdolnmjaaaVOVaelmjeejcjjedbl{" ], [ 77869, "u8", "doerlmmjbYYYZaaejmjebekkkjdde{" ], [ 77917, "u8", "\u003e\u003e\u003eDjnskbZYVYYaekmkeadjmnmeaYK" ], [ 77965, "u8", "ooo{vyymbYYYYZackmkebdjnsskaf{" ], [ 78013, "u8", "ofrvsvncVPVZYY^ejmjedfkmn~" ], [ 78061, "u8", "@@\u003eLLnmb\u003ePYaadYblmjbVP?KLLKA\u003eA" ], [ 78116, "u8", "{rorfoog}snmeaa^}~~{vfk" ], [ 78164, "u8", "vodocfrf{mnmeaV^j~~~vfp" ], [ 78205, "u8", "AAALQ_LR\u003eAA\u003e\u003e\u003e\u003eDmnme^PV^lLLD\u003e\u003e" ], [ 78270, "u8", "yvkaValmssca9" ], [ 78308, "u8", "vmcoofocv~~" ], [ 78320, "u8", "vaaaclsmlb8)" ], [ 78349, "u8", "IBBD`_snjaYA@\u003eADRLLD\u003eOPellmcY8+" ], [ 78403, "u8", "}vndbogro}" ], [ 78415, "u8", "woeofsnnmka;+" ], [ 78451, "u8", "}ynjcpooov~wwndZfemnmea;-" ], [ 78492, "u8", "BBIBShwylbaaAAABKnmjaV\u003ebmnmeY8)" ], [ 78547, "u8", "yyskdcpoor" ], [ 78558, "u8", "xwsjaoknnkeb;-" ], [ 78596, "u8", "yskccoror{" ], [ 78607, "u8", "ywkcd~jjjca;" ], [ 78636, "u8", "NIIBS```mebIIIAALTTTD\u003e\u003eDRLjbY\u003e" ], [ 78694, "u8", "o}orroo{" ], [ 78781, "u8", "_SIIJhhh_NIBIIIIJTTLQJAHmnlD\u003eB" ], [ 78850, "u8", "{gkswskov" ], [ 78898, "u8", "}omvwwkf{" ], [ 78925, "u8", "i__NJnwwxnJIIBJIAShTTD@jswneAB" ], [ 78994, "u8", "{omsvnjkW" ], [ 79069, "u8", "h_`_SswwwsngdddIIN_``RDEMMFE4/" ], [ 79123, "u8", "yy~ywskgkgkn" ], [ 79321, "u8", "}zuuttorr!\\" ], [ 79415, "u8", "zopoupW%doo*" ], [ 81383, "u8", "BBBEEE@B=\u003c;" ], [ 81817, "u8", "tpgZnpu" ], [ 81865, "u8", "klWVflmmu" ], [ 81916, "u8", "JcjkSTqY" ], [ 81960, "u8", "5Mk34QkSRSk" ], [ 82070, "u8", "ohiT5" ], [ 85323, "u8", "ST+)+%!\"+%)%+5R+XUZ|" ], [ 85369, "u8", "URTTR,,+,UV554RSXXYk}" ], [ 85416, "u8", "U,TRTUUR5XS+RSVVXYYl~" ], [ 85464, "u8", "+(*,,555RUSSSSXXYjk~" ], [ 85512, "u8", "\u0026$+06667S5RRSVVXYkl~" ], [ 85562, "u8", "\u0026'03677777777VVWjlm" ], [ 85610, "u8", "##.--/1/111MNNO[giiggchrw" ], [ 85669, "u8", "I2IJJKLQb_Q@=PaoqqvqvqqE;;" ], [ 85717, "u8", "\u003e?D@B@P```PBAEnnFFEFFCCn" ], [ 85763, "u8", ":BE^`^```aoppppvqonnv" ], [ 85857, "u8", "9Edst" ], [ 85903, "u8", "8AEddsp" ], [ 86570, "u8", "zzyyyzzzz" ], [ 86617, "u8", "zzyyyyzzzzzzyyyyyyyy" ], [ 86665, "u8", "xxHHHHHxxxxxHHHHHHHHxxx" ], [ 86715, "u8", "GGGGGGGGGGGGGGGGGGGHGH" ], [ 89229, "u8", "-*664@??2MQu" ], [ 89277, "u8", "\")57DA====ORwhz" ], [ 89325, "u8", "#37\u003cFB\u003eOLORR" ], [ 89373, "u8", "#3\u003cDJUNRORRd" ] ], "v": { "file.stem": "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea", "pe.imphash": "6808697e1b6e70ced8a05545ffcfda5b", "pe.machine": "i386", "pe.rich.key": 2288615565, "pe.rich.hash": "cfa14d932599a86407a6162cc2d261fa", "pe.subsystem": "windows_gui", "pe.timestamp": 1349718131, "file.basename": "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea.exe", "pe.image_base": 4194304, "pe.image_size": 98304, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4604, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "fd78ec8f2cb58ac5b097469b88d841bcd80d0710", "pe.image_hash.sha256": "d3cc9cbbe3ab0ab669838c3928e3160a3711e0ef55e6ec0e475b98387e6ff0dd", "pe.image_hash.sha384": "18b56cb761de19ea8cb4dfb6322f5e8139159d5eb27312234e337e4d18008adef55d82691f25c7e3046fffa5cca21191", "pe.image_hash.sha512": "12344489a5900cbd0ef46f2289e15caf268bf2d2400c4aa36fed4e6ece5d67605fdbb0d725313b715d98c4f169e3359bd58dce52c98e1b48730b110b4e3912f8", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "USER32.DLL", "pe.bound_imports[1].name": "KERNEL32.DLL", "pe.bound_imports[2].name": "GDI32.DLL", "pe.bound_imports[3].name": "WINSPOOL.DRV", "pe.bound_imports[4].name": "WINMM.DLL", "pe.bound_imports[5].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 70260, "pe.data_directories[1].rva": 77824, "pe.data_directories[2].rva": 544, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 140, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 17740, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 128, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 212, "pe.rich.entries[0].