{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999629259109497, "class": 2 } ], "prob": 0.9999629, "class": 2, "models": [ { "m": "az", "prob": 0.96348554, "class": 0 }, { "m": "az/native", "prob": 0.99706, "class": 0 }, { "m": "az/pe", "prob": 0.9999629, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T03:28:37Z" }, "path": "40498", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₂Si)", "k": { "hash.imp": "ee0eef5a22f0a6be5bafbf4eebc269ea", "pe.timestamp": 1420504568, "hash.authenti": "407a36fe9097e8abcc328850ade487278154b1d8da6455edf0c848e79732ff57", "hash.rich_header": "f7271f5af83b10a06cf4a4dd326afae997370f618505c3a3fa527fb2ed5d38a0", "build.target_arch": "x86", "pe.linker_version": "5.12", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.rich_header.xor_key": "0xd4cd6c21", "pe.inflated_sections[0]": ".rdata", "pe.data_directories[0].rva": 507932, "pe.data_directories[1].rva": 516096, "pe.data_directories[2].rva": 507904, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 4444, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 28, "pe.rich_header_compids[0].count": 10, "pe.rich_header_compids[1].count": 1, "binary.top_complex_unnamed[0].cc": 3, "pe.rich_header_compids[0].compid": 1253262, "binary.top_complex_unnamed[0].bbs": 75, "pe.rich_header_compids[1].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x47b27a", "binary.top_complex_unnamed[0].size": 14907, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.rich_header.entries[0].use_count": 10, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[0].product_id": 19, "pe.rich_header.entries[0].build_number": 8078, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].product_name": "unknown", "pe.section_characteristics[0].raw_size": 500736, "pe.section_characteristics[1].raw_size": 512, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[3].raw_size": 4608, "pe.section_characteristics[0].virtual_size": 503808, "pe.section_characteristics[1].virtual_size": 4096, "pe.section_characteristics[2].virtual_size": 173, "pe.section_characteristics[3].virtual_size": 4444, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 507904, "pe.section_characteristics[2].virtual_address": 512000, "pe.section_characteristics[3].virtual_address": 516096, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "c0040020" }, "x": 5, "id": 0, "is": [ "OleTranslateAccelerator", "ZwReplaceKey", "GetForegroundWindow", "GetClipboardViewer" ], "ms": { "pe": { "entry": 4096.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 4608.0, "subsystem": 2.0, "timestamp": 1420504568.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 5.62, "entry_section": ".text", "size_of_image": 524288.0, "file_alignment": 512.0, "resource_count": 2.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON" ], "characteristics": 271.0, "has_rich_header": true, "size_of_headers": 1536.0, "export_timestamp": 0.0, "import_dll_count": 3.0, "computed_checksum": 572041.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 5.0, "linker_minor_version": 12.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "max_section_inflation_ratio": 8.0 }, "file": { "size": 507904.0 }, "binary": { "code_size": 500736.0, "func_count": 6.0, "code_entropy": 7.96, "data_entropy": 2.76, "func_density": 0.01, "import_count": 4.0, "string_count": 186.0, "avg_func_size": 85905.0, "section_count": 4.0, "avg_complexity": 2.83, "import_density": 0.01, "max_complexity": 10.0, "string_density": 0.38, "overall_entropy": 4.78, "avg_basic_blocks": 80.83, "avg_section_size": 126592.0, "dependency_count": 3.0, "entropy_variance": 2.2, "avg_string_length": 6.76, "complexity_per_kb": 0.01, "max_string_length": 164.0, "avg_string_entropy": 2.18, "code_to_data_ratio": 88.91, "data_to_file_ratio": 0.0, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.99, "total_basic_blocks": 485.