{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999004602432251, "class": 1 }, { "id": 1, "prob": 0.9999004602432251, "class": 0 } ], "prob": 0.99990046, "class": 1, "oprob": 0.99990046, "models": [ { "m": "az", "prob": 0.99810046, "class": 0 }, { "m": "az/native", "prob": 0.9997341, "class": 0 }, { "m": "az/pe", "prob": 0.9997497, "class": 2 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-07T07:09:29Z" }, "path": "38620", "raw": { "v": "4", "fs": [ { "f": "KO₆(As₉Er₇AlC₃CoS)H₇(Po₄Cm₃F₃HfOs₂DbDs)Md₂(Bi₉Si)", "k": { "hash.imp": "4b7df1510b83d806b44846742a42fa8f", "pe.timestamp": 1300980193, "hash.authenti": "5b84bde76f7fafc898a4c94258bcbaaa1fb97cc6249e143f99b05a21e14707f1", "hash.rich_header": "867da6548edcac91f072733641ff1a50c7e0289e1b8731251d535973d4b1d000", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.rich_header.xor_key": "0x33981bfe", "pe.data_directories[0].rva": 42832, "pe.data_directories[1].rva": 266240, "pe.data_directories[2].rva": 40960, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 24040, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 332, "pe.version_info.company_name": "(", "pe.version_info.file_version": "1, 0, 0, 0", "pe.rich_header_compids[0].count": 7, "pe.rich_header_compids[1].count": 1, "pe.rich_header_compids[2].count": 20, "pe.rich_header_compids[3].count": 90, "pe.rich_header_compids[4].count": 7, "pe.rich_header_compids[5].count": 85, "pe.rich_header_compids[6].count": 5, "pe.rich_header_compids[7].count": 1, "pe.version_info.legal_copyright": "Copyright 2010", "pe.version_info.product_version": "1, 0, 0, 0", "binary.top_complex_unnamed[0].cc": 111, "binary.top_complex_unnamed[1].cc": 47, "binary.top_complex_unnamed[2].cc": 47, "binary.top_complex_unnamed[3].cc": 43, "binary.top_complex_unnamed[4].cc": 41, "binary.top_complex_unnamed[5].cc": 39, "binary.top_complex_unnamed[6].cc": 38, "binary.top_complex_unnamed[7].cc": 36, "pe.rich_header_compids[1].compid": 793723, "pe.rich_header_compids[2].compid": 924803, "pe.rich_header_compids[3].compid": 665142, "pe.rich_header_compids[4].compid": 1253218, "pe.rich_header_compids[5].compid": 65536, "pe.rich_header_compids[6].compid": 730678, "pe.rich_header_compids[7].compid": 394951, "pe.version_info.file_description": "6\u000b\u0001FileVersion", "binary.top_complex_unnamed[0].bbs": 193, "binary.top_complex_unnamed[1].bbs": 33, "binary.top_complex_unnamed[2].bbs": 33, "binary.top_complex_unnamed[3].bbs": 73, "binary.top_complex_unnamed[4].bbs": 71, "binary.top_complex_unnamed[5].bbs": 65, "binary.top_complex_unnamed[6].bbs": 65, "binary.top_complex_unnamed[7].bbs": 65, "pe.rich_header_compids[0].product": "Unknown", "pe.rich_header_compids[5].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x402f3b", "binary.top_complex_unnamed[0].size": 1918, "binary.top_complex_unnamed[1].addr": "0x4039a0", "binary.top_complex_unnamed[1].size": 821, "binary.top_complex_unnamed[2].addr": "0x407f90", "binary.top_complex_unnamed[2].size": 821, "binary.top_complex_unnamed[3].addr": "0x407005", "binary.top_complex_unnamed[3].size": 719, "binary.top_complex_unnamed[4].addr": "0x40434f", "binary.top_complex_unnamed[4].size": 436, "binary.top_complex_unnamed[5].addr": "0x409381", "binary.top_complex_unnamed[5].size": 815, "binary.top_complex_unnamed[6].addr": "0x4058db", "binary.top_complex_unnamed[6].size": 777, "binary.top_complex_unnamed[7].addr": "0x407817", "binary.top_complex_unnamed[7].size": 517, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": "hdata", "pe.section_characteristics[4].name": "qdata", "pe.section_characteristics[5].name": "edata", "pe.section_characteristics[6].name": "ddata", "pe.section_characteristics[7].name": "cdata", "pe.section_characteristics[8].name": ".rsrc", "pe.rich_header.entries[0].use_count": 7, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[2].use_count": 20, "pe.rich_header.entries[3].use_count": 90, "pe.rich_header.entries[4].use_count": 7, "pe.rich_header.entries[5].use_count": 85, "pe.rich_header.entries[6].use_count": 5, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[1].product_id": 12, "pe.rich_header.entries[2].product_id": 14, "pe.rich_header.entries[3].product_id": 10, "pe.rich_header.entries[4].product_id": 19, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 11, "pe.rich_header.entries[7].product_id": 6, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 7291, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 7299, "pe.rich_header.entries[2].product_name": "Export_VC2003", "pe.rich_header.entries[3].build_number": 9782, "pe.rich_header.entries[3].product_name": "Linker_v6", "pe.rich_header.entries[4].build_number": 8034, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 9782, "pe.rich_header.entries[6].product_name": "Cvt_Omf", "pe.rich_header.entries[7].build_number": 1735, "pe.rich_header.entries[7].product_name": "Cvt_Pgo_VS_v6_or_earlier", "pe.section_characteristics[0].raw_size": 36864, "pe.section_characteristics[1].raw_size": 4096, "pe.section_characteristics[2].raw_size": 192512, "pe.section_characteristics[3].raw_size": 4096, "pe.section_characteristics[4].raw_size": 4096, "pe.section_characteristics[5].raw_size": 4096, "pe.section_characteristics[6].raw_size": 4096, "pe.section_characteristics[7].raw_size": 4096, "pe.section_characteristics[8].raw_size": 24576, "pe.section_characteristics[0].virtual_size": 35200, "pe.section_characteristics[1].virtual_size": 3760, "pe.section_characteristics[2].virtual_size": 198312, "pe.section_characteristics[3].virtual_size": 4, "pe.section_characteristics[4].virtual_size": 4, "pe.section_characteristics[5].virtual_size": 4, "pe.section_characteristics[6].virtual_size": 4, "pe.section_characteristics[7].virtual_size": 4, "pe.section_characteristics[8].virtual_size": 24040, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 40960, "pe.section_characteristics[2].virtual_address": 45056, "pe.section_characteristics[3].virtual_address": 