{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.93665814, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T14:53:44Z" }, "path": "107074", "raw": { "v": "4", "fs": [ { "f": "K₃O₁₀(Al₄S₅As₁₀C₅CoEr₄I₃LaP₂Xe)H₆(Cm₄F₃Os₃Po₅DbDs)Md₄(Bi₇Pa₂)", "x": 170, "id": 0, "is": [ "ORDINAL 9", "ORDINAL 2", "SendMessageA", "SetTimer", "DialogBoxParamW", "DialogBoxParamA", "SetWindowLongA", "GetWindowLongA", "SetWindowTextW", "LoadIconA", "LoadStringW", "LoadStringA", "CharUpperW", "CharUpperA", "DestroyWindow", "EndDialog", "PostMessageA", "ShowWindow", "MessageBoxW", "GetDlgItem", "KillTimer", "SetWindowTextA", "ShellExecuteExA", "GetStringTypeW", "GetStringTypeA", "LCMapStringW", "LCMapStringA", "InterlockedIncrement", "InterlockedDecrement", "GetProcAddress", "GetOEMCP", "GetACP", "GetCPInfo", "IsBadCodePtr", "IsBadReadPtr", "GetFileType", "SetHandleCount", "GetEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "FreeEnvironmentStringsA", "UnhandledExceptionFilter", "HeapSize", "GetCurrentProcess", "TerminateProcess", "IsBadWritePtr", "HeapCreate", "HeapDestroy", "GetEnvironmentVariableA", "SetUnhandledExceptionFilter", "TlsAlloc", "ExitProcess", "GetVersion", "GetCommandLineA", "GetStartupInfoA", "GetModuleHandleA", "WaitForSingleObject", "CloseHandle", "CreateProcessA", "SetCurrentDirectoryA", "GetCommandLineW", "GetVersionExA", "LeaveCriticalSection", "EnterCriticalSection", "DeleteCriticalSection", "MultiByteToWideChar", "WideCharToMultiByte", "GetLastError", "LoadLibraryA", "AreFileApisANSI", "GetModuleFileNameA", "GetModuleFileNameW", "LocalFree", "FormatMessageA", "FormatMessageW", "GetWindowsDirectoryA", "SetFileTime", "CreateFileW", "SetLastError", "SetFileAttributesA", "RemoveDirectoryA", "SetFileAttributesW", "RemoveDirectoryW", "CreateDirectoryA", "CreateDirectoryW", "DeleteFileA", "DeleteFileW", "lstrlenA", "GetFullPathNameA", "GetFullPathNameW", "GetCurrentDirectoryA", "GetTempPathA", "GetTempFileNameA", "FindClose", "FindFirstFileA", "FindFirstFileW", "FindNextFileA", "CreateFileA", "GetFileSize", "SetFilePointer", "ReadFile", "WriteFile", "SetEndOfFile", "GetStdHandle", "WaitForMultipleObjects", "Sleep", "VirtualAlloc", "VirtualFree", "CreateEventA", "SetEvent", "ResetEvent", "InitializeCriticalSection", "RtlUnwind", "RaiseException", "HeapAlloc", "HeapFree", "HeapReAlloc", "CreateThread", "GetCurrentThreadId", "TlsSetValue", "TlsGetValue", "ExitThread" ], "ms": { "pe": { "machine": 332.0, "checksum": 153019.0, "rsrc_size": 4096.0, "subsystem": 2.0, "timestamp": 1290097655.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.89, "entry_section": ".text", "size_of_image": 163840.0, "timestamp_day": 18.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2010.0, "characteristics": 271.0, "entry_point_rva": 84740.0, "size_of_headers": 1024.0, "timestamp_month": 11.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 4.0, "manifest_present": true, "checksum_mismatch": true, "computed_checksum": 791200.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "rich_header_present": true, "linker_major_version": 6.0, "version_info_present": true, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 104960.0, "file_size": 739991.0, "entry_point": 84740.0, "has_overlay": true, "code_entropy": 6.61, "data_entropy": 1.92, "import_count": 122.0, "overlay_size": 598679.0, "string_count": 997.0, "overlay_ratio": 0.81, "section_count": 5.0, "avg_complexity": 7.04, "function_count": 224.0, "import_density": 1.19, "max_complexity": 47.0, "string_density": 9.73, "overall_entropy": 3.45, "overlay_entropy": 6.1, "avg_basic_blocks": 11.17, "avg_section_size": 28057.6, "dependency_count": 4.0, "entropy_variance": 2.41, "function_density": 2.19, "avg_function_size": 194.02, "avg_string_length": 40.16, "complexity_per_kb": 0.07, "max_string_length": 5799.0, "wide_string_count": 50.0, "writable_sections": 2.0, "avg_string_entropy": 3.4, "code_to_data_ratio": 2.97, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.14, "total_basic_blocks": 2503.0, "embedded_file_count": 2.