{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9961373209953308, "class": 1 } ], "prob": 0.9961373, "class": 1, "oprob": 0.9961373, "models": [ { "m": "az", "prob": 0.9961373, "class": 0 }, { "m": "az/native", "prob": 0.49723756, "class": 0 }, { "m": "az/pe", "prob": 0.81875, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-16T13:00:16Z" }, "path": "f593508039831238754043473ebe0ea7cf3f0299ee39dd26787bb978fc5825a3.exe", "raw": { "v": "4", "fs": [ { "f": "O(As)H₂(CmCr)Md₃(Bi₂HeSi)", "k": { "hash.imp": "0069d3b811b76dadf096fc086ee4750a", "pe.timestamp": 1751032744, "hash.authenti": "380c949e48a63ac9552f41b4aac279a158bcb3af8edd15fc0fb09cd313aa0aa0", "build.target_arch": "x86_64", "pe.linker_version": "14.43", "pe.data_directories[0].rva": 139088, "pe.data_directories[1].rva": 160416, "pe.data_directories[2].rva": 151552, "pe.data_directories[3].rva": 163840, "pe.data_directories[4].rva": 35488, "pe.data_directories[5].rva": 159744, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 81, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 5412, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 1640, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 320, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 616, "pe.load_config.cfg_check_func": "0x180027268", "pe.load_config.cfg_guard_flags": "0x100", "pe.load_config.security_cookie": "0x180022040", "binary.top_complex_unnamed[0].cc": 16, "binary.top_complex_unnamed[1].cc": 10, "binary.top_complex_unnamed[2].cc": 9, "binary.top_complex_unnamed[3].cc": 7, "binary.top_complex_unnamed[4].cc": 7, "binary.top_complex_unnamed[5].cc": 6, "binary.top_complex_unnamed[6].cc": 6, "binary.top_complex_unnamed[7].cc": 5, "pe.dll_characteristics.nx_compat": true, "binary.top_complex_unnamed[0].bbs": 32, "binary.top_complex_unnamed[1].bbs": 11, "binary.top_complex_unnamed[2].bbs": 16, "binary.top_complex_unnamed[3].bbs": 10, "binary.top_complex_unnamed[4].bbs": 11, "binary.top_complex_unnamed[5].bbs": 8, "binary.top_complex_unnamed[6].bbs": 7, "binary.top_complex_unnamed[7].bbs": 9, "binary.top_complex_unnamed[0].addr": "0x18001a58b", "binary.top_complex_unnamed[0].size": 595, "binary.top_complex_unnamed[1].addr": "0x180011bd5", "binary.top_complex_unnamed[1].size": 188, "binary.top_complex_unnamed[2].addr": "0x1800144b2", "binary.top_complex_unnamed[2].size": 200, "binary.top_complex_unnamed[3].addr": "0x1800123fc", "binary.top_complex_unnamed[3].size": 432, "binary.top_complex_unnamed[4].addr": "0x1800142d8", "binary.top_complex_unnamed[4].size": 225, "binary.top_complex_unnamed[5].addr": "0x1800132bc", "binary.top_complex_unnamed[5].size": 103, "binary.top_complex_unnamed[6].addr": "0x180012aec", "binary.top_complex_unnamed[6].size": 69, "binary.top_complex_unnamed[7].addr": "0x180013a6d", "binary.top_complex_unnamed[7].size": 150, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".data", "pe.section_characteristics[2].name": ".pdata", "pe.section_characteristics[3].name": ".idata", "pe.section_characteristics[4].