{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9580419659614563, "class": 0 } ], "