245760, "pe.section_characteristics[4].virtual_address": 249856, "pe.section_characteristics[5].virtual_address": 253952, "pe.section_characteristics[6].virtual_address": 258048, "pe.section_characteristics[7].virtual_address": 262144, "pe.section_characteristics[8].virtual_address": 266240, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "c0000040", "pe.section_characteristics[4].characteristics_hex": "c0000040", "pe.section_characteristics[5].characteristics_hex": "c0000040", "pe.section_characteristics[6].characteristics_hex": "c0000040", "pe.section_characteristics[7].characteristics_hex": "c0000040", "pe.section_characteristics[8].characteristics_hex": "40000040" }, "x": 119, "id": 0, "is": [ "WinExec", "GetModuleFileNameA", "GetTempPathA", "CloseHandle", "CreateFileA", "GetVersionExA", "Sleep", "SetEnvironmentVariableA", "CompareStringW", "CompareStringA", "GetStringTypeW", "GetStringTypeA", "LCMapStringW", "LCMapStringA", "MultiByteToWideChar", "ReadFile", "SetEndOfFile", "LoadLibraryA", "GetTimeZoneInformation", "GetSystemTime", "GetLocalTime", "GetModuleHandleA", "GetStartupInfoA", "GetCommandLineA", "GetVersion", "ExitProcess", "GetCurrentThreadId", "TlsSetValue", "TlsAlloc", "SetLastError", "TlsGetValue", "GetLastError", "EnterCriticalSection", "LeaveCriticalSection", "HeapFree", "WriteFile", "InitializeCriticalSection", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "FreeEnvironmentStringsA", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStrings", "GetEnvironmentStringsW", "SetHandleCount", "GetStdHandle", "GetFileType", "DeleteCriticalSection", "GetEnvironmentVariableA", "HeapDestroy", "HeapCreate", "VirtualFree", "RtlUnwind", "HeapAlloc", "VirtualAlloc", "HeapReAlloc", "SetStdHandle", "FlushFileBuffers", "SetFilePointer", "InterlockedDecrement", "InterlockedIncrement", "GetCPInfo", "GetACP", "GetOEMCP", "GetProcAddress", "CreateWindowExA", "DefWindowProcA", "DispatchMessageA", "TranslateMessage", "GetMessageA", "ShowWindow", "RegisterClassExA", "PostQuitMessage", "StrStrA", "URLDownloadToFileA", "SHGetValueA", "SHSetValueA" ], "ms": { "pe": { "entry": 9911.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 24576.0, "subsystem": 2.0, "timestamp": 1300980193.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 6.19, "entry_section": ".text", "size_of_image": 290816.0, "file_alignment": 4096.0, "resource_count": 2.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON" ], "characteristics": 271.0, "has_rich_header": true, "overlay_padding": 64.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "import_dll_count": 5.0, "computed_checksum": 325500.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "api_hashing_indicator_count": 1.0 }, "file": { "size": 282688.0 }, "binary": { "code_size": 36864.0, "func_count": 84.0, "has_overlay": true, "code_entropy": 6.59, "data_entropy": 1.61, "func_density": 2.33, "import_count": 78.0, "overlay_size": 64.0, "string_count": 314.0, "avg_func_size": 297.64, "overlay_ratio": 0.0, "section_count": 9.0, "avg_complexity": 13.46, "import_density": 2.17, "max_complexity": 111.0, "string_density": 8.72, "overall_entropy": 2.67, "overlay_entropy": 3.75, "avg_basic_blocks": 21.67, "avg_section_size": 30947.55, "dependency_count": 5.0, "entropy_variance": 3.01, "avg_string_length": 12.67, "complexity_per_kb": 0.37, "max_string_length": 64.0, "wide_string_count": 12.0, "avg_string_entropy": 2.83, "code_to_data_ratio": 0.15, "data_to_file_ratio": 0.68, "rsrc_to_file_ratio": 0.09, "text_to_file_ratio": 0.13, "total_basic_blocks": 1820.0, "embedded_file_count": 1.0, "func_analysis_depth": 2.0, "string_length_stddev": 9.87, "embedded_binary_count": 1.0, "largest_section_ratio": 0.68, "sentence_string_count": 29.0, "sentence_string_ratio": 0.09, "writable_section_count": 6.0, "behavioral_import_ratio": 0.04, "executable_section_count": 1.0, "nonstandard_section_count": 4.0, "high_complexity_func_count": 1.0, "unnamed_complex_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, "hdata" ], [ 648, "qdata" ], [ 688, "edata" ], [ 728, "ddata" ], [ 768, "cdata" ], [ 808, ".rsrc" ], [ 5686, "SUVW3" ], [ 7801, "SVWP" ], [ 8249, "SVHW" ], [ 9580, "QSVW" ], [ 9942, "XSVW" ], [ 12640, "HHtpHHtl" ], [ 14352, "SVW3" ], [ 15576, "QQSV" ], [ 17081, "QQS3" ], [ 17145, "PSSW" ], [ 19138, "SVWU" ], [ 21094, "WQPWS" ], [ 26584, "QQSUVWj" ], [ 32232, "SUVW" ], [ 35731, "QSUV" ], [ 35787, "t/WWUPj" ], [ 36132, "PWPSS" ], [ 36715, "QQSVW3" ], [ 37680, "FGQPS" ], [ 38991, "QQV3" ], [ 41377, "700WP" ], [ 41393, "`h````" ], [ 41428, "wide", "(null)" ], [ 41444, "(null)" ], [ 41452, "__GLOBAL_HEAP_SELECTED" ], [ 41476, "__MSVCRT_HEAP_SELECT" ], [ 41500, "runtime error" ], [ 41520, "TLOSS error" ], [ 41536, "SING error" ], [ 41552, "DOMAIN error" ], [ 41568, "R6028\r\n- unable to initialize heap" ], [ 41575, "- unable to initialize heap" ], [ 41608, "R6027\r\n- not enough space for lowio initialization" ], [ 41615, "- not enough space for lowio initialization" ], [ 41664, "R6026\r\n- not enough space for stdio initialization" ], [ 41671, "- not enough space for stdio initialization" ], [ 41720, "R6025\r\n- pure virtual function call" ], [ 41727, "- pure virtual function call" ], [ 41760, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 41767, "- not enough space for _onexit/atexit table" ], [ 41816, "R6019\r\n- unable to open console device" ], [ 41823, "- unable to open console device" ], [ 41860, "R6018\r\n- unexpected heap error" ], [ 41867, "- unexpected heap error" ], [ 41896, "R6017\r\n- unexpected multithread lock error" ], [ 41903, "- unexpected multithread lock error" ], [ 41944, "R6016\r\n- not enough space for thread data" ], [ 41951, "- not enough space for thread data" ], [ 41988, "abnormal program termination" ], [ 42024, "R6009\r\n- not enough space for environment" ], [ 42031, "- not enough space for environment" ], [ 42068, "R6008\r\n- not enough space for arguments" ], [ 42075, "- not enough space for arguments" ], [ 42112, "R6002\r\n- floating point not loaded" ], [ 42119, "- floating point not loaded" ], [ 42152, "Microsoft Visual C++ Runtime Library" ], [ 42196, "Runtime Error!