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.coff.dos_header_pe_pointer": 176, "pe.rich.entries[0].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1290254886, "pe.bound_imports[1].time_date_stamp": 1310790079, "pe.bound_imports[2].time_date_stamp": 1290254346, "pe.bound_imports[3].time_date_stamp": 1290254923, "pe.bound_imports[4].time_date_stamp": 1290254914, "pe.bound_imports[5].time_date_stamp": 1247533676 }, "id": "pe", "sc": [ [ ".text", 4096, 69632, 4.84, "r-x" ], [ ".data", 0, 0, 0.0, "rw-" ], [ ".rsrc", 73728, 20480, 4.87, "r--" ] ] }, "id": 0, "sz": 94208, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp" ], "i": "objectives/impact/infect/binary/rewrite::tmp-extension-staging", "l": 1, "el": [ "0x124b" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 47.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x291" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x1149a" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x12316" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 47.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 244.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler", "ProcCallEngine" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x114ac", "0x114c2" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"USER32.DLL\",\"time_date_stamp\":1290254886,\"forwarder_ref_count\":0}, {\"name\":\"KERNEL32.DLL\",\"time_date_stamp\":1310790079" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x332f" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1, "el": [ "0x124b" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x12482" ] }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x107c" ] }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039", "el": [ "0x1008" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x124b2" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 47.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x124d4" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 47.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x319e" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x123f2" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x123b6" ] }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcA" ], "i": "micro-behaviors/ui/window/manage/control::call-window-proc", "l": 2, "el": [ "0x3088" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014", "el": [ "0x1014" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 47.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 47.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x1377" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 69632, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x1377" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 47.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x124d4" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "DjnskbZYVYYaekmkeadjmnmeaYK" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x1305d" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links winmm (mixerGetNumDevs)", "e": [ "winmm" ], "i": "metadata/dylib::winmm", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (ResetEvent)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links gdi32 (Chord, CreateCompatibleDC, CreateDiscardableBitmap)", "e": [ "gdi32" ], "i": "metadata/dylib::gdi32", "l": 2, "el": [ "3 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (GetThreadDesktop)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links winspool.drv (ScheduleJob)", "e": [ "winspool.drv" ], "i": "metadata/dylib::winspool/drv", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 187, ORDINAL 696, ORDINAL 697, ORDINAL 698, ORDINAL 516, ... +35 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "40 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "MSVBVM60.DLL", "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x291", "0x1149a" ] } ], "sha": "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea", "path": "f497e449c3d1cb7a734e8ecde936208d60db8ac99bf429270b328a0e6ff8dfea.exe", "type": "pe" } ], "tv": "52045" } }