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 12.34, "largest_section_ratio": 0.99, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "writable_section_count": 2.0, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 432, ".text" ], [ 511, "@.data" ], [ 552, ".rsrc" ], [ 6200, "/CVGx%y" ], [ 11237, "QAX0Q" ], [ 21778, "6j6v" ], [ 22382, "4iv5t" ], [ 24433, "5vjvu" ], [ 26154, "Tjvw" ], [ 29758, "6ivu" ], [ 36640, "IYkvZYkvZYkeZ;" ], [ 36660, "HYkvZYkuZY" ], [ 36678, "fvZYkvZYktZYk" ], [ 36819, "vZYkgZY" ], [ 36828, ";#yvZYkvZYkiZY" ], [ 36888, "KkvZYkvZYk{ZY" ], [ 36904, ":#yvZYkvZYkd:\u0026" ], [ 36944, ":#yvZYkvZYkiZY" ], [ 37020, "HYkvZYkvZYke" ], [ 37544, "HYkvZYkvZYk~Z" ], [ 37579, "vZYkvZYkvZYkc" ], [ 37619, "Vh%yvZYkvZYkl" ], [ 37780, "KkvZYkvZYkgZ" ], [ 37920, "WYkvZYkvZYkw:" ], [ 48374, "DCDV" ], [ 53340, "oW-S|W-P|Wm3oW-S|W-S|W-A" ], [ 54797, "YpZ%TpZ%TpjZ" ], [ 56164, "L.bZ%TpZ%TpJ" ], [ 56488, "L.bZ%TpZ%Tp_E" ], [ 58603, "/2Og" ], [ 62930, "Gzte" ], [ 63388, "l18z" ], [ 66981, "/lK3LMc" ], [ 69534, "/4wc" ], [ 69879, "pt3e" ], [ 71294, "H75TD" ], [ 71799, "U3TL" ], [ 72392, "8ZEQ" ], [ 72817, "7LXI" ], [ 74014, "s373" ], [ 77822, "g 0w" ], [ 80878, "Fajm" ], [ 85218, "Sgsj" ], [ 85669, "F9I8" ], [ 87499, "Aqlc" ], [ 88531, "e130" ], [ 89310, "xv-che" ], [ 89665, "V xu" ], [ 92010, "f9g6" ], [ 97069, "BG_E" ], [ 97939, "5PMU" ], [ 98817, "QWQGH" ], [ 99404, "/aUm" ], [ 101376, "/5PG" ], [ 101496, "iuzwx" ], [ 102206, "IRT_" ], [ 104231, "lb_SY" ], [ 107668, "/nrI" ], [ 109738, "P.ogw" ], [ 111156, "BPQJ" ], [ 111914, "IMrTMafp" ], [ 115708, "7mej" ], [ 117904, "Erml" ], [ 119326, "6e5r" ], [ 133142, "Ywux" ], [ 134558, "d9FnI.b" ], [ 135058, "CJTZ" ], [ 140247, "O X2" ], [ 144995, "ZE_7" ], [ 147388, "3bav" ], [ 147566, "5j0z" ], [ 155544, "/mvOA_Q" ], [ 156897, "Bxbl" ], [ 157484, "o9wh" ], [ 158239, "Hiky" ], [ 162744, "Lrnu" ], [ 164552, "UGW4M" ], [ 169148, "Giez" ], [ 172045, "502h" ], [ 173629, "KRGFR" ], [ 173902, "rVgwxKO" ], [ 175094, "3tia" ], [ 178282, "v8v4" ], [ 179429, "/y6L" ], [ 180276, "F9S7" ], [ 182381, "Z8W3" ], [ 190697, "a98p" ], [ 190937, "Na\u003c\u003cb" ], [ 195205, "Q7BQ" ], [ 198149, "Fl.e" ], [ 198294, "L1I6" ], [ 202214, "Nxfx" ], [ 202490, "Fyfx" ], [ 204341, "/1Wrr" ], [ 204586, "Posh" ], [ 204819, "TL8S" ], [ 207694, "RZJB" ], [ 207904, "Ebvs" ], [ 208954, "IPF9" ], [ 211541, "6FPY" ], [ 218900, "u1x4" ], [ 223447, "LIK1" ], [ 230279, "yf.x" ], [ 230356, "96JZ" ], [ 230553, "/M2\td" ], [ 230691, "/X07" ], [ 234693, "NBCM" ], [ 238403, "/Hq9" ], [ 239442, "8QEA" ], [ 245268, "S63_" ], [ 249427, "Fcji" ], [ 251408, "g0ni" ], [ 262753, "M0SH" ], [ 263744, "Z0BY" ], [ 263896, "IV18" ], [ 265773, "9QAH" ], [ 266977, "ADY6" ], [ 273726, "WRPG" ], [ 280362, "/bzj" ], [ 291961, "YAMgKAMgKA" ], [ 292005, "YAMgKAMgKA]gK" ], [ 292809, "ZOCGW" ], [ 293101, "Roxu" ], [ 293137, "/x'yRer" ], [ 298489, "Shky" ], [ 298837, "Shkl" ], [ 300673, "/llo" ], [ 302636, "S ts" ], [ 302946, "4PS WY" ], [ 304201, "I5PR" ], [ 304292, "RD5Q" ], [ 304355, "8Y S" ], [ 306697, "H7XR" ], [ 308192, "Q 0S" ], [ 309756, "Z 0S" ], [ 315019, "s3j4" ], [ 316705, "597A" ], [ 317502, "9265" ], [ 318334, "YR45" ], [ 321402, "su9p" ], [ 321566, "USZ 1" ], [ 322257, "Qsuyt" ], [ 323558, "yu9p" ], [ 333391, "SWD9" ], [ 334371, "SWD8" ], [ 335013, "dsu9p" ], [ 343133, "2XZK" ], [ 344176, "9w z" ], [ 344462, "201v" ], [ 348137, "2XZE" ], [ 352441, "EtheDTk" ], [ 364049, "7EYB" ], [ 364897, "P8CND" ], [ 377629, "/x4y" ], [ 380348, "D4AH" ], [ 380584, "I4AH" ], [ 382338, "TDLG" ], [ 384405, "28RS" ], [ 390377, "MEW3" ], [ 392632, "EMIA" ], [ 393237, "/} yREr" ], [ 397929, ".tey" ], [ 402400, "j1im" ], [ 403081, "R ry" ], [ 410253, "/v6yR" ], [ 412549, "00to" ], [ 412563, "to40t" ], [ 423518, "CKIZ" ], [ 431963, "al'\".wX" ], [ 433171, "tlWg.gu" ], [ 433909, "My.j" ], [ 453541, "Opnmb" ], [ 459283, "pLo .eV" ], [ 468219, "b3k5" ], [ 468361, "/y2yR" ], [ 471561, "28tz" ], [ 486972, "Acqs" ], [ 502410, "OleTranslateAccelerator" ], [ 502434, "ole32.dll" ], [ 502446, "ZwReplaceKey" ], [ 502459, "ntdll.dll" ], [ 502471, "GetForegroundWindow" ], [ 502493, "GetClipboardViewer" ], [ 502512, "user32.dll" ], [ 507740, "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ] ], "sz": 507904, "ts": [ { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 4.