\n\nProgram:" ], [ 42228, "\u003cprogram name unknown\u003e" ], [ 42280, "SunMonTueWedThuFriSat" ], [ 42304, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 42376, "GetLastActivePopup" ], [ 42396, "GetActiveWindow" ], [ 42412, "MessageBoxA" ], [ 42424, "user32.dll" ], [ 42520, "dddd, MMMM dd, yyyy" ], [ 42556, "December" ], [ 42568, "November" ], [ 42580, "October" ], [ 42588, "September" ], [ 42600, "August" ], [ 42608, "July" ], [ 42616, "June" ], [ 42624, "April" ], [ 42632, "March" ], [ 42640, "February" ], [ 42652, "January" ], [ 42708, "Saturday" ], [ 42720, "Friday" ], [ 42728, "Thursday" ], [ 42740, "Wednesday" ], [ 42752, "Tuesday" ], [ 42760, "Monday" ], [ 42768, "Sunday" ], [ 43286, "WinExec" ], [ 43296, "GetModuleFileNameA" ], [ 43318, "GetTempPathA" ], [ 43334, "CloseHandle" ], [ 43348, "CreateFileA" ], [ 43362, "GetVersionExA" ], [ 43378, "Sleep" ], [ 43384, "KERNEL32.dll" ], [ 43400, "DefWindowProcA" ], [ 43418, "PostQuitMessage" ], [ 43436, "RegisterClassExA" ], [ 43456, "ShowWindow" ], [ 43470, "CreateWindowExA" ], [ 43488, "TranslateMessage" ], [ 43508, "DispatchMessageA" ], [ 43528, "GetMessageA" ], [ 43540, "USER32.dll" ], [ 43562, "SHELL32.dll" ], [ 43576, "URLDownloadToFileA" ], [ 43596, "urlmon.dll" ], [ 43610, "SHGetValueA" ], [ 43624, "SHSetValueA" ], [ 43636, "SHLWAPI.dll" ], [ 43650, "GetTimeZoneInformation" ], [ 43676, "GetSystemTime" ], [ 43692, "GetLocalTime" ], [ 43708, "GetModuleHandleA" ], [ 43728, "GetStartupInfoA" ], [ 43746, "GetCommandLineA" ], [ 43764, "GetVersion" ], [ 43778, "ExitProcess" ], [ 43792, "GetCurrentThreadId" ], [ 43814, "TlsSetValue" ], [ 43828, "TlsAlloc" ], [ 43840, "SetLastError" ], [ 43856, "TlsGetValue" ], [ 43870, "GetLastError" ], [ 43886, "EnterCriticalSection" ], [ 43910, "LeaveCriticalSection" ], [ 43934, "HeapFree" ], [ 43946, "WriteFile" ], [ 43958, "InitializeCriticalSection" ], [ 43986, "TerminateProcess" ], [ 44006, "GetCurrentProcess" ], [ 44026, "UnhandledExceptionFilter" ], [ 44054, "FreeEnvironmentStringsA" ], [ 44080, "FreeEnvironmentStringsW" ], [ 44106, "WideCharToMultiByte" ], [ 44128, "GetEnvironmentStrings" ], [ 44152, "GetEnvironmentStringsW" ], [ 44178, "SetHandleCount" ], [ 44196, "GetStdHandle" ], [ 44212, "GetFileType" ], [ 44226, "DeleteCriticalSection" ], [ 44250, "GetEnvironmentVariableA" ], [ 44276, "HeapDestroy" ], [ 44290, "HeapCreate" ], [ 44304, "VirtualFree" ], [ 44318, "RtlUnwind" ], [ 44330, "HeapAlloc" ], [ 44342, "VirtualAlloc" ], [ 44358, "HeapReAlloc" ], [ 44372, "SetStdHandle" ], [ 44388, "FlushFileBuffers" ], [ 44408, "SetFilePointer" ], [ 44426, "InterlockedDecrement" ], [ 44450, "InterlockedIncrement" ], [ 44474, "GetCPInfo" ], [ 44496, "GetOEMCP" ], [ 44508, "GetProcAddress" ], [ 44526, "LoadLibraryA" ], [ 44542, "SetEndOfFile" ], [ 44558, "ReadFile" ], [ 44570, "MultiByteToWideChar" ], [ 44592, "LCMapStringA" ], [ 44608, "LCMapStringW" ], [ 44624, "GetStringTypeA" ], [ 44642, "GetStringTypeW" ], [ 44660, "CompareStringA" ], [ 44678, "CompareStringW" ], [ 44696, "SetEnvironmentVariableA" ], [ 45704, "pdata" ], [ 45784, "ndata" ], [ 45824, "mdata" ], [ 45944, "idata" ], [ 50015, "df_fYZP" ], [ 52061, "/dfZ" ], [ 52528, "SVWSfQf" ], [ 53804, "SSPR" ], [ 55624, "QRSSSSS" ], [ 58563, "SVWfPQV" ], [ 60105, "SVW2" ], [ 60198, "DZYX" ], [ 60336, "PQRVW" ], [ 60921, "SVWPQ" ], [ 61217, "PQVW" ], [ 62159, "PQVR" ], [ 63619, "SVWfRPf" ], [ 64597, "QRPV" ], [ 65956, "5P6B" ], [ 66083, "XPVSS" ], [ 70822, "GetSystemDirectoryA" ], [ 70866, "FreeLibrary" ], [ 70956, "WaitForSingleObject" ], [ 70978, "CreateProcessA" ], [ 71026, "SetFileTime" ], [ 71040, "GetFileAttributesExA" ], [ 71112, "DuplicateHandle" ], [ 71150, "OpenProcess" ], [ 71190, "SendMessageTimeoutA" ], [ 71212, "RegisterWindowMessageA" ], [ 71238, "GetClassNameA" ], [ 71254, "PostMessageA" ], [ 71270, "EnumChildWindows" ], [ 71290, "GetWindowThreadProcessId" ], [ 71318, "EnumWindows" ], [ 71352, "GetDesktopWindow" ], [ 71506, "CloseServiceHandle" ], [ 71528, "DeleteService" ], [ 71544, "OpenServiceA" ], [ 71560, "OpenSCManagerA" ], [ 71578, "StartServiceA" ], [ 71594, "RegCloseKey" ], [ 71608, "RegQueryValueExA" ], [ 71628, "RegOpenKeyExA" ], [ 71644, "CreateServiceA" ], [ 71662, "ConvertSidToStringSidA" ], [ 71688, "LookupAccountNameA" ], [ 71710, "GetUserNameA" ], [ 71724, "ADVAPI32.dll" ], [ 71740, "SHGetSpecialFolderPathA" ], [ 71778, "CoUninitialize" ], [ 71796, "CoInitialize" ], [ 71810, "ole32.dll" ], [ 71820, "OLEAUT32.dll" ], [ 71876, "sprintf" ], [ 71886, "??3@YAXPAX@Z" ], [ 71910, "??2@YAPAXI@Z" ], [ 71926, "wcslen" ], [ 71936, "atoi" ], [ 71964, "__CxxFrameHandler" ], [ 71984, "_access" ], [ 71994, "fclose" ], [ 72004, "fflush" ], [ 72014, "fwrite" ], [ 72024, "fopen" ], [ 72040, "time" ], [ 72046, "MSVCRT.dll" ], [ 72068, "_XcptFilter" ], [ 72082, "exit" ], [ 72090, "_acmdln" ], [ 72100, "__getmainargs" ], [ 72116, "_initterm" ], [ 72128, "__setusermatherr" ], [ 72148, "_adjust_fdiv" ], [ 72164, "__p__commode" ], [ 72180, "__p__fmode" ], [ 72194, "__set_app_type" ], [ 72212, "_except_handler3" ], [ 72232, "_controlfp" ], [ 72246, "ImageNtHeader" ], [ 72260, "dbghelp.dll" ], [ 72272, "VERSION.dll" ], [ 72324, "_strlwr" ] ], "sz": 282688, "ts": [ { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0xb030 (~180224 bytes)", "e": [ "kind=Pe32 estimated_size=180224" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.67", "binary.overall_entropy = 1.74" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 290816.00", "pe.size_of_image = 180224.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "38620!!embedded:pe:6_FileVersion@0xb030", "38620" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00", "pe.import_dll_count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1300980193.00", "pe.timestamp = 1300977564.