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.load_config.cfg_flags.instrumented": true, "pe.dll_characteristics.high_entropy_va": true, "pe.section_characteristics[0].raw_size": 135168, "pe.section_characteristics[1].raw_size": 6144, "pe.section_characteristics[2].raw_size": 5632, "pe.section_characteristics[3].raw_size": 3072, "pe.section_characteristics[4].raw_size": 2048, "pe.section_characteristics[0].virtual_size": 135073, "pe.section_characteristics[1].virtual_size": 10304, "pe.section_characteristics[2].virtual_size": 5412, "pe.section_characteristics[3].virtual_size": 2740, "pe.section_characteristics[4].virtual_size": 1640, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 139264, "pe.section_characteristics[2].virtual_address": 151552, "pe.section_characteristics[3].virtual_address": 159744, "pe.section_characteristics[4].virtual_address": 163840, "pe.section_characteristics[0].characteristics_hex": "e0000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 84, "id": 0, "is": [ "GetOEMCP", "HeapFree", "GetCurrentProcess", "GetModuleFileNameW", "QueueUserWorkItem", "MultiByteToWideChar", "GetLastError", "HeapAlloc", "LocalFree", "GetProcessHeap", "WideCharToMultiByte", "WriteConsoleW", "CreateFileW", "CloseHandle", "HeapReAlloc", "HeapSize", "SetFilePointerEx", "SetStdHandle", "GetConsoleMode", "GetConsoleOutputCP", "WriteFile", "FlushFileBuffers", "GetStringTypeW", "QueryPerformanceCounter", "GetCurrentProcessId", "GetCurrentThreadId", "GetSystemTimeAsFileTime", "InitializeSListHead", "RtlCaptureContext", "RtlLookupFunctionEntry", "RtlVirtualUnwind", "IsDebuggerPresent", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetStartupInfoW", "IsProcessorFeaturePresent", "GetModuleHandleW", "TerminateProcess", "RtlUnwindEx", "RtlPcToFileHeader", "RaiseException", "InterlockedFlushSList", "SetLastError", "EncodePointer", "EnterCriticalSection", "LeaveCriticalSection", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "FreeLibrary", "GetProcAddress", "LoadLibraryExW", "ExitProcess", "GetModuleHandleExW", "FlsAlloc", "FlsGetValue", "FlsSetValue", "FlsFree", "LCMapStringW", "GetStdHandle", "GetFileType", "FindClose", "FindFirstFileExW", "FindNextFileW", "IsValidCodePage", "GetACP", "GetCPInfo", "GetCommandLineA", "GetCommandLineW", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "ORDINAL 9" ], "ms": { "pe": { "entry": 47240.0, "machine": 34404.0, "checksum": 0.0, "subsystem": 3.0, "timestamp": 1751032744.0, "image_base": 6442450944.0, "entry_section": ".text", "size_of_image": 167936.0, "cfg_check_func": 6442611304.0, "file_alignment": 512.0, "cfg_guard_flags": 256.0, "characteristics": 8226.0, "security_cookie": 6442590272.0, "size_of_headers": 1024.0, "export_timestamp": 4294967295.0, "import_dll_count": 2.0, "computed_checksum": 173741.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 352.0, "has_export_timestamp": true, "linker_major_version": 14.0, "linker_minor_version": 43.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "api_hashing_indicator_count": 1.0 }, "file": { "size": 153088.0 }, "binary": { "code_size": 135168.0, "func_count": 451.0, "code_entropy": 6.3, "data_entropy": 4.49, "export_count": 1.0, "func_density": 3.42, "import_count": 75.0, "string_count": 270.0, "avg_func_size": 213.76, "section_count": 5.0, "avg_complexity": 5.32, "import_density": 0.57, "max_complexity": 25.0, "string_density": 2.05, "overall_entropy": 4.93, "avg_basic_blocks": 8.44, "avg_section_size": 30412.8, "dependency_count": 2.0, "entropy_variance": 0.79, "wx_section_count": 1.0, "avg_string_length": 15.75, "complexity_per_kb": 0.04, "max_string_length": 94.0, "wide_string_count": 71.0, "avg_string_entropy": 3.07, "code_to_data_ratio": 8.0, "data_to_file_ratio": 0.04, "text_to_file_ratio": 0.88, "total_basic_blocks": 211.0, "func_analysis_depth": 2.0, "string_length_stddev": 11.9, "largest_section_ratio": 0.88, "sentence_string_count": 33.0, "sentence_string_ratio": 0.12, "writable_section_count": 