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 205.17, "embedded_binary_count": 2.0, "largest_section_ratio": 0.14, "sentence_string_count": 202.0, "sentence_string_ratio": 0.2, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".sxdata" ], [ 640, ".rsrc" ], [ 3195, "PSSSSSS" ], [ 4227, "QSVW" ], [ 5276, "QQVW" ], [ 10672, "QQSV" ], [ 11836, "FSWF" ], [ 11946, "QQS3" ], [ 12111, "QSUVW" ], [ 13706, "SVW3" ], [ 13759, "AABB" ], [ 14512, "5P1B" ], [ 15101, "PPRPQPh" ], [ 15883, "f98t" ], [ 17107, "f99t" ], [ 21960, "t09u" ], [ 22067, "5D1B" ], [ 24041, "FXQWP" ], [ 24586, "FHPPQ" ], [ 27570, "RPSV" ], [ 28084, "t\\IItEIt2IIt!It" ], [ 31347, "VVVVP" ], [ 32012, "QQSV3" ], [ 36080, "SHVH" ], [ 42368, "G 90" ], [ 46121, "VRQW" ], [ 49658, "QQSVW" ], [ 59674, "QQSUV" ], [ 72371, "SUVW" ], [ 76481, "4SVW" ], [ 78725, "54ZB" ], [ 81458, "SVWU" ], [ 81699, "XSVW" ], [ 83791, "YYPW" ], [ 91909, "PSSW" ], [ 96443, "HSVHWtgHHtF" ], [ 98752, "FGQPS" ], [ 106773, "15.23.35.193:105" ], [ 108648, "__GLOBAL_HEAP_SELECTED" ], [ 108672, "__MSVCRT_HEAP_SELECT" ], [ 108744, "runtime error" ], [ 108764, "TLOSS error" ], [ 108780, "SING error" ], [ 108796, "DOMAIN error" ], [ 108812, "R6028\r\n- unable to initialize heap" ], [ 108819, "- unable to initialize heap" ], [ 108852, "R6027\r\n- not enough space for lowio initialization" ], [ 108859, "- not enough space for lowio initialization" ], [ 108908, "R6026\r\n- not enough space for stdio initialization" ], [ 108915, "- not enough space for stdio initialization" ], [ 108964, "R6025\r\n- pure virtual function call" ], [ 108971, "- pure virtual function call" ], [ 109004, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 109011, "- not enough space for _onexit/atexit table" ], [ 109060, "R6019\r\n- unable to open console device" ], [ 109067, "- unable to open console device" ], [ 109104, "R6018\r\n- unexpected heap error" ], [ 109111, "- unexpected heap error" ], [ 109140, "R6017\r\n- unexpected multithread lock error" ], [ 109147, "- unexpected multithread lock error" ], [ 109188, "R6016\r\n- not enough space for thread data" ], [ 109195, "- not enough space for thread data" ], [ 109232, "abnormal program termination" ], [ 109268, "R6009\r\n- not enough space for environment" ], [ 109275, "- not enough space for environment" ], [ 109312, "R6008\r\n- not enough space for arguments" ], [ 109319, "- not enough space for arguments" ], [ 109356, "R6002\r\n- floating point not loaded" ], [ 109363, "- floating point not loaded" ], [ 109396, "Microsoft Visual C++ Runtime Library" ], [ 109440, "Runtime Error!\n\nProgram:" ], [ 109472, "\u003cprogram name unknown\u003e" ], [ 109496, "GetLastActivePopup" ], [ 109516, "GetActiveWindow" ], [ 109532, "MessageBoxA" ], [ 109544, "user32.dll" ], [ 109612, "dddd, MMMM dd, yyyy" ], [ 109648, "December" ], [ 109660, "November" ], [ 109672, "October" ], [ 109680, "September" ], [ 109692, "August" ], [ 109700, "July" ], [ 109708, "June" ], [ 109716, "April" ], [ 109724, "March" ], [ 109732, "February" ], [ 109744, "January" ], [ 109800, "Saturday" ], [ 109812, "Friday" ], [ 109820, "Thursday" ], [ 109832, "Wednesday" ], [ 109844, "Tuesday" ], [ 109852, "Monday" ], [ 109860, "Sunday" ], [ 109896, "SunMonTueWedThuFriSat" ], [ 109920, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 121408, "OLEAUT32.dll" ], [ 121424, "MessageBoxW" ], [ 121438, "ShowWindow" ], [ 121452, "PostMessageA" ], [ 121468, "EndDialog" ], [ 121480, "DestroyWindow" ], [ 121496, "CharUpperA" ], [ 121510, "CharUpperW" ], [ 121524, "LoadStringA" ], [ 121538, "LoadStringW" ], [ 121552, "SetWindowTextA" ], [ 121570, "SetWindowTextW" ], [ 121588, "GetWindowLongA" ], [ 121606, "SetWindowLongA" ], [ 121624, "DialogBoxParamA" ], [ 121642, "DialogBoxParamW" ], [ 121660, "SetTimer" ], [ 