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 6.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.6000000238418579, "d": "Clipboard keyword", "e": [ "GetClipboardViewer" ], "i": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.func_count = 6.00" ], "i": "metadata/binary/metrics/structural::few-functions", "l": 3 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.96)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 6.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.78" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.78" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 7.96, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.18" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "c": 0.75, "d": "Text section dominates file", "e": [ "binary.text_to_file_ratio = 0.99" ], "i": "metadata/binary/layout::text-section-dominates-file", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "49" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 485.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.96" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "40498" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Query current foreground window", "e": [ "GetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage/control::get-foreground-window", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 2.83" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1420504568.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4608.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 2.35)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 186.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Average function size over 50KB", "e": [ "binary.avg_func_size = 85905.00" ], "i": "metadata/binary/metrics/pe-details::extremely-large-avg-function", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 4.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "40498" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_func_size = 85905.00" ], "i": "metadata/binary/metrics/structural::giant-average-function", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.96" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 8.00" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 524288.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 85905.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 2.83" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 4.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "OleTranslateAccelerator" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 7.96, perms: r-x)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ ".rdata = 0.1% of total (512 / 507904 bytes)", ".rdata" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 4.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform/defender::ntdll-dll-str", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 4.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 6.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1420504568.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links ole32.dll (OleTranslateAccelerator)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (GetForegroundWindow, GetClipboardViewer)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ntdll.dll (ZwReplaceKey)", "e": [ "ntdll.dll" ], "i": "metadata/dylib::ntdll/dll", "l": 2 } ], "sha": "f7e841d930ca853f18486fcbe8ed7ea9e66f6e1d2b24be4c985ed9618668cb70", "path": "40498", "type": "pe" } ], "tv": "d376d" } }