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 10.52", "binary.avg_complexity = 13.46" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (ANSI)", "e": [ "GetMessageA" ], "i": "micro-behaviors/os/message/queue::get-message-a", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.83", "binary.avg_string_entropy = 2.67" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1055.002", "c": 0.8500000238418579, "d": "OpenProcess API name in strings", "e": [ "OpenProcess" ], "i": "objectives/evasion/process/injection/dll::open-process-text", "l": 3 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ConvertSidToStringSidA", "GetEnvironmentStringsW", "GetStringTypeW", "LCMapStringA", "CompareStringW", "GetStringTypeA", "LCMapStringW", "StringFileInfo", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "FreeEnvironmentStringsW", "CompareStringA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.59)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.949999988079071, "d": "PE compile timestamp far in future", "e": [ "pe.timestamp = 1300980193.00", "pe.timestamp = 1300977564.00" ], "i": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "l": 2 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "URLDownloadToFile API name as string", "e": [ "URLDownloadToFileA" ], "i": "micro-behaviors/communications/http/get::url-download-to-file-str", "l": 3 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1820.00", "binary.total_basic_blocks = 858.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 173.00", "binary.string_count = 314.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 84.00", "binary.func_count = 58.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 90.00", "binary.import_count = 78.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 84.00", "binary.func_count = 58.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 58.00", "binary.func_count = 84.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 78.00", "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "URLDownloadToFileA" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "URLDownloadToFileA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 90.00", "binary.import_count = 78.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66", "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 78.00", "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1, 0, 0, 0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "WinExec command execution API", "e": [ "WinExec" ], "i": "micro-behaviors/process/create/exec::winexec", "l": 3 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 78.00", "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 3.75" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExA" ], "i": "micro-behaviors/ui/window/manage/control::register-class", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage/control::post-quit-message", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.67", "binary.overall_entropy = 1.74" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open service control manager", "e": [ "OpenSCManagerA" ], "i": "micro-behaviors/os/service/control::open-sc-manager", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Start Windows service", "e": [ "StartServiceA" ], "i": "micro-behaviors/os/service/control::start-service", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00", "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 4 }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 78.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "10 a0 40 00", "48 a0 40 00", "70 a0 40 00", "f8 a0 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetWindowThreadProcessId", "GetEnvironmentVariableA", "SetEnvironmentVariableA", "WideCharToMultiByte", "UnhandledExceptionFilter", "InterlockedDecrement", "GetTimeZoneInformation", "MultiByteToWideChar", "InitializeCriticalSection", "InterlockedIncrement", "GetSystemDirectoryA", "SunMonTueWedThuFriSat", "GetModuleFileNameA", "ConvertSidToStringSidA", "JanFebMarAprMayJunJulAugSepOctNovDec" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.68", "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariableA" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableA" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "High entropy .data section", "e": [ ".data (size: 192512, entropy: 6.16)", ".data (size: 118784, entropy: 7.38)" ], "i": "objectives/anti-static/obfuscation/payload/section::high-entropy-dot-data-section", "l": 4, "m": "B0032" }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Create Windows service", "e": [ "CreateServiceA" ], "i": "micro-behaviors/os/service/control::create-service", "l": 3 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1300980193.00", "pe.timestamp = 1300977564.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ "hdata", "pdata", "idata", "ddata", "mdata", "ndata", "edata", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", ".rdata+.data+hdata+qdata+edata+ddata+cdata = 588.9% of text (217088 / 36864 bytes)", "qdata", "cdata", ".rdata", "odata", ".data" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open existing service handle", "e": [ "OpenServiceA" ], "i": "micro-behaviors/os/service/control::open-service", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 9.00", "binary.section_count = 11.