121672, "SendMessageA" ], [ 121714, "KillTimer" ], [ 121724, "USER32.dll" ], [ 121738, "ShellExecuteExA" ], [ 121754, "SHELL32.dll" ], [ 121768, "WaitForSingleObject" ], [ 121790, "CloseHandle" ], [ 121804, "CreateProcessA" ], [ 121822, "SetCurrentDirectoryA" ], [ 121846, "GetCommandLineW" ], [ 121864, "GetVersionExA" ], [ 121880, "LeaveCriticalSection" ], [ 121904, "EnterCriticalSection" ], [ 121928, "DeleteCriticalSection" ], [ 121952, "MultiByteToWideChar" ], [ 121974, "WideCharToMultiByte" ], [ 121996, "GetLastError" ], [ 122012, "LoadLibraryA" ], [ 122028, "AreFileApisANSI" ], [ 122046, "GetModuleFileNameA" ], [ 122068, "GetModuleFileNameW" ], [ 122090, "LocalFree" ], [ 122102, "FormatMessageA" ], [ 122120, "FormatMessageW" ], [ 122138, "GetWindowsDirectoryA" ], [ 122162, "SetFileTime" ], [ 122176, "CreateFileW" ], [ 122190, "SetLastError" ], [ 122206, "SetFileAttributesA" ], [ 122228, "RemoveDirectoryA" ], [ 122248, "SetFileAttributesW" ], [ 122270, "RemoveDirectoryW" ], [ 122290, "CreateDirectoryA" ], [ 122310, "CreateDirectoryW" ], [ 122330, "DeleteFileA" ], [ 122344, "DeleteFileW" ], [ 122358, "lstrlenA" ], [ 122370, "GetFullPathNameA" ], [ 122390, "GetFullPathNameW" ], [ 122410, "GetCurrentDirectoryA" ], [ 122434, "GetTempPathA" ], [ 122450, "GetTempFileNameA" ], [ 122470, "FindClose" ], [ 122482, "FindFirstFileA" ], [ 122500, "FindFirstFileW" ], [ 122518, "FindNextFileA" ], [ 122534, "CreateFileA" ], [ 122548, "GetFileSize" ], [ 122562, "SetFilePointer" ], [ 122580, "ReadFile" ], [ 122592, "WriteFile" ], [ 122604, "SetEndOfFile" ], [ 122620, "GetStdHandle" ], [ 122636, "WaitForMultipleObjects" ], [ 122662, "Sleep" ], [ 122670, "VirtualAlloc" ], [ 122686, "VirtualFree" ], [ 122700, "CreateEventA" ], [ 122716, "SetEvent" ], [ 122728, "ResetEvent" ], [ 122742, "InitializeCriticalSection" ], [ 122770, "RtlUnwind" ], [ 122782, "RaiseException" ], [ 122800, "HeapAlloc" ], [ 122812, "HeapFree" ], [ 122824, "HeapReAlloc" ], [ 122838, "CreateThread" ], [ 122854, "GetCurrentThreadId" ], [ 122876, "TlsSetValue" ], [ 122890, "TlsGetValue" ], [ 122904, "ExitThread" ], [ 122918, "GetModuleHandleA" ], [ 122938, "GetStartupInfoA" ], [ 122956, "GetCommandLineA" ], [ 122974, "GetVersion" ], [ 122988, "ExitProcess" ], [ 123002, "TlsAlloc" ], [ 123014, "SetUnhandledExceptionFilter" ], [ 123044, "GetEnvironmentVariableA" ], [ 123070, "HeapDestroy" ], [ 123084, "HeapCreate" ], [ 123098, "IsBadWritePtr" ], [ 123114, "TerminateProcess" ], [ 123134, "GetCurrentProcess" ], [ 123154, "HeapSize" ], [ 123166, "UnhandledExceptionFilter" ], [ 123194, "FreeEnvironmentStringsA" ], [ 123220, "FreeEnvironmentStringsW" ], [ 123246, "GetEnvironmentStrings" ], [ 123270, "GetEnvironmentStringsW" ], [ 123296, "SetHandleCount" ], [ 123314, "GetFileType" ], [ 123328, "IsBadReadPtr" ], [ 123344, "IsBadCodePtr" ], [ 123360, "GetCPInfo" ], [ 123382, "GetOEMCP" ], [ 123394, "GetProcAddress" ], [ 123412, "InterlockedDecrement" ], [ 123436, "InterlockedIncrement" ], [ 123460, "LCMapStringA" ], [ 123476, "LCMapStringW" ], [ 123492, "GetStringTypeA" ], [ 123510, "GetStringTypeW" ], [ 123526, "KERNEL32.dll" ], [ 124004, ",!@Install@!UTF-8!" ], [ 124024, ",!@InstallEnd@!" ], [ 124064, "wide", "Can not find setup.exe" ], [ 124112, "wide", "setup.exe" ], [ 124132, "wide", "Can not open file" ], [ 124168, "wide", "Can not load codecs" ], [ 124208, "wide", "Can not create temp folder archive" ], [ 124280, "wide", "ExecuteParameters" ], [ 124316, "wide", "ExecuteFile" ], [ 124340, "wide", "RunProgram" ], [ 124364, "wide", "Directory" ], [ 124392, "wide", "Progress" ], [ 124412, "wide", "BeginPrompt" ], [ 124436, "wide", "Title" ], [ 124448, "wide", "Config failed" ], [ 124484, "wide", "Can't load config info" ], [ 124550, "wide", "BUnsupported Method" ], [ 124592, "wide", "Can not open output file" ], [ 124644, "wide", "Can not delete output file" ], [ 124706, "wide", "BCan not open the file as