2.0, "behavioral_import_ratio": 0.03, "entry_in_writable_region": true, "executable_section_count": 1.0, "high_entropy_string_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 392, ".text" ], [ 432, ".data" ], [ 472, ".pdata" ], [ 511, "@.idata" ], [ 551, "@.reloc" ], [ 1160, "expand 32-byte k" ], [ 1240, "Unknown exception" ], [ 1656, "bad exception" ], [ 3504, "__cdecl" ], [ 3512, "__pascal" ], [ 3528, "__stdcall" ], [ 3544, "__thiscall" ], [ 3560, "__fastcall" ], [ 3576, "__vectorcall" ], [ 3592, "__clrcall" ], [ 3604, "__eabi" ], [ 3616, "__swift_1" ], [ 3632, "__swift_2" ], [ 3648, "__swift_3" ], [ 3672, "__restrict" ], [ 3688, "__unaligned" ], [ 3704, "restrict(" ], [ 3728, "delete" ], [ 3768, "operator" ], [ 3960, "`local static guard'" ], [ 4000, "`vbase destructor'" ], [ 4024, "`vector deleting destructor'" ], [ 4056, "`default constructor closure'" ], [ 4088, "`scalar deleting destructor'" ], [ 4120, "`vector constructor iterator'" ], [ 4152, "`vector destructor iterator'" ], [ 4184, "`vector vbase constructor iterator'" ], [ 4224, "`virtual displacement map'" ], [ 4256, "`eh vector constructor iterator'" ], [ 4296, "`eh vector destructor iterator'" ], [ 4328, "`eh vector vbase constructor iterator'" ], [ 4368, "`copy constructor closure'" ], [ 4400, "`udt returning'" ], [ 4432, "`local vftable'" ], [ 4448, "`local vftable constructor closure'" ], [ 4496, "delete[]" ], [ 4512, "`omni callsig'" ], [ 4528, "`placement delete closure'" ], [ 4560, "`placement delete[] closure'" ], [ 4592, "`managed vector constructor iterator'" ], [ 4632, "`managed vector destructor iterator'" ], [ 4672, "`eh vector copy constructor iterator'" ], [ 4712, "`eh vector vbase copy constructor iterator'" ], [ 4760, "`dynamic initializer for '" ], [ 4792, "`dynamic atexit destructor for '" ], [ 4832, "`vector copy constructor iterator'" ], [ 4872, "`vector vbase copy constructor iterator'" ], [ 4920, "`managed vector copy constructor iterator'" ], [ 4968, "`local static thread guard'" ], [ 5016, "operator co_await" ], [ 5040, "operator\u003c=\u003e" ], [ 5056, "Type Descriptor'" ], [ 5080, "Base Class Descriptor at (" ], [ 5112, "Base Class Array'" ], [ 5136, "Class Hierarchy Descriptor'" ], [ 5168, "Complete Object Locator'" ], [ 5200, "`anonymous namespace'" ], [ 5248, "wide", "api-ms-win-core-fibers-l1-1-1" ], [ 5312, "wide", "api-ms-win-core-synch-l1-2-0" ], [ 5376, "wide", "kernel32" ], [ 5400, "wide", "api-ms-" ], [ 5424, "FlsAlloc" ], [ 5448, "FlsFree" ], [ 5464, "FlsGetValue" ], [ 5488, "FlsSetValue" ], [ 5512, "InitializeCriticalSectionEx" ], [ 5848, "wide", "mscoree.dll" ], [ 5872, "CorExitProcess" ], [ 7304, "MM/dd/yy" ], [ 7320, "dddd, MMMM dd, yyyy" ], [ 7416, "wide", "Sunday" ], [ 7432, "wide", "Monday" ], [ 7448, "wide", "Tuesday" ], [ 7464, "wide", "Wednesday" ], [ 7488, "wide", "Thursday" ], [ 7512, "wide", "Friday" ], [ 7528, "wide", "Saturday" ], [ 7648, "wide", "January" ], [ 7664, "wide", "February" ], [ 7688, "wide", "March" ], [ 7704, "wide", "April" ], [ 7720, "wide", "June" ], [ 7736, "wide", "July" ], [ 7752, "wide", "August" ], [ 7768, "wide", "September" ], [ 7792, "wide", "October" ], [ 7808, "wide", "November" ], [ 7832, "wide", "December" ], [ 7872, "wide", "MM/dd/yy" ], [ 7896, "wide", "dddd, MMMM dd, yyyy" ], [ 8160, "wide", "api-ms-win-core-datetime-l1-1-1" ], [ 8224, "wide", "api-ms-win-core-file-l1-2-4" ], [ 8280, "wide", "api-ms-win-core-file-l1-2-2" ], [ 8336, "wide", "api-ms-win-core-localization-l1-2-1" ], [ 