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "ndata", "ddata", "hdata", "idata", "edata", "mdata", ".rdata+.data+hdata+qdata+edata+ddata+cdata = 588.9% of text (217088 / 36864 bytes)", "pdata", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", "cdata", "odata", ".data", "qdata", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", "odata", "mdata", "hdata", "ndata", "idata", "pdata", "ddata", ".rdata", "qdata", "edata", "cdata", ".rdata+.data+hdata+qdata+edata+ddata+cdata = 588.9% of text (217088 / 36864 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.68", "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHGetValueA, SHSetValueA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (StrStrA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (WinExec, GetModuleFileNameA, GetTempPathA, CloseHandle, CreateFileA, ... +61 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links urlmon.dll (URLDownloadToFileA)", "e": [ "urlmon.dll" ], "i": "metadata/dylib::urlmon/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CreateWindowExA, DefWindowProcA, DispatchMessageA, TranslateMessage, GetMessageA, ... +3 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00", "binary.has_signature = 0.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "Enumerate child windows", "e": [ "EnumChildWindows" ], "i": "micro-behaviors/ui/window/manage/enumerate::enum-child-windows-import", "l": 2 }, { "c": 0.800000011920929, "d": "Convert SID to string representation", "e": [ "ConvertSidToStringSidA" ], "i": "micro-behaviors/os/group/lookup::convert-sid-to-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Wide string length", "e": [ "wcslen" ], "i": "micro-behaviors/data/string/library::wcslen", "l": 2 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage/enumerate::get-window-thread-process-id", "l": 2 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 3, "m": "C0014" }, { "a": "T1106", "c": 0.6000000238418579, "d": "EnumWindows / EnumChildWindows API", "e": [ "EnumWindows", "EnumChildWindows" ], "i": "objectives/evasion/process/injection/callback::enum-windows-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 90.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.69)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 4.50" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Close stdio file", "e": [ "fclose" ], "i": "micro-behaviors/os/stdio::fclose", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "a": "T1543.003", "c": 0.9300000071525574, "d": "Program can open Windows services", "e": [ "OpenServiceA" ], "i": "micro-behaviors/os/service/control::open-service-import", "l": 3 }, { "c": 0.75, "d": "String to integer conversion (atoi)", "e": [ "atoi" ], "i": "micro-behaviors/data/string/conversion::atoi", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve account name to SID", "e": [ "LookupAccountNameA" ], "i": "micro-behaviors/os/user/lookup::lookup-account-name", "l": 2 }, { "c": 0.8500000238418579, "d": "Parse PE NT headers via dbghelp", "e": [ "ImageNtHeader" ], "i": "micro-behaviors/fs/file/pe-inspect::image-nt-header", "l": 3 }, { "c": 0.800000011920929, "d": "Query file attributes and timestamps", "e": [ "GetFileAttributesExA" ], "i": "micro-behaviors/fs/file/timestamp::get-file-attributes-ex", "l": 2 }, { "c": 0.8199999928474426, "d": "Resolve special folder path ANSI", "e": [ "SHGetSpecialFolderPathA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-special-folder-path-a", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.8999999761581421, "d": "Find character in string", "e": [ "strchr" ], "i": "micro-behaviors/data/string/library::strchr", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "Find substring", "e": [ "strstr" ], "i": "micro-behaviors/data/string/library::strstr", "l": 2 }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage/enumerate::enum-windows", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 3 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "10 60 40 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Program opens service control manager", "e": [ "OpenSCManagerA" ], "i": "micro-behaviors/os/service/control::open-sc-manager-import", "l": 3 }, { "a": "T1543.003", "c": 0.9300000071525574, "d": "Program can start Windows services", "e": [ "StartServiceA" ], "i": "micro-behaviors/os/service/control::start-service-import", "l": 3 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8199999928474426, "d": "sprintf string formatting API", "e": [ "sprintf" ], "i": "micro-behaviors/fs/path/construct::sprintf-format-api", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Program can create Windows services", "e": [ "CreateServiceA" ], "i": "micro-behaviors/os/service/control::create-service-import", "l": 3 }, { "a": "T1543.003", "c": 0.8399999737739563, "d": "Delete installed service", "e": [ "DeleteService" ], "i": "micro-behaviors/os/service/control::delete-service", "l": 3 }, { "a": "T1033", "c": 0.8999999761581421, "d": "Query current username", "e": [ "GetUserNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-user-name", "l": 3 }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".data (entropy: 7.38, perms: rw-)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data (entropy: 7.38, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links dbghelp.dll (ImageNtHeader)", "e": [ "dbghelp.dll" ], "i": "metadata/dylib::dbghelp/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (LookupAccountNameA, DeleteService, OpenServiceA, OpenSCManagerA, StartServiceA, ... +7 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCRT.dll (strstr, strlwr, controlfp, except_handler3, set_app_type, ... +26 more)", "e": [ "MSVCRT.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 6, ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize, CoUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 90.