archive" ], [ 124776, "wide", "Can not find archive file" ], [ 124828, "wide", "Default" ], [ 124912, ".?AVCNewException@@" ], [ 125028, "out of memory" ], [ 125056, ".?AUCSystemException@@" ], [ 125088, ".?AUCInBufferException@@" ], [ 125128, ".?AUCOutBufferException@@" ], [ 125164, "wide", "Unknown error" ], [ 125208, "wide", "Are you sure you want to cancel?" ], [ 125296, ".?AVCInArchiveException@N7z@NArchive@@" ], [ 125424, "wide", "BCJ2" ], [ 125512, "wide", "Copy" ], [ 125568, "wide", "LZMA2" ], [ 125624, "wide", "LZMA" ] ], "sz": 739991, "ts": [ { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 511.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "d": "JSON.stringify call", "e": [ "JSON.stringify" ], "i": "micro-behaviors/data/serialize/json::json-stringify-call", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny JavaScript sidecar loader", "e": [ "text.total_lines = 1.00" ], "i": "objectives/supply-chain/hidden-payload/encoding::tiny-loader-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "107074##plain@0x2498d" ], "i": "objectives/supply-chain/metadata-anomaly/markers/npm::small-file-5k", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(e){}" ], "i": "objectives/supply-chain/install-hook/dropper::top-level-try-catch-empty", "l": 1, "m": "B0024" }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(e){}" ], "i": "objectives/supply-chain/trojanized/library::swallowed-loader-errors", "l": 1 }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x2498d" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0x270a1 (~372736 bytes)", "e": [ "kind=Pe32 estimated_size=372736", "kind=Pe32 estimated_size=249856" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "WinDbg debugger", "e": [ "windbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::windbg-process", "l": 3, "m": "B0013" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Two or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::multiple-pe-embedded", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "7z SFX installer config marker", "e": [ "…XPADDINGPADDINGXXPADDING;!@Install@!UTF-8!" ], "i": "objectives/anti-static/obfuscation/binary-metrics::7zsfx-config-marker", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadReadPtr anti-debug style probe", "e": [ "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Wireshark analyzer", "e": [ "$:hlen:wireshark", "$:hlen:wireshark network analyzer", "$:hash:wireshark.exe", "$:hlen:the wireshark network analyzer" ], "i": "micro-behaviors/communications/capture/wireshark::wireshark", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA", "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…ssembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "open the file as archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "FbiRat keylogger output filename", "e": [ "log.txt" ], "i": "well-known/malware/rat/fbirat::keylog-output-file", "l": 1, "m": "B0030" }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "JavaScript function keyword in non-code file", "e": [ "function include(", "function loadIntoWindow(", "function unloadFromWindow(", "function startup(", "function shutdown(", "function install(", "function uninstall(" ], "i": "objectives/anti-static/obfuscation/payload::js-function-in-noncode", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.40" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1290097655.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE", "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 122.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "d": "DELETE FROM SQL keyword", "e": [ "delete from" ], "i": "micro-behaviors/data/db/conn/sql::sql-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "$:hlen:process explorer" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 2 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 598679.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (romChar)", "e": [ "…64!