8416, "wide", "api-ms-win-core-localization-obsolete-l1-2-0" ], [ 8512, "wide", "api-ms-win-core-processthreads-l1-1-2" ], [ 8592, "wide", "api-ms-win-core-string-l1-1-0" ], [ 8656, "wide", "api-ms-win-core-sysinfo-l1-2-1" ], [ 8720, "wide", "api-ms-win-core-winrt-l1-1-0" ], [ 8784, "wide", "api-ms-win-core-xstate-l2-1-0" ], [ 8848, "wide", "api-ms-win-rtcore-ntuser-window-l1-1-0" ], [ 8928, "wide", "api-ms-win-security-systemfunctions-l1-1-0" ], [ 9024, "wide", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], [ 9104, "wide", "ext-ms-win-ntuser-windowstation-l1-1-0" ], [ 9184, "wide", "advapi32" ], [ 9208, "wide", "kernelbase" ], [ 9248, "wide", "api-ms-win-appmodel-runtime-l1-1-2" ], [ 9320, "wide", "user32" ], [ 9336, "wide", "ext-ms-" ], [ 9360, "AreFileApisANSI" ], [ 9392, "LCMapStringEx" ], [ 9416, "LocaleNameToLCID" ], [ 9440, "AppPolicyGetProcessTerminationMethod" ], [ 10416, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 10800, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 22320, "wide", "az-az-cyrl" ], [ 22344, "wide", "az-az-latn" ], [ 22416, "wide", "bs-ba-latn" ], [ 22584, "wide", "div-mv" ], [ 23560, "wide", "kok-in" ], [ 23912, "wide", "quz-bo" ], [ 23928, "wide", "quz-ec" ], [ 23944, "wide", "quz-pe" ], [ 24088, "wide", "sma-no" ], [ 24104, "wide", "sma-se" ], [ 24120, "wide", "smj-no" ], [ 24136, "wide", "smj-se" ], [ 24152, "wide", "smn-fi" ], [ 24168, "wide", "sms-fi" ], [ 24200, "wide", "sr-ba-cyrl" ], [ 24224, "wide", "sr-ba-latn" ], [ 24248, "wide", "sr-sp-cyrl" ], [ 24272, "wide", "sr-sp-latn" ], [ 24344, "wide", "syr-sy" ], [ 24488, "wide", "uz-uz-cyrl" ], [ 24512, "wide", "uz-uz-latn" ], [ 24568, "wide", "zh-chs" ], [ 24584, "wide", "zh-cht" ], [ 25233, "TUUUU" ], [ 31536, "log10" ], [ 31596, "Sunday" ], [ 31604, "Monday" ], [ 31616, "Tuesday" ], [ 31624, "Wednesday" ], [ 31640, "Thursday" ], [ 31652, "Friday" ], [ 31664, "Saturday" ], [ 31728, "January" ], [ 31736, "February" ], [ 31748, "March" ], [ 31756, "April" ], [ 31764, "June" ], [ 31772, "July" ], [ 31780, "August" ], [ 31792, "September" ], [ 31808, "October" ], [ 31816, "November" ], [ 31832, "December" ], [ 31848, "wide", "\u003cNULL\u003e" ], [ 31872, "wide", "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 31952, "wide", "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 32056, "url", "\u0002X:\u0002X:\u0002X:\u0002X:\u0002X:\u0002X" ], [ 32120, "wide", "SHA256" ], [ 42873, "UVWAVH" ], [ 43890, "VWAVH" ], [ 46442, "UWAVH" ], [ 46503, "Genu" ], [ 54883, "UVWATAUAVAWH" ], [ 55296, "@USVWATAUAVAWH" ], [ 57170, "E E3" ], [ 61199, "IH9B" ], [ 61628, "@SVWATAUAVAWH" ], [ 63311, "SVWATAUAVAWH" ], [ 64632, "t$ WATAUAVAWH" ], [ 67686, "N0E3" ], [ 73696, "@UATAUAVAWH" ], [ 83760, "@USVWATAUAVH" ], [ 87363, "l$ VWATAVAWH" ], [ 88655, "f90t" ], [ 94386, "VWAV" ], [ 103016, "@SUVWATAVAWH" ], [ 104091, "USVWAVH" ], [ 126929, "vKfffff" ], [ 128336, "ob0f" ], [ 136066, "loader_moder.dll" ], [ 136083, "CalculateSize" ], [ 137386, "abcdefghijklmnopqrstuvwxyz" ], [ 137418, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 139729, "160.7.240.10:24578" ], [ 141808, ".?AV_com_error@@" ], [ 141848, ".?AVexception@std@@" ], [ 141888, ".?AVbad_exception@std@@" ], [ 141928, ".?AVtype_info@@" ], [ 149322, "GetOEMCP" ], [ 149334, "HeapFree" ], [ 149346, "GetCurrentProcess" ], [ 149366, "GetModuleFileNameW" ], [ 149388, "QueueUserWorkItem" ], [ 149408, "MultiByteToWideChar" ], [ 149430, "GetLastError" ], [ 149446, "HeapAlloc" ], [ 