{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.8254117965698242 } ], "prob": 0.8254118, "models": [ { "m": "az", "prob": 0.8254118, "class": 0 }, { "m": "az/native", "prob": 0.20119224, "class": 0 }, { "m": "az/pe", "prob": 0.012552301, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-03T04:54:08Z" }, "path": "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe", "raw": { "v": "6", "fs": [ { "f": "O(Er)H(Db₂)", "x": 4, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "checksum_valid": 0.0, "resource_count": 3.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 1058709.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 1018880.0, "entropy": 6.95, "size_bytes": 1018880.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.95, "string_count": 9419.0, "overall_entropy": 6.95, "entropy_variance": 8.09, "avg_string_length": 10.33, "max_string_length": 480.0, "code_to_data_ratio": 1.0, "string_length_stddev": 15.65, "largest_section_ratio": 0.93, "sentence_string_count": 809.0, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 948736.0, "entropy_max": 6.95, "entropy_mean": 3.9, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 50336, "u8", "kr17" ], [ 118696, "u8", "wr17" ], [ 120309, "u8", "pB[}" ], [ 225038, "u8", "*.rOp" ], [ 385852, "u8", "BSJB" ], [ 387374, "u8", "pSePA" ], [ 387430, "u8", "QKePA" ], [ 387486, "u8", "MCePA" ], [ 387598, "u8", "VCePA" ], [ 387612, "u8", "1BePA" ], [ 387682, "u8", "IeePA" ], [ 427253, "u8", "label100" ], [ 427262, "u8", "label110" ], [ 427271, "u8", "\u003cattendance\u003eb__50_10" ], [ 427292, "u8", "\u003cadjst_leave\u003eb__83_10" ], [ 427338, "u8", "\u003cadjst_leave\u003eb__84_10" ], [ 427405, "u8", "\u003cload2\u003eb__10" ], [ 427430, "u8", "\u003cattendance\u003eb__10" ], [ 427448, "u8", "\u003cfillsal\u003eb__10" ], [ 427463, "u8", "\u003cgetleaves\u003eb__10" ], [ 427491, "u8", "\u003cimport\u003eb__10" ], [ 427505, "u8", "\u003cgethistory\u003eb__10" ], [ 427523, "u8", "linkLabel10" ], [ 427535, "u8", "label10" ], [ 427543, "u8", "panel10" ], [ 427551, "u8", "richTextBox10" ], [ 427565, "u8", "textBox10" ], [ 427575, "u8", "label120" ], [ 427584, "u8", "\u003cattendance\u003eb__50_20" ], [ 427605, "u8", "\u003cattendance\u003eb__62_20" ], [ 427634, "u8", "\u003cload2\u003eb__20" ], [ 427647, "u8", "\u003cattendance\u003eb__20" ], [ 427665, "u8", "\u003cgetleaves\u003eb__20" ], [ 427682, "u8", "linkLabel20" ], [ 427694, "u8", "label20" ], [ 427702, "u8", "panel20" ], [ 427710, "u8", "textBox20" ], [ 427720, "u8", "label130" ], [ 427729, "u8", "\u003cattendance\u003eb__62_30" ], [ 427750, "u8", "\u003cattendance\u003eb__30" ], [ 427768, "u8", "label30" ], [ 427776, "u8", "textBox30" ], [ 427786, "u8", "\u003cattendance\u003eb__50_40" ], [ 427807, "u8", "\u003cattendance\u003eb__80_40" ], [ 427828, "u8", "\u003cattendance\u003eb__62_40" ], [ 427849, "u8", "\u003cattendance\u003eb__82_40" ], [ 427870, "u8", "label40" ], [ 427878, "u8", "\u003cattendance\u003eb__50" ], [ 427896, "u8", "label50" ], [ 427904, "u8", "\u003cattendance\u003eb__60" ], [ 427922, "u8", "label60" ], [ 427930, "u8", "\u003cattendance\u003eb__80_70" ], [ 427951, "u8", "\u003cattendance\u003eb__62_70" ], [ 427972, "u8", "\u003cattendance\u003eb__82_70" ], [ 427993, "u8", "label70" ], [ 428001, "u8", "\u003cattendance\u003eb__80_80" ], [ 428022, "u8", "\u003cattendance\u003eb__62_80" ], [ 428043, "u8", "\u003cattendance\u003eb__82_80" ], [ 428064, "u8", "label80" ], [ 428072, "u8", "label90" ], [ 428080, "u8", "\u003c\u003ec__DisplayClass10_0" ], [ 428102, "u8", "\u003c\u003ec__DisplayClass20_0" ], [ 428124, "u8", "\u003clinkLabel13_LinkClicked\u003eb__30_0" ], [ 428219, "u8", "\u003clinkLabel13_LinkClicked\u003eb__50_0" ], [ 428252, "u8", "\u003cattendance\u003eb__50_0" ], [ 428272, "u8", "\u003c\u003ec__DisplayClass50_0" ], [ 428294, "u8", "\u003cattendance\u003eb__80_0" ], [ 428314, "u8", "\u003c\u003ec__DisplayClass80_0" ], [ 428336, "u8", "\u003clinkLabel18_LinkClicked\u003eb__90_0" ], [ 428384, "u8", "\u003c\u003ec__DisplayClass11_0" ], [ 