=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003cj\u0026\u0026", "…64!=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003ci\u0026\u0026(b+…", "…CodeAt(c+2),b=b+String.fromCharCode((d\u002615)\u003c\u003c12|(e\u002663)\u003c\u003c…", "…(c);if(128\u003ed)b+=String.fromCharCode(d),", "…(c);if(128\u003ed)b+=String.fromCharCode(d),c++;else if(191\u003c…", "…64!=g\u0026\u00260\u003ci\u0026\u0026(b+=String.fromCharCode(i))}return this._ut…", "…CodeAt(c+1),b=b+String.fromCharCode((d\u002631)\u003c\u003c6|e\u002663),c=c…", "(b+=String.fromCharCode(j))}return this._ut…", "…=(f\u00263)\u003c\u003c6|g,b=b+String.fromCharCode(d\u003c\u003c2|e\u003e\u003e4);64!=f\u0026\u00260…" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-romchar", "l": 1 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT * FROM", "SELECT url,scode,epoch FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.04" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3", "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform::amsi-memory-patch-hex-bytes", "l": 1 }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (CharCode)", "e": [ "…=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003ci\u0026\u0026(b+=Str…", "…=g\u0026\u00260\u003ci\u0026\u0026(b+=String.fromCharCode(i))}return this._utf8_d…", "…\u00263)\u003c\u003c6|g,b=b+String.fromCharCode(d\u003c\u003c2|e\u003e\u003e4);64!=f\u0026\u00260\u003ch\u0026\u0026…", "(b+=String.fromCharCode(j))}return this._utf8_d…", "…eAt(c+2),b=b+String.fromCharCode((d\u002615)\u003c\u003c12|(e\u002663)\u003c\u003c6|f\u0026…", "…;if(128\u003ed)b+=String.fromCharCode(d),c++;else if(191\u003cd\u0026\u00262…", "…eAt(c+1),b=b+String.fromCharCode((d\u002631)\u003c\u003c6|e\u002663),c=c+2;e…", "…;if(128\u003ed)b+=String.fromCharCode(d),", "…=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003cj\u0026\u0026" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-charcode", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.30000001192092896, "d": "lzma compression reference", "e": [ "LZMA" ], "i": "micro-behaviors/dylib/library::lzma-ref", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "crxdrop_exe.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8500000238418579, "d": "File API ANSI check", "e": [ "AreFileApisANSI" ], "i": "micro-behaviors/os/env/access::are-file-apis-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Can not open output file", "Can not delete output file" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1005", "c": 0.550000011920929, "d": "Generic database extension", "e": [ ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db" ], "i": "objectives/collection/file-targeting/filter::db-extension", "l": 1, "m": "B0024" }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1497", "c": 0.6000000238418579, "d": "Fiddler tooling reference", "e": [ "fiddler.exe" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::fiddler", "l": 2, "m": "B0007" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2503.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.9399999976158142, "d": "7-Zip LZMA2 method string", "e": [ "LZMA2" ], "i": "metadata/binary/installer/sfx::7zip-lzma2-method", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "SQLite extension", "e": [ ".sqlite", ".sqlite", ".sqlite", ".sqlite", ".sqlite" ], "i": "objectives/collection/file-targeting/filter::sqlite-extension", "l": 1, "m": "B0024" }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.9800000190734863, "d": "zycript custom alphabet", "e": [ "….url})}},zycript={xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\",", "….url})}},zycript={xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\",decode:function(a){for…", "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], "i": "well-known/malware/trojan/elex/dropper::zycript-custom-alphabet", "l": 4 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "a": "T1518.001", "c": 