149458, "LocalFree" ], [ 149470, "GetProcessHeap" ], [ 149488, "WideCharToMultiByte" ], [ 149508, "KERNEL32.dll" ], [ 149522, "OLEAUT32.dll" ], [ 149538, "QueryPerformanceCounter" ], [ 149564, "GetCurrentProcessId" ], [ 149586, "GetCurrentThreadId" ], [ 149608, "GetSystemTimeAsFileTime" ], [ 149634, "InitializeSListHead" ], [ 149656, "RtlCaptureContext" ], [ 149676, "RtlLookupFunctionEntry" ], [ 149702, "RtlVirtualUnwind" ], [ 149722, "IsDebuggerPresent" ], [ 149742, "UnhandledExceptionFilter" ], [ 149770, "SetUnhandledExceptionFilter" ], [ 149800, "GetStartupInfoW" ], [ 149818, "IsProcessorFeaturePresent" ], [ 149846, "GetModuleHandleW" ], [ 149866, "TerminateProcess" ], [ 149886, "RtlUnwindEx" ], [ 149900, "RtlPcToFileHeader" ], [ 149920, "RaiseException" ], [ 149938, "InterlockedFlushSList" ], [ 149962, "SetLastError" ], [ 149978, "EncodePointer" ], [ 149994, "EnterCriticalSection" ], [ 150018, "LeaveCriticalSection" ], [ 150042, "DeleteCriticalSection" ], [ 150066, "InitializeCriticalSectionAndSpinCount" ], [ 150106, "TlsAlloc" ], [ 150118, "TlsGetValue" ], [ 150132, "TlsSetValue" ], [ 150146, "TlsFree" ], [ 150156, "FreeLibrary" ], [ 150170, "GetProcAddress" ], [ 150188, "LoadLibraryExW" ], [ 150206, "ExitProcess" ], [ 150220, "GetModuleHandleExW" ], [ 150292, "LCMapStringW" ], [ 150308, "GetStdHandle" ], [ 150324, "GetFileType" ], [ 150338, "FindClose" ], [ 150350, "FindFirstFileExW" ], [ 150370, "FindNextFileW" ], [ 150386, "IsValidCodePage" ], [ 150414, "GetCPInfo" ], [ 150426, "GetCommandLineA" ], [ 150444, "GetCommandLineW" ] ], "sz": 153088, "ts": [ { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "In-code MZ/PE compare immediate", "e": [ "MZf9\bu3HcH\u003cH\u0003ȁ9PE" ], "i": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "f593508039831238754043473ebe0ea7cf3f0299ee39dd26787bb978fc5825a3.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 451.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "f593508039831238754043473ebe0ea7cf3f0299ee39dd26787bb978fc5825a3.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1751032744.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.93" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 167936.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "FlsGetValue", "TlsGetValue", "FlsSetValue", "TlsSetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 270.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 0.75, "d": "Binary exports one symbol", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/symbols/exports::single-export", "l": 1 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "41", "51", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.07" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.07" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.32" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.30" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetEnvironmentStringsW", "api-ms-win-core-string-l1-1-0", "FreeEnvironmentStringsW", "LCMapStringEx", "LCMapStringW", "GetStringTypeW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cNULL\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 451.