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Large encoded configuration data section", "e": [ "cdata", "pdata", "idata", ".rdata", "odata", ".data", "edata", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", "ndata", "mdata", ".data (entropy: 7.38, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section", "l": 4, "m": "B0032" }, { "a": "T1543.003", "c": 0.9200000166893005, "d": "Service stop or delete chain", "e": [ "OpenServiceA", "DeleteService", "OpenSCManagerA" ], "i": "micro-behaviors/os/service/control::service-stop-control", "l": 3 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Windows service admin import cluster", "e": [ "OpenServiceA", "OpenSCManagerA", "StartServiceA", "CreateServiceA" ], "i": "micro-behaviors/os/service/control::service-admin-import-cluster", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1564.003", "c": 0.8500000238418579, "d": "Hidden WinExec process launch", "e": [ "10 60 40 00", "WinExec" ], "i": "micro-behaviors/process/create/flags::hidden-winexec", "l": 4 } ], "sha": "f79dccfc01b3c19d2e008d61bba90ee66908c386118e105e81e2d9350e7d861a", "path": "38620", "type": "pe" }, { "f": "O₄(As₈Er₆C₂Co)H₇(Po₄F₃HfOs₂Cm₂DbDs)Md₂(Bi₇Si)", "x": 80, "dp": 1, "id": 1, "is": [ "GetLastError", "SetFileTime", "GetFileAttributesExA", "WinExec", "GetModuleFileNameA", "DuplicateHandle", "GetCurrentProcess", "OpenProcess", "WriteFile", "GetStartupInfoA", "GetModuleHandleA", "CreateFileA", "GetSystemDirectoryA", "CreateProcessA", "WaitForSingleObject", "TerminateProcess", "CloseHandle", "LoadLibraryA", "GetProcAddress", "Sleep", "FreeLibrary", "WideCharToMultiByte", "GetVersionExA", "RegisterWindowMessageA", "SendMessageTimeoutA", "GetClassNameA", "PostMessageA", "EnumChildWindows", "GetWindowThreadProcessId", "EnumWindows", "DispatchMessageA", "GetDesktopWindow", "TranslateMessage", "GetMessageA", "ShowWindow", "CreateWindowExA", "DefWindowProcA", "PostQuitMessage", "RegisterClassExA", "LookupAccountNameA", "DeleteService", "OpenServiceA", "OpenSCManagerA", "StartServiceA", "RegCloseKey", "RegQueryValueExA", "RegOpenKeyExA", "CreateServiceA", "ConvertSidToStringSidA", "GetUserNameA", "CloseServiceHandle", "SHGetSpecialFolderPathA", "CoInitialize", "CoUninitialize", "ORDINAL 6", "ORDINAL 9", "SHSetValueA", "SHGetValueA", "strstr", "strlwr", "controlfp", "except_handler3", "set_app_type", "p__fmode", "p__commode", "adjust_fdiv", "setusermatherr", "initterm", "getmainargs", "acmdln", "exit", "XcptFilter", "exit", "time", "srand", "fopen", "fwrite", "fflush", "fclose", "access", "CxxFrameHandler", "stricmp", "sprintf", "??3@YAXPAX@Z", "rand", "??2@YAPAXI@Z", "wcslen", "atoi", "strchr", "ImageNtHeader" ], "ms": { "pe": { "entry": 20688.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 4096.0, "subsystem": 2.0, "timestamp": 1300977564.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 2.0, "entry_section": ".text", "size_of_image": 180224.0, "file_alignment": 4096.0, "resource_count": 3.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON", "RT_VERSION" ], "characteristics": 271.0, "has_rich_header": true, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 9.0, "computed_checksum": 242394.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "api_hashing_indicator_count": 1.0 }, "file": { "size": 180224.0 }, "binary": { "code_size": 20480.0, "func_count": 58.0, "code_entropy": 6.09, "data_entropy": 1.23, "func_density": 2.9, "import_count": 90.0, "string_count": 173.0, "avg_func_size": 248.5, "section_count": 11.0, "avg_complexity": 10.52, "import_density": 4.5, "max_complexity": 51.0, "string_density": 8.65, "overall_entropy": 1.74, "avg_basic_blocks": 14.79, "avg_section_size": 16011.64, "dependency_count": 9.0, "entropy_variance": 2.63, "avg_string_length": 9.68, "complexity_per_kb": 0.53, "max_string_length": 40.0, "wide_string_count": 4.0, "avg_string_entropy": 2.67, "code_to_data_ratio": 0.13, "data_to_file_ratio": 0.66, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.11, "total_basic_blocks": 858.0, "func_analysis_depth": 2.0, "string_length_stddev": 5.53, "largest_section_ratio": 0.66, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "writable_section_count": 8.0, "behavioral_import_ratio": 0.06, "executable_section_count": 1.0, "nonstandard_section_count": 4.0, "high_complexity_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, "pdata" ], [ 640, "odata" ], [ 680, "ndata" ], [ 720, "mdata" ], [ 760, "edata" ], [ 800, "cdata" ], [ 840, "idata" ], [ 880, ".rsrc" ], [ 4911, "df_fYZP" ], [ 6957, "/dfZ" ], [ 7424, "SVWSfQf" ], [ 8700, "SSPR" ], [ 10520, "QRSSSSS" ], [ 11257, "SVW3" ], [ 13459, "SVWfPQV" ], [ 13763, "QSVW" ], [ 15001, "SVW2" ], [ 15094, "DZYX" ], [ 15232, "PQRVW" ], [ 15817, "SVWPQ" ], [ 16113, "PQVW" ], [ 17055, "PQVR" ], [ 18515, "SVWfRPf" ], [ 19493, "QRPV" ], [ 20852, "5P6B" ], [ 20979, "XPVSS" ], [ 25718, "GetSystemDirectoryA" ], [ 25740, "WideCharToMultiByte" ], [ 25762, "FreeLibrary" ], [ 25776, "Sleep" ], [ 25784, "GetProcAddress" ], [ 25802, "LoadLibraryA" ], [ 25818, "CloseHandle" ], [ 25832, "TerminateProcess" ], [ 25852, "WaitForSingleObject" ], [ 25874, "CreateProcessA" ], [ 25892, "CreateFileA" ], [ 25906, "GetLastError" ], [ 25922, "SetFileTime" ], [ 25936, "GetFileAttributesExA" ], [ 25960, "WinExec" ], [ 25970, "GetVersionExA" ], [ 25986, "GetModuleFileNameA" ], [ 26008, "DuplicateHandle" ], [ 26026, "GetCurrentProcess" ], [ 26046, "OpenProcess" ], [ 26060, "WriteFile" ], [ 26070, "KERNEL32.dll" ], [ 26086, "SendMessageTimeoutA" ], [ 26108, "RegisterWindowMessageA" ], [ 26134, "GetClassNameA" ], [ 26150, "PostMessageA" ], [ 26166, "EnumChildWindows" ], [ 26186, "GetWindowThreadProcessId" ], [ 26214, "EnumWindows" ], [ 26228, "DispatchMessageA" ], [ 26248, "GetDesktopWindow" ], [ 26268, "TranslateMessage" ], [ 26288, "GetMessageA" ], [ 26302, "ShowWindow" ], [ 26316, "CreateWindowExA" ], [ 26334, "DefWindowProcA" ], [ 26352, "PostQuitMessage" ], [ 26370, "RegisterClassExA" ], [ 26388, "USER32.dll" ], [ 26402, "CloseServiceHandle" ], [ 26424, "DeleteService" ], [ 26440, "OpenServiceA" ], [ 26456, "OpenSCManagerA" ], [ 26474, "StartServiceA" ], [ 26490, "RegCloseKey" ], [ 26504, "RegQueryValueExA" ], [ 26524, "RegOpenKeyExA" ], [ 26540, "CreateServiceA" ], [ 26558, "ConvertSidToStringSidA" ], [ 26584, "LookupAccountNameA" ], [ 26606, "GetUserNameA" ], [ 26620, "ADVAPI32.dll" ], [ 26636, "SHGetSpecialFolderPathA" ], [ 26660, "SHELL32.dll" ], [ 26674, "CoUninitialize" ], [ 26692, "CoInitialize" ], [ 26706, "ole32.dll" ], [ 26716, "OLEAUT32.dll" ], [ 26732, "SHGetValueA" ], [ 26746, "SHSetValueA" ], [ 26758, "SHLWAPI.dll" ], [ 