428406, "u8", "\u003clinkLabel14_LinkClicked\u003eb__31_0" ], [ 428439, "u8", "\u003clinkLabel15_LinkClicked\u003eb__31_0" ], [ 428504, "u8", "\u003clinkLabel14_LinkClicked\u003eb__51_0" ], [ 428537, "u8", "\u003clinkLabel17_LinkClicked\u003eb__61_0" ], [ 428570, "u8", "\u003c\u003ec__DisplayClass91_0" ], [ 428592, "u8", "\u003cload2\u003eb__12_0" ], [ 428607, "u8", "\u003c\u003ec__DisplayClass12_0" ], [ 428682, "u8", "\u003clinkLabel12_LinkClicked\u003eb__52_0" ], [ 428715, "u8", "\u003c\u003ec__DisplayClass52_0" ], [ 428737, "u8", "\u003cattendance\u003eb__62_0" ], [ 428757, "u8", "\u003c\u003ec__DisplayClass62_0" ], [ 428779, "u8", "\u003cattendance\u003eb__82_0" ], [ 428799, "u8", "\u003c\u003ec__DisplayClass82_0" ], [ 428821, "u8", "\u003c\u003ec__DisplayClass13_0" ], [ 428875, "u8", "\u003c\u003ec__DisplayClass33_0" ], [ 428943, "u8", "\u003c\u003ec__DisplayClass53_0" ], [ 428965, "u8", "\u003c\u003ec__DisplayClass63_0" ], [ 428987, "u8", "\u003cadjst_leave\u003eb__83_0" ], [ 429008, "u8", "\u003c\u003ec__DisplayClass93_0" ], [ 429094, "u8", "\u003c\u003ec__DisplayClass34_0" ], [ 429116, "u8", "\u003clinkLabel13_LinkClicked\u003eb__64_0" ], [ 429188, "u8", "\u003c\u003ec__DisplayClass64_0" ], [ 429210, "u8", "\u003cadjst_leave\u003eb__84_0" ], [ 429323, "u8", "\u003c\u003ec__DisplayClass25_0" ], [ 429375, "u8", "\u003clinkLabel14_LinkClicked\u003eb__65_0" ], [ 429408, "u8", "\u003clinkLabel10_LinkClicked\u003eb__26_0" ], [ 429473, "u8", "\u003c\u003ec__DisplayClass46_0" ], [ 429530, "u8", "\u003c\u003ec__DisplayClass86_0" ], [ 429591, "u8", "\u003clinkLabel11_LinkClicked\u003eb__27_0" ], [ 429688, "u8", "\u003clinkLabel15_LinkClicked\u003eb__47_0" ], [ 429721, "u8", "\u003clinkLabel11_LinkClicked\u003eb__57_0" ], [ 429754, "u8", "\u003c\u003ec__DisplayClass87_0" ], [ 429790, "u8", "\u003clinkLabel12_LinkClicked\u003eb__28_0" ], [ 429885, "u8", "\u003capproval\u003eb__38_0" ], [ 429903, "u8", "\u003c\u003ec__DisplayClass38_0" ], [ 429925, "u8", "\u003clinkLabel10_LinkClicked\u003eb__48_0" ], [ 429958, "u8", "\u003clinkLabel17_LinkClicked\u003eb__48_0" ], [ 429991, "u8", "\u003cgetleaves\u003eb__48_0" ], [ 430010, "u8", "\u003c\u003ec__DisplayClass48_0" ], [ 430032, "u8", "\u003cgetleaves\u003eb__58_0" ], [ 430051, "u8", "\u003c\u003ec__DisplayClass58_0" ], [ 430073, "u8", "\u003c\u003ec__DisplayClass68_0" ], [ 430095, "u8", "\u003c\u003ec__DisplayClass8_0" ], [ 430116, "u8", "\u003clinkLabel12_LinkClicked\u003eb__19_0" ], [ 430149, "u8", "\u003clinkLabel14_LinkClicked\u003eb__29_0" ], [ 430214, "u8", "\u003cgethistory\u003eb__29_0" ], [ 430234, "u8", "\u003c\u003ec__DisplayClass29_0" ], [ 430256, "u8", "\u003ccancel_approval\u003eb__39_0" ], [ 430281, "u8", "\u003c\u003ec__DisplayClass39_0" ], [ 430303, "u8", "\u003clinkLabel16_LinkClicked\u003eb__49_0" ], [ 430350, "u8", "\u003c\u003ec__DisplayClass59_0" ], [ 430372, "u8", "\u003clinkLabel10_LinkClicked\u003eb__79_0" ], [ 430448, "u8", "\u003c\u003ec__DisplayClass9_0" ], [ 430487, "u8", "\u003cwebload\u003eb__0" ], [ 430501, "u8", "\u003cupload\u003eb__0" ], [ 430514, "u8", "\u003clinkLabel2_LinkClicked\u003eb__0" ], [ 430543, "u8", "\u003ctextappend\u003eb__0" ], [ 430560, "u8", "\u003ccancel_date_time\u003eb__0" ], [ 430583, "u8", "\u003crateupdate\u003eb__0" ], [ 430600, "u8", "\u003cattach\u003eb__0" ], [ 430633, "u8", "\u003cfillsal\u003eb__0" ], [ 430647, "u8", "\u003cimport\u003eb__0" ], [ 430660, "u8", "label101" ], [ 430669, "u8", "label111" ], [ 430678, "u8", "\u003cattendance\u003eb__50_11" ], [ 430699, "u8", "\u003cattendance\u003eb__80_11" ], [ 430720, "u8", "\u003cattendance\u003eb__62_11" ], [ 430741, "u8", "\u003cattendance\u003eb__82_11" ], [ 430762, "u8", "\u003cadjst_leave\u003eb__83_11" ], [ 430808, "u8", "\u003cadjst_leave\u003eb__84_11" ], [ 430875, "u8", "\u003cload2\u003eb__11" ], [ 430900, "u8", "\u003cfillsal\u003eb__11" ], [ 430915, "u8", "\u003cgetleaves\u003eb__11" ], [ 430932, "u8", "\u003cimport\u003eb__11" ], [ 430946, "u8", "\u003cgethistory\u003eb__11" ], [ 430964, "u8", "linkLabel11" ], [ 