0.800000011920929, "d": "Fiddler HTTP debugger process", "e": [ "fiddler.exe" ], "i": "objectives/anti-analysis/tool-detect/process::fiddler-process", "l": 3, "m": "B0013" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "a": "T1496", "c": 0.8500000238418579, "d": "Process Explorer check", "e": [ "procexp.exe" ], "i": "objectives/impact/cryptojacking/miner::procexp-check", "l": 1, "m": "B0004" }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Port 80 (HTTP)", "e": [ ":80" ], "i": "objectives/command-and-control/infrastructure/ip::port-80", "l": 1, "m": "C0002" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "a": "T1518.001", "c": 0.800000011920929, "d": "Wireshark network analyzer process", "e": [ "wireshark.exe" ], "i": "objectives/anti-analysis/tool-detect/process::wireshark-process", "l": 3, "m": "B0013" }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.9950000047683716, "d": "japproxy sync C2 URL", "e": [ "…Tk8rdn6tNhVCT95tMtHojw=;http://japproxy.net/sync/?q=hfZ9ojC9rdk8hchTB6lKDzt4…" ], "i": "well-known/malware/trojan/elex/dropper::japproxy-sync-c2", "l": 4 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetProcessImageFileNameA dynamic resolve", "e": [ "GetProcessImageFileNameA" ], "i": "micro-behaviors/process/enumerate/psapi::get-process-image-filename-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requests highest available privileges", "e": [ "\u003crequestedExecutionLevel level=\"highestAvailable" ], "i": "micro-behaviors/os/privilege/manifest::highest-available", "l": 3 }, { "c": 0.9399999976158142, "d": "7-Zip BCJ2 method string", "e": [ "BCJ2" ], "i": "metadata/binary/installer/sfx::7zip-bcj2-method", "l": 1 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 739991.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "Process Hacker tool", "e": [ "processhacker.exe" ], "i": "objectives/anti-analysis/tool-detect/process::process-hacker-dup", "l": 3, "m": "B0013" }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 739991.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "FireFox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 163840.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.61)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Tool identity claims Wireshark", "e": [ "wireshark", "wireshark", "wireshark", "wireshark" ], "i": "metadata/package/tooling::tool-identity-wireshark", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 997.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 12800)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 1.0, "d": ".js extension", "e": [ "\"oE2tn3Eqp.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessW", "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetModuleFileNameExA dynamic resolve", "e": [ "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::get-module-filename-ex-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.20" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Principal", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://syncerjpi.com/", "http://syncerjpi.com/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Transacted registry API name", "e": [ "RegOpenKeyTransactedW", "RegCreateKeyTransactedW" ], "i": "well-known/malware/trojan/elex::transacted-registry-api-name", "l": 1 }, { "a": "T1496", "c": 0.8500000238418579, "d": "Process Monitor check", "e": [ "procmon.exe" ], "i": "objectives/impact/cryptojacking/miner::procmon-check", "l": 1, "m": "B0004" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4e", "40", "40", "47", "46", "4a", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.81" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadWritePtr anti-debug style probe", "e": [ "IsBadWritePtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-write-ptr", "l": 1, "m": "B0001" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.81" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry delete API lookup", "e": [ "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-delete-key-transacted-name", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 598679.