26772, "sprintf" ], [ 26782, "??3@YAXPAX@Z" ], [ 26806, "??2@YAPAXI@Z" ], [ 26822, "wcslen" ], [ 26832, "atoi" ], [ 26860, "__CxxFrameHandler" ], [ 26880, "_access" ], [ 26890, "fclose" ], [ 26900, "fflush" ], [ 26910, "fwrite" ], [ 26920, "fopen" ], [ 26936, "time" ], [ 26942, "MSVCRT.dll" ], [ 26964, "_XcptFilter" ], [ 26978, "exit" ], [ 26986, "_acmdln" ], [ 26996, "__getmainargs" ], [ 27012, "_initterm" ], [ 27024, "__setusermatherr" ], [ 27044, "_adjust_fdiv" ], [ 27060, "__p__commode" ], [ 27076, "__p__fmode" ], [ 27090, "__set_app_type" ], [ 27108, "_except_handler3" ], [ 27128, "_controlfp" ], [ 27142, "ImageNtHeader" ], [ 27156, "dbghelp.dll" ], [ 27168, "VERSION.dll" ], [ 27182, "GetModuleHandleA" ], [ 27202, "GetStartupInfoA" ], [ 27220, "_strlwr" ], [ 27230, "_stricmp" ], [ 32662, "a4onu" ], [ 33844, "p6aw" ], [ 36824, "7\u003c\u003cu" ], [ 39676, "94PN" ], [ 40260, "wh332" ], [ 40405, "S332" ], [ 40476, "rh33" ], [ 43596, "yh33" ], [ 43879, "Mraai" ], [ 44724, "rh33" ], [ 45554, "ho6i" ], [ 48564, "th33" ], [ 49084, "84ao" ], [ 50932, "ifao" ], [ 52324, "n5ao" ], [ 52833, "/4dy" ], [ 52912, "Hgqw" ], [ 56802, "j4xi" ], [ 57358, "14lbu" ], [ 59149, "U33I" ], [ 61250, "8Q RA" ], [ 65053, "h33p" ], [ 66445, "h33h" ], [ 67015, "Ldpl" ], [ 67262, "VCI0" ], [ 67958, "VRI\n" ], [ 75628, "ux4h" ], [ 78792, "Lc g" ], [ 81159, "Qvibk" ], [ 88762, "Sibkfq" ], [ 94318, "dwpL(/]" ], [ 96343, "id9o" ], [ 98602, "lwhE(/]" ], [ 99110, "8akp" ], [ 103278, "Lc g" ], [ 103592, "o8t1" ], [ 141870, "q98k" ], [ 176410, "wide", "IDI_ICON" ], [ 176438, "VS_VERSION_INFO" ], [ 176530, "StringFileInfo" ], [ 176590, "wide", "CompanyName" ], [ 176622, "wide", "FileDescription" ], [ 176662, "FileVersion" ], [ 176718, "LegalCopyright" ], [ 176748, "Copyright 2010" ], [ 176786, "ProductVersion" ], [ 176846, "wide", "VarFileInfo" ], [ 176878, "Translation" ], [ 177311, "wwwwwwwx" ], [ 177344, "DDDDDOx" ], [ 177488, "DDDDDOx" ] ], "sz": 180224, "ts": [ { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 1.74" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 180224.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Enumerate child windows", "e": [ "EnumChildWindows" ], "i": "micro-behaviors/ui/window/manage/enumerate::enum-child-windows-import", "l": 2 }, { "c": 0.800000011920929, "d": "Convert SID to string representation", "e": [ "ConvertSidToStringSidA" ], "i": "micro-behaviors/os/group/lookup::convert-sid-to-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Wide string length", "e": [ "wcslen" ], "i": "micro-behaviors/data/string/library::wcslen", "l": 2 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage/enumerate::get-window-thread-process-id", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 3, "m": "C0014" }, { "a": "T1106", "c": 0.6000000238418579, "d": "EnumWindows / EnumChildWindows API", "e": [ "EnumChildWindows", "EnumWindows" ], "i": "objectives/evasion/process/injection/callback::enum-windows-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 90.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "38620!!embedded:pe:6_FileVersion@0xb030" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.69)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 4.50" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close stdio file", "e": [ "fclose" ], "i": "micro-behaviors/os/stdio::fclose", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1300977564.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1543.003", "c": 0.9300000071525574, "d": "Program can open Windows services", "e": [ "OpenServiceA" ], "i": "micro-behaviors/os/service/control::open-service-import", "l": 3 }, { "c": 0.75, "d": "String to integer conversion (atoi)", "e": [ "atoi" ], "i": "micro-behaviors/data/string/conversion::atoi", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 10.52" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (ANSI)", "e": [ "GetMessageA" ], "i": "micro-behaviors/os/message/queue::get-message-a", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.67" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve account name to SID", "e": [ "LookupAccountNameA" ], "i": "micro-behaviors/os/user/lookup::lookup-account-name", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8500000238418579, "d": "Parse PE NT headers via dbghelp", "e": [ "ImageNtHeader" ], "i": "micro-behaviors/fs/file/pe-inspect::image-nt-header", "l": 3 }, { "c": 0.800000011920929, "d": "Query file attributes and timestamps", "e": [ "GetFileAttributesExA" ], "i": "micro-behaviors/fs/file/timestamp::get-file-attributes-ex", "l": 2 }, { "c": 0.8199999928474426, "d": "Resolve special folder path ANSI", "e": [ "SHGetSpecialFolderPathA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-special-folder-path-a", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.8999999761581421, "d": "Find character in string", "e": [ "strchr" ], "i": "micro-behaviors/data/string/library::strchr", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "Find substring", "e": [ "strstr" ], "i": "micro-behaviors/data/string/library::strstr", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1055.002", "c": 0.8500000238418579, "d": "OpenProcess API name in strings", "e": [ "OpenProcess" ], "i": "objectives/evasion/process/injection/dll::open-process-text", "l": 3 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ConvertSidToStringSidA", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.949999988079071, "d": "PE compile timestamp far in future", "e": [ "pe.timestamp = 1300977564.00" ], "i": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "l": 2 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 858.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 173.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 58.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 58.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage/enumerate::enum-windows", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 58.