430976, "u8", "label11" ], [ 430984, "u8", "panel11" ], [ 430992, "u8", "richTextBox11" ], [ 431006, "u8", "textBox11" ], [ 431016, "u8", "label121" ], [ 431025, "u8", "\u003cattendance\u003eb__80_21" ], [ 431046, "u8", "\u003cattendance\u003eb__62_21" ], [ 431067, "u8", "\u003cattendance\u003eb__82_21" ], [ 431096, "u8", "\u003cload2\u003eb__21" ], [ 431109, "u8", "\u003cattendance\u003eb__21" ], [ 431127, "u8", "\u003cgetleaves\u003eb__21" ], [ 431144, "u8", "label21" ], [ 431152, "u8", "panel21" ], [ 431160, "u8", "textBox21" ], [ 431170, "u8", "label131" ], [ 431179, "u8", "\u003cattendance\u003eb__80_31" ], [ 431200, "u8", "\u003cattendance\u003eb__62_31" ], [ 431221, "u8", "\u003cattendance\u003eb__82_31" ], [ 431242, "u8", "\u003cattendance\u003eb__31" ], [ 431260, "u8", "label31" ], [ 431268, "u8", "textBox31" ], [ 431278, "u8", "\u003cattendance\u003eb__50_41" ], [ 431299, "u8", "\u003cattendance\u003eb__80_41" ], [ 431320, "u8", "\u003cattendance\u003eb__62_41" ], [ 431341, "u8", "\u003cattendance\u003eb__82_41" ], [ 431362, "u8", "label41" ], [ 431378, "u8", "\u003cattendance\u003eb__51" ], [ 431396, "u8", "label51" ], [ 431412, "u8", "\u003cattendance\u003eb__61" ], [ 431430, "u8", "label61" ], [ 431438, "u8", "\u003cattendance\u003eb__80_71" ], [ 431459, "u8", "\u003cattendance\u003eb__62_71" ], [ 431480, "u8", "\u003cattendance\u003eb__82_71" ], [ 431501, "u8", "label71" ], [ 431509, "u8", "\u003cattendance\u003eb__80_81" ], [ 431530, "u8", "\u003cattendance\u003eb__62_81" ], [ 431551, "u8", "\u003cattendance\u003eb__82_81" ], [ 431572, "u8", "label81" ], [ 431580, "u8", "label91" ], [ 431588, "u8", "\u003cattendance\u003eb__50_1" ], [ 431608, "u8", "\u003c\u003ec__DisplayClass50_1" ], [ 431630, "u8", "\u003cattendance\u003eb__80_1" ], [ 431650, "u8", "\u003c\u003ec__DisplayClass80_1" ], [ 431687, "u8", "\u003c\u003ec__DisplayClass11_1" ], [ 431709, "u8", "\u003c\u003ec__DisplayClass91_1" ], [ 431731, "u8", "\u003cload2\u003eb__12_1" ], [ 431746, "u8", "\u003c\u003ec__DisplayClass12_1" ], [ 431768, "u8", "\u003cattendance\u003eb__62_1" ], [ 431788, "u8", "\u003c\u003ec__DisplayClass62_1" ], [ 431810, "u8", "\u003cattendance\u003eb__82_1" ], [ 431830, "u8", "\u003c\u003ec__DisplayClass82_1" ], [ 431883, "u8", "\u003c\u003ec__DisplayClass53_1" ], [ 431905, "u8", "\u003c\u003ec__DisplayClass63_1" ], [ 431927, "u8", "\u003cadjst_leave\u003eb__83_1" ], [ 431971, "u8", "\u003c\u003ec__DisplayClass93_1" ], [ 431993, "u8", "\u003c\u003ec__DisplayClass34_1" ], [ 432015, "u8", "\u003cadjst_leave\u003eb__84_1" ], [ 432050, "u8", "\u003c\u003ec__DisplayClass25_1" ], [ 432102, "u8", "\u003cwebload\u003eb__86_1" ], [ 432119, "u8", "\u003c\u003ec__DisplayClass87_1" ], [ 432171, "u8", "\u003cgetleaves\u003eb__48_1" ], [ 432190, "u8", "\u003c\u003ec__DisplayClass48_1" ], [ 432212, "u8", "\u003cgetleaves\u003eb__58_1" ], [ 432231, "u8", "\u003c\u003ec__DisplayClass58_1" ], [ 432276, "u8", "\u003c\u003ec__DisplayClass68_1" ], [ 432314, "u8", "\u003cgethistory\u003eb__29_1" ], [ 432334, "u8", "\u003c\u003ec__DisplayClass29_1" ], [ 432370, "u8", "\u003c\u003ec__DisplayClass59_1" ], [ 432404, "u8", "\u003c\u003ec__DisplayClass9_1" ], [ 432443, "u8", "\u003cupload\u003eb__1" ], [ 432456, "u8", "\u003ctextappend\u003eb__1" ], [ 432473, "u8", "\u003ccancel_date_time\u003eb__1" ], [ 432496, "u8", "\u003crateupdate\u003eb__1" ], [ 432513, "u8", "\u003cattach\u003eb__1" ], [ 432526, "u8", "\u003ccalsal\u003eb__1" ], [ 432539, "u8", "\u003cfillsal\u003eb__1" ], [ 432553, "u8", "\u003capproval\u003eb__1" ], [ 432568, "u8", "\u003ccancel_approval\u003eb__1" ], [ 432590, "u8", "\u003cimport\u003eb__1" ], [ 432603, "u8", "linkLabel11_LinkClicked_1" ], [ 432629, "u8", "linkLabel4_LinkClicked_1" ], [ 432654, "u8", "button2_Click_1" ], [ 432670, "u8", "dateTimePicker4_CloseUp_1" ], [ 432696, "u8", "IEnumerable`1" ], [ 432710, "u8", "EnumerableRowCollection`1" ], [ 432746, "u8", "load1" ], [ 432758, "u8", "tabPage1" ], [ 432767, "u8", "date1" ], [ 432773, "u8", "rate1" ], [ 432782, "u8", "saveFileDialog1" ], [ 