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1497", "c": 0.6000000238418579, "d": "Process Monitor tool", "e": [ "procmon" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::procmon", "l": 2, "m": "B0007" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1497", "c": 0.6000000238418579, "d": "OllyDbg debugger", "e": [ "ollydbg" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::ollydbg", "l": 2, "m": "B0007" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{62D82EC1-0D3A-DF54-8E3E-07E1337A5311}", "{4F212A74-69DC-C882-4117-6205355D3697}", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "Process Monitor (Sysinternals)", "e": [ "procexp.exe", "procmon.exe" ], "i": "objectives/anti-analysis/tool-detect/process::procmon-process", "l": 3, "m": "B0013" }, { "a": "T1497.001", "c": 0.6000000238418579, "d": "VirtualBox hypervisor vendor string", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/vm-detect::vendor-virtualbox", "l": 1 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "15.23.35.193:105" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "e4 b1 41 00", "b0 b0 41 00", "1c b1 41 00", "20 b1 41 00", "30 b1 41 00", "b0 b0 41 00", "6c b0 41 00", "24 b0 41 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 598679.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8500000238418579, "d": "PE contains 2+ embedded PE binaries", "e": [ "binary.embedded_binary_count = 2.00" ], "i": "metadata/binary/metrics::embedded-pe-multi", "l": 3 }, { "a": "T1497.001", "d": "VBOX string detection", "e": [ "vbox" ], "i": "objectives/anti-analysis/emulator-detect::vbox-string", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1071.001", "c": 0.75, "d": "Encoded HTTP URL", "e": [ "}},syncer={url:\"http://proxyjpi.co.il/sync/?q=hfZ9ojC9rdk8hchTB6lKDzt4okwFtNtVh7n0rjrEpjsGrjr9rdk8tM...", "c.readyState?c.onreadystatechange=function(){if(\"loaded\"==c.readyState||\"complete\"==c.readyState)c.o..." ], "i": "objectives/anti-static/obfuscation/encoding::encoded-http-url", "l": 3 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "….working=1,this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",a,!…" ], "i": "micro-behaviors/communications/http/request::xmlhttprequest-word", "l": 3 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry create API lookup", "e": [ "RegCreateKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-transacted-name", "l": 3 }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "a": "T1497.001", "d": "VirtualBox string detection", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/emulator-detect::virtualbox-word", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableA" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1518.001", "c": 0.8999999761581421, "d": "OllyDbg debugger", "e": [ "ollydbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::ollydbg-process", "l": 3, "m": "B0013" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry open API lookup", "e": [ "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-transacted-name", "l": 3 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "MultiByteToWideChar", "WideCharToMultiByte", "GetModuleFileNameA", "GetModuleFileNameW", "GetWindowsDirectoryA", "GetCurrentDirectoryA", "InitializeCriticalSection", "SetUnhandledExceptionFilter", "GetEnvironmentVariableA", "UnhandledExceptionFilter", "InterlockedDecrement", "InterlockedIncrement", "GenuineIntelAuthenticAMDCentaurHauls" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9, ORDINAL 2)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, ... +94 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, ... +15 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileA", "GetFileSize", "ReadFile", "CreateFileW", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "CreateFileW", "CreateFileA", "SetFileTime", "GetModuleFileNameA", "FindFirstFileW", "GetModuleFileNameW", "WriteFile" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindFirstFileA", "FindNextFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "c": 0.9800000190734863, "d": "7-Zip self-extracting archive profile", "e": [ "LZMA2", "BCJ2" ], "i": "metadata/binary/installer/sfx::7zip-sfx-archive-profile", "l": 3 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 122.