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 3 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "10 60 40 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Program opens service control manager", "e": [ "OpenSCManagerA" ], "i": "micro-behaviors/os/service/control::open-sc-manager-import", "l": 3 }, { "a": "T1543.003", "c": 0.9300000071525574, "d": "Program can start Windows services", "e": [ "StartServiceA" ], "i": "micro-behaviors/os/service/control::start-service-import", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "WinExec command execution API", "e": [ "WinExec" ], "i": "micro-behaviors/process/create/exec::winexec", "l": 3 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8199999928474426, "d": "sprintf string formatting API", "e": [ "sprintf" ], "i": "micro-behaviors/fs/path/construct::sprintf-format-api", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExA" ], "i": "micro-behaviors/ui/window/manage/control::register-class", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage/control::post-quit-message", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 1.74" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Program can create Windows services", "e": [ "CreateServiceA" ], "i": "micro-behaviors/os/service/control::create-service-import", "l": 3 }, { "a": "T1543.003", "c": 0.8399999737739563, "d": "Delete installed service", "e": [ "DeleteService" ], "i": "micro-behaviors/os/service/control::delete-service", "l": 3 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open service control manager", "e": [ "OpenSCManagerA" ], "i": "micro-behaviors/os/service/control::open-sc-manager", "l": 1 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Start Windows service", "e": [ "StartServiceA" ], "i": "micro-behaviors/os/service/control::start-service", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1033", "c": 0.8999999761581421, "d": "Query current username", "e": [ "GetUserNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-user-name", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemDirectoryA", "GetWindowThreadProcessId", "ConvertSidToStringSidA", "WideCharToMultiByte", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8399999737739563, "d": "High entropy .data section", "e": [ ".data (size: 118784, entropy: 7.38)" ], "i": "objectives/anti-static/obfuscation/payload/section::high-entropy-dot-data-section", "l": 3, "m": "B0032" }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".data (entropy: 7.38, perms: rw-)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Create Windows service", "e": [ "CreateServiceA" ], "i": "micro-behaviors/os/service/control::create-service", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1300977564.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ "odata", ".data", "ndata", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", ".rdata", "pdata", "idata", "edata", "mdata", "cdata" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open existing service handle", "e": [ "OpenServiceA" ], "i": "micro-behaviors/os/service/control::open-service", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 11.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".data", "idata", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", "mdata", "pdata", "odata", "ndata", "edata", "cdata", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "cdata", ".rdata", "odata", "edata", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", "ndata", "mdata", "idata", ".data", "pdata" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data (entropy: 7.38, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links dbghelp.dll (ImageNtHeader)", "e": [ "dbghelp.dll" ], "i": "metadata/dylib::dbghelp/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetSpecialFolderPathA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (RegisterWindowMessageA, SendMessageTimeoutA, GetClassNameA, PostMessageA, EnumChildWindows, ... +11 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHSetValueA, SHGetValueA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (LookupAccountNameA, DeleteService, OpenServiceA, OpenSCManagerA, StartServiceA, ... +7 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCRT.dll (strstr, strlwr, controlfp, except_handler3, set_app_type, ... +26 more)", "e": [ "MSVCRT.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 6, ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetLastError, SetFileTime, GetFileAttributesExA, WinExec, GetModuleFileNameA, ... +18 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize, CoUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 90.00", "pe.has_rich_header = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Large encoded configuration data section", "e": [ "ndata", ".data", "edata", ".rdata", "idata", "pdata", ".rdata+.data+pdata+odata+ndata+mdata+edata+cdata+idata = 740.0% of text (151552 / 20480 bytes)", ".data (entropy: 7.38, perms: rw-)", "mdata", "odata", "cdata" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section", "l": 4, "m": "B0032" }, { "a": "T1543.003", "c": 0.9200000166893005, "d": "Service stop or delete chain", "e": [ "OpenServiceA", "DeleteService", "OpenSCManagerA" ], "i": "micro-behaviors/os/service/control::service-stop-control", "l": 3 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Windows service admin import cluster", "e": [ "OpenServiceA", "CreateServiceA", "StartServiceA", "OpenSCManagerA" ], "i": "micro-behaviors/os/service/control::service-admin-import-cluster", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1564.003", "c": 0.8500000238418579, "d": "Hidden WinExec process launch", "e": [ "WinExec", "10 60 40 00" ], "i": "micro-behaviors/process/create/flags::hidden-winexec", "l": 4 } ], "sha": "065aab5de80017e33df13c76a867a050c32910ed400f62365cea6d209b747be9", "path": "38620!!embedded:pe:6_FileVersion@0xb030", "type": "pe" } ], "tv": "7f26a" } }