432798, "u8", "openFileDialog1" ], [ 432814, "u8", "linkLabel1" ], [ 432825, "u8", "label1" ], [ 432832, "u8", "tableLayoutPanel1" ], [ 432850, "u8", "panel1" ], [ 432857, "u8", "tabControl1" ], [ 432869, "u8", "Form1" ], [ 432875, "u8", "radioButton1" ], [ 432888, "u8", "button1" ], [ 432896, "u8", "temp1" ], [ 432902, "u8", "dateTimePicker1" ], [ 432918, "u8", "timer1" ], [ 432925, "u8", "webBrowser1" ], [ 432937, "u8", "CS$\u003c\u003e8__locals1" ], [ 432953, "u8", "dataGridView1" ], [ 432967, "u8", "treeView1" ], [ 432977, "u8", "listView1" ] ], "v": { "file.stem": "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1722297668, "file.basename": "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe", "pe.image_base": 4194304, "pe.image_size": 1040384, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 956474, "pe.headers_size": 512, "pe.version.type": "app", "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.debug.pdb.guid": "cf946e9d-ca45-4d8c-a570-42301da74247", "pe.debug.pdb.path": "KmDU.pdb", "pe.debug.pdb.stem": "KmDU", "pe.file_alignment": 512, "pe.image_hash.sha1": "3c52b0be6fc3d5163a1e9476f28342e32e2c0f35", "pe.image_hash.sha256": "b0a1da7bf140e85ee63e6b2ac59409a57555be73de3cbe7960f3f0ead0fa402b", "pe.image_hash.sha384": "5f5ad02d2f641760676b79c4ffd4c89ec1f349f82ff75cc314eda4b4771218844fb7e319aaa904e7baf2f00f732195fa", "pe.image_hash.sha512": "038b6bf17f92058b4c71f15b1d8bdb1d8eb97b7edd6b40de108282552e60515288b0d6677d6979cd7ff9c2cd443b1eb2043ca2573fcf2d687e6443bea4509cb3", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 2015", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.debug.pdb.basename": "KmDU.pdb", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.debug.pdb.timestamp": 2797285386, "pe.version.description": "Login", "pe.linker_major_version": 48, "pe.version.file_version": "1.0.0.0", "pe.version.product_name": "Login", "pe.debug.entries[0].type": "codeview", "pe.debug.entries[1].type": "other", "pe.debug.entries[2].type": "other", "pe.version.internal_name": "KmDU.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 956390, "pe.data_directories[1].rva": 958464, "pe.data_directories[2].rva": 1032192, "pe.data_directories[3].rva": 906352, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1.0.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 79, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 68640, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 84, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.debug.entries[0].type_id": 2, "pe.debug.entries[1].type_id": 19, "pe.debug.entries[2].type_id": 17, "pe.version.original_filename": "KmDU.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.debug.entries[0].size_bytes": 284, "pe.debug.entries[1].size_bytes": 39, "pe.debug.entries[2].size_bytes": 49631, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1, "pe.debug.entries[0].timestamp_unix": 2797285386 }, "id": "pe", "sc": [ [ ".text", 512, 948736, 6.95, "r-x" ], [ ".rsrc", 949248, 69120, 4.65, "r--" ], [ ".reloc", 1018368, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 1018880, "ts": [ { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "f8752" ] }, { "d": "password keyword", "e": [ "Change Password", "Please enter a password and reconfirm it!!!", "Passwords do not match !!!", "Login.password.resources", "New Password :", "password", "Confirm Password :", "set_PasswordChar", "Password Change", "Password Change Information", "Password :", "update users set password = '", "Password has been changed successfully !!!", "Icorrect Password !!!", "server=127.0.0.1;Port=3306;UID=root;Password =root;database=ems_data", "set_UseSystemPasswordChar" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1, "el": [ "72d96", "76a84", "76a2e", "6dec6", "76adc", "6c725", "76afa", "6da5a", "76a64", "7697a", "75af6", "768be", "76924", "759da", "75b5d", "6da6b" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 9419.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "set_ConnectionString", "OleDbConnection", "set_Connection", "MySqlConnection", "Internet Connection Error !!!" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012", "el": [ "6cfe6", "6d7e5", "6d7d6", "6d7f5", "6ec54" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "6dd9d" ] }, { "a": "T1046", "c": 0.699999988079071, "d": "MySQL port 3306", "e": [ "3306" ], "i": "objectives/discovery/network/scan/internal-port::mysql-port", "l": 1, "m": "E1046", "el": [ "75b5d" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "4886" ] }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "6c89e" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.95)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 9419.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Stagecomp approved status", "e": [ "approved" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::stagecomp-approved-status", "l": 1, "m": "B0024", "el": [ "79f2e" ] }, { "c": 0.6000000238418579, "d": "SqlParameter class", "e": [ "MySqlParameterCollection", "MySqlParameter" ], "i": "micro-behaviors/data/db/access::sql-parameter-class", "l": 3, "el": [ "6d756", "6dc53" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringBuilder", "ToString", "StringFileInfo", "sqlstring", "cmndstring", "ToShortDateString", "ToShortTimeString", "set_ConnectionString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "6dae7", "6cffb", "f85ca", "6d00f", "6d004", "6cfd4", "6cfc2", "6cfe6" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1113", "c": 0.699999988079071, "d": "System.Drawing.Bitmap class reference", "e": [ "Bitmap" ], "i": "micro-behaviors/hardware/display/screen::bitmap-fromscratch-str", "l": 1, "m": "C0014", "el": [ "6d9f5" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "f878e" ] }, { "c": 0.6000000238418579, "d": "AddWithValue method", "e": [ "AddWithValue" ], "i": "micro-behaviors/data/db/access::add-with-value", "l": 3, "el": [ "6cef4" ] }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "select * from users where username ='", "update users set password = '" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1, "el": [ "75867", "768be" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "OleDbConnection class", "e": [ "OleDbConnection" ], "i": "micro-behaviors/data/db/access::oledb-connection-class", "l": 3, "el": [ "6d7e5" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Login" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "f852a" ] }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "75ad2" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO", "System.Security" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "6c100", "6ea4a" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "6f62c" ] }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 6.95" ], "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "e7a28" ] }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "7be87" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Login" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8600000143051147, "d": "VB late binding token", "e": [ "LateCall" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-latecall-token", "l": 1, "el": [ "6d404" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic.CompilerServices", "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "6ddda", "6c19b" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "6e212" ] }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2, "el": [ "f867a" ] }, { "c": 0.6000000238418579, "d": ".NET Process class token", "e": [ "Process" ], "i": "micro-behaviors/process/create/spawn::process-class-token-dotnet", "l": 1, "el": [ "6e3b3" ] }, { "a": "T1486", "c": 1.0, "d": "PDF file extension", "e": [ ".pdf" ], "i": "objectives/impact/ransom/native::ext-pdf", "l": 1, "m": "C0027", "el": [ "75079" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "credentials" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-2", "l": 1, "el": [ "758d7" ] }, { "c": 0.699999988079071, "d": "ConnectionString property", "e": [ "set_ConnectionString" ], "i": "micro-behaviors/data/db/access::connection-string-singular", "l": 3, "el": [ "6cfe6" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "ce" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "86617" ] }, { "c": 0.6000000238418579, "d": "DataAdapter class", "e": [ "OleDbDataAdapter", "MySqlDataAdapter" ], "i": "micro-behaviors/data/db/access::data-adapter-class", "l": 3, "el": [ "6dc85", "6dc96" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "f8646" ] }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2, "el": [ "f852a" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "c34a" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 9419.