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1027", "c": 0.4000000059604645, "d": "RC4 S-box initialization pattern (64-byte sequential table)", "e": [ "00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A" ], "i": "objectives/anti-static/obfuscation/encoding/stream::rc4-sbox-init", "l": 1, "m": "C0027.001" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.04" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-fibers-l1-1-1", "api-ms-", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-file-l1-2-4", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-security-systemfunctions-l1-1-0" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.93" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8799999952316284, "d": "Wide string count over sixty", "e": [ "binary.wide_string_count = 71.00" ], "i": "objectives/evasion/process/injection/vb6::wide-string-count-60", "l": 1, "m": "C0041" }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 451.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 4294967295.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "f593508039831238754043473ebe0ea7cf3f0299ee39dd26787bb978fc5825a3.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".text (size: 135168, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 75.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "160.7.240.10:24578" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 451.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.9200000166893005, "d": "External IPv4 endpoint in data section", "e": [ "160.7.240.10:24578" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-data-literal", "l": 1 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (Unicode)", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeSListHead", "UnhandledExceptionFilter", "GetCurrentProcessId", "InitializeCriticalSectionEx", "InterlockedFlushSList", "InitializeCriticalSectionAndSpinCount", "GetModuleHandleExW", "RtlLookupFunctionEntry", "MultiByteToWideChar", "WideCharToMultiByte", "GetSystemTimeAsFileTime", "GetModuleFileNameW", "AppPolicyGetProcessTerminationMethod", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Writable .text section (custom packer indicator)", "e": [ ".text (size: 135168, entropy: 6.30, perms: rwx)" ], "i": "metadata/binary/section/metrics::writable-text-section", "l": 4 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "ChaCha20/Salsa20 cipher constant", "e": [ "expand 32-byte k" ], "i": "micro-behaviors/crypto/symmetric/stream::chacha-salsa-constant", "l": 3 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_section_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetOEMCP, HeapFree, GetCurrentProcess, GetModuleFileNameW, QueueUserWorkItem, ... +69 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetModuleHandleExW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsGetValue", "FlsSetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Hardcoded external IPv4 address with port", "e": [ "160.7.240.10:24578", "LCMapStringW", "GetStringTypeW", "ORDINAL 9", "api-ms-win-core-string-l1-1-0", "GetEnvironmentStringsW", "LCMapStringEx", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary", "l": 3 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedFlushSList", "InitializeSListHead" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1027.007", "c": 0.9200000166893005, "d": "Generic PEB+PE walk with multiplicative hash resolver (x64)", "e": [ "65 48 8b 04 25 60 00 00 00", "41", "B8 4D 5A 00 00", "48", "51" ], "i": "objectives/anti-static/obfuscation/imports::pe-walk-hash-resolver-x64", "l": 4, "m": "B0032.014" } ], "sha": "f593508039831238754043473ebe0ea7cf3f0299ee39dd26787bb978fc5825a3", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/f593508039831238754043473ebe0ea7cf3f0299ee39dd26787bb978fc5825a3.exe", "type": "pe" } ], "tv": "91363" } }