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1057", "c": 0.8799999952316284, "d": "Dynamic PSAPI API resolution strings", "e": [ "PSAPI", "GetProcessImageFileNameA", "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dynamic-resolve", "l": 3 }, { "d": "SQL statement keywords", "e": [ "SELECT url,scode,epoch FROM", "SELECT * FROM", "INSERT INTO", "delete from", "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempFileNameA", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileW", "GetModuleFileNameA", "DeleteFileA", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1548.002", "c": 0.8500000238418579, "d": "Admin manifest with network activity", "e": [ "….working=1,this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",a,!…", "\u003crequestedExecutionLevel level=\"highestAvailable" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/manifest::admin-manifest-network", "l": 2 }, { "a": "T1497", "c": 0.6600000262260437, "d": "Sandbox detection techniques", "e": [ "$:hlen:wireshark", "PSAPI", "$:hlen:the wireshark network analyzer", "procmon", "ollydbg", "GetModuleFileNameExA", "$:hash:wireshark.exe", "$:hlen:wireshark network analyzer", "GetProcessImageFileNameA" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::sandbox", "l": 4, "m": "B0007" }, { "a": "T1518.001", "c": 0.8999999761581421, "d": "Multiple analysis tools enumerated", "e": [ "PSAPI", "GetProcessImageFileNameA", "ollydbg.exe", "processhacker.exe", "wireshark.exe", "procexp.exe", "fiddler.exe", "windbg.exe", "procmon.exe", "GetModuleFileNameExA" ], "i": "objectives/anti-analysis/tool-detect/process::analysis-tool-enumeration", "l": 4, "m": "B0013" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry API fallback chain", "e": [ "RegDeleteKeyTransactedW", "RegCreateKeyTransactedW", "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::registry-transacted-api-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1622", "c": 0.8999999761581421, "d": "SEH with bad pointer debug probes", "e": [ "IsBadWritePtr", "SetUnhandledExceptionFilter", "IsBadReadPtr", "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::seh-pointer-probe-anti-debug", "l": 2, "m": "B0001" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "GetModuleFileNameA", "CreateFileW", "CreateFileA", "ReadFile", "binary.has_overlay = 1.00", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 3, "m": "B0032" }, { "a": "T1497", "c": 0.8999999761581421, "d": "Multi-tool analyst-name catalog (debugger + sandbox + monitor)", "e": [ "$:hash:wireshark.exe", "ollydbg", "fiddler.exe", "procmon", "$:hlen:wireshark network analyzer", "$:hlen:the wireshark network analyzer", "$:hlen:wireshark" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::analyst-tool-name-cluster", "l": 4, "m": "B0007" }, { "c": 0.8999999761581421, "d": "Trojanized system utility or hardware monitor dropper", "e": [ "wireshark", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::trojanized-system-utility-dropper", "l": 4 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "}},syncer={url:\"http://proxyjpi.co.il/sy \u003curl\u003e", "c.readyState?c.onreadystatechange=functi \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 } ], "sha": "f58506ebb0bd6fde6fed44dc93b2890fa4204026d8c7f04ddde161e6d945cae6", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/107074", "type": "pe" } ], "tv": "feb13" } }