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "6cf20" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "6d66f" ] }, { "a": "T1552.001", "c": 0.4000000059604645, "d": "Credentials filename context", "e": [ "credentials" ], "i": "objectives/supply-chain/credential-theft/registry::credentials-file-basename-context", "l": 1, "el": [ "758d7" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "upload", "Upload Failed", "\u003cupload\u003eb__1", "Upload / Update", "\u003cupload\u003eb__3", "\u003cupload\u003eb__2", "Uploading...", "Upload", "Uploaded Successfully", "rowuploadstatus", "\u003cupload\u003eb__0" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-8", "l": 1, "el": [ "6c240", "7a996", "6993b", "6f5d6", "6a708", "6a0cf", "7a950", "6f11c", "7a96a", "6e4a9", "691a5" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 9419.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.6000000238418579, "d": "GetMethods call reference", "e": [ "GetMethods" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-methods-call", "l": 1, "el": [ "6ddb0" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "get_ResourceManager", "ComponentResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "6db26", "6db3a" ] }, { "c": 0.800000011920929, "d": "CodeDom compiler access", "e": [ "System.CodeDom.Compiler" ], "i": "metadata/lang/compiler/managed::codedom-compiler", "l": 2, "el": [ "6dbf7" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2, "el": [ "f87ba" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2015" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "download", "Download", "Check Salary / Download", "Downloaded Successfully !!! ", "Download Copy" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1, "el": [ "6c237", "6f60c", "78757", "6f426", "7354e" ] }, { "c": 0.699999988079071, "d": "SqlConnection class", "e": [ "MySqlConnection" ], "i": "micro-behaviors/data/db/access::sql-connection-class", "l": 3, "el": [ "6d7f5" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin", "Admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028", "el": [ "758cb", "740e4" ] }, { "c": 0.7200000286102295, "d": "Directory name helper token", "e": [ "GetDirectoryName" ], "i": "micro-behaviors/fs/temp/directory::directory-name-token", "l": 1, "el": [ "6ca01" ] }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "Download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105", "el": [ "6c237", "6f426" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.699999988079071, "d": "DbCommand class", "e": [ "OleDbCommand" ], "i": "micro-behaviors/data/db/access::db-command-class", "l": 3, "el": [ "6c6b5" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ "-ID:", ".ID ", " ID ", "-ID ", " ID.", " ID,", " ID" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "752c6", "7824d", "6f566", "70133", "71250", "730ee", "73fa4" ] }, { "a": "T1027.003", "c": 0.8199999928474426, "d": ".NET Bitmap type reference", "e": [ "System.Drawing.Bitmap" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token", "l": 1, "m": "F0001.006", "el": [ "89214" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "7bf90" ] }, { "c": 0.699999988079071, "d": "ExecuteNonQuery method", "e": [ "ExecuteNonQuery" ], "i": "micro-behaviors/data/db/access::execute-nonquery", "l": 3, "el": [ "6eaa6" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "f86aa" ] }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "6ea67" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025", "el": [ "6dae7" ] }, { "a": "T1041", "c": 0.8600000143051147, "d": "Notification config wording", "e": [ "sender" ], "i": "objectives/exfiltration/messaging/webhook::notification-config-word", "l": 1, "m": "B0030", "el": [ "6daf5" ] }, { "c": 0.8999999761581421, "d": "PNG image magic in text section", "e": [ "89 50 4E 47 0D 0A 1A 0A" ], "i": "metadata/binary/resource::png-magic-in-text", "l": 1, "el": [ "7cb3a" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.95" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "f8622" ] }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1, "el": [ "f8820", "f8820", "f8820" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "d2c0" ] }, { "c": 0.6000000238418579, "d": "SqlDataAdapter class", "e": [ "MySqlDataAdapter" ], "i": "micro-behaviors/data/db/access::sql-data-adapter-class", "l": 3, "el": [ "6dc96" ] }, { "c": 0.8199999928474426, "d": "Type.InvokeMember reflection token", "e": [ "InvokeMember" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "l": 1, "el": [ "6da94" ] }, { "c": 0.8999999761581421, "d": "WCF generated code attribute", "e": [ "GeneratedCodeAttribute" ], "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute", "l": 1, "el": [ "6ccb6" ] }, { "c": 0.699999988079071, "d": "DbConnection class", "e": [ "OleDbConnection" ], "i": "micro-behaviors/data/db/access::db-connection-class", "l": 3, "el": [ "6d7e5" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "set_ColumnHeadersHeightSizeMode", "DataGridViewColumnHeadersHeightSizeMode" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1, "el": [ "6c7ad", "6c7cd" ] }, { "c": 0.699999988079071, "d": "SqlCommand class", "e": [ "MySqlCommand" ], "i": "micro-behaviors/data/db/access::sql-command-class", "l": 3, "el": [ "6c6c2" ] }, { "c": 0.6000000238418579, "d": "DbParameter class", "e": [ "DbParameter" ], "i": "micro-behaviors/data/db/access::db-parameter-class", "l": 3, "el": [ "6dc47" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "6c16f", "7bf90" ] }, { "d": "UPDATE SQL keyword", "e": [ "update empwork set", "update empdailyreport set", "update emp_leave set", "update users set", "Update empdetails set", "update cancel_leave set" ], "i": "micro-behaviors/data/db/sql::sql-update", "l": 3, "el": [ "79411", "799ec", "79e23", "768be", "77449", "7a10e" ] }, { "a": "T1552.001", "c": 0.30000001192092896, "d": "\"password\" keyword", "e": [ "password" ], "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword", "l": 1, "el": [ "6c725" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.6000000238418579, "d": "GetTypes method reference", "e": [ "GetTypes" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-gettypes-token", "l": 1, "el": [ "6e104" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "e7a28" ] }, { "a": "T1027.009", "c": 0.7200000286102295, "d": ".NET resource GetObject token", "e": [ "GetObject" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getobject-token", "l": 1, "el": [ "6e5a1" ] }, { "c": 0.7200000286102295, "d": "WinForms Timer control token", "e": [ "Timer" ], "i": "micro-behaviors/ui/controls/widget::winforms-timer", "l": 1, "el": [ "6dc0f" ] }, { "c": 0.6399999856948853, "d": "System Action delegate token", "e": [ "Action" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::action-delegate-token", "l": 1, "el": [ "6d659" ] }, { "d": "INSERT INTO SQL keyword", "e": [ "Insert into", "insert into" ], "i": "micro-behaviors/data/db/sql::sql-insert", "l": 3, "el": [ "6ed7f", "6f48c" ] }, { "c": 0.7200000286102295, "d": "Path combination helper token", "e": [ "Combine" ], "i": "micro-behaviors/fs/temp/directory::path-combine-token", "l": 1, "el": [ "6ca98" ] }, { "c": 0.8199999928474426, "d": "SQL password value update", "e": [ "password =", "Password =" ], "i": "micro-behaviors/data/db/sql::sql-plaintext-password-update", "l": 1, "el": [ "768be", "75b5d" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "6ddbb" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "KmDU.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "db6dc" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "7bf90" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AM token", "e": [ " AM " ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-am", "l": 1, "m": "B0007.003", "el": [ "73cba" ] }, { "c": 0.9399999976158142, "d": "Dominant largest PE section", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "metadata/binary/layout::large-dominant-section", "l": 1 }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "6e212" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "insert into empdailyreport (emp_number,idempwork,rate,comment,date,time) values(", "add_ValueChanged", "value", "dateTimePicker3_ValueChanged", "dateTimePicker5_ValueChanged", "set_Value", "insert into empdailyreport (emp_number,idempwork,rate,comment,date,time) value(", "insert into compdocs (did,data) values (", "dateTimePicker2_ValueChanged", "dateTimePicker4_ValueChanged", "ValueType", "dateTimePicker1_ValueChanged", "get_Value", "AddWithValue", "insert into empdailyreport (emp_number,idempwork,rate,comment,date,time,dropreason) values(", "Insert into attend_log (emp_number,emp_name,intime,outtime,wd,ot,totald,status,date,day,month,year) Values (@empno,@empname,@int" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "70639", "6c33b", "6cf01", "6c2e4", "6c31e", "6ceea", "6ff49", "6f48c", "6c2c7", "6c301", "6cabc", "6c2aa", "6cee0", "6cef4", "70210", "6ed7f" ] }, { "c": 0.699999988079071, "d": "LINQ query operations", "e": [ "System.Linq" ], "i": "micro-behaviors/data/db/linq::linq-queries", "l": 3, "el": [ "6da19" ] }, { "a": "T1027", "c": 0.8799999952316284, "d": ".NET MD5CryptoServiceProvider use", "e": [ "MD5CryptoServiceProvider" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-md5-crypto-service", "l": 1, "el": [ "6dace" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "7be38" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1, "el": [ "6cf20" ] }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 9419.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "DataGridViewCellStyle", "DebuggableAttribute", "AssemblyTitleAttribute", "EnumerableRowCollection", "InternalDataCollectionBase", "ComVisibleAttribute", "GeneratedCodeAttribute", "DebuggerBrowsableAttribute", "EditorBrowsableAttribute", "DataGridViewColumnHeadersHeightSizeMode", "DataGridViewColumnSortMode", "DebuggerNonUserCodeAttribute", "ApplicationSettingsBase", "AssemblyTrademarkAttribute", "CompilerGeneratedAttribute", "TableLayoutPanelCellBorderStyle" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "6c965", "6ccea", "6cd46", "69a46", "6cb25", "6cd32", "6ccb6", "6ccfe", "6cd19", "6c7cd", "6c802", "6cccd", "6cb4b", "6cd5d", "6cc8d", "6c9ab" ] }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "Select * from", "select rate from", "select code from", "Select emp_number,emp_fname,emp_mname,emp_lname,bank_name,ifsc_code,acc_number,bank_address,acc_name from", "Select idempwork,ticket_status from" ], "i": "micro-behaviors/data/db/sql::sql-select", "l": 3, "el": [ "6ecfe", "701a9", "6fbd6", "710a1", "6fcf0" ] }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1, "el": [ "f852a" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "Password =root" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1, "el": [ "75b5d" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53\" != \"kmdu\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "ProductVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2, "el": [ "f867a", "f87ba", "f852a" ] }, { "d": "SQL statement keywords", "e": [ "select code from", "select rate from", "Select emp_number,emp_fname,emp_mname,emp_lname,bank_name,ifsc_code,acc_number,bank_address,acc_name from", "Select * from", "Select idempwork,ticket_status from" ], "i": "micro-behaviors/data/db/sql::sql-keywords", "l": 3, "el": [ "6fbd6", "701a9", "710a1", "6ecfe", "6fcf0" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-08/f7a08ebdae40fcb8cdc61a569fdf42b9e65d2dd8f88a4cca9cae0e632a3d8f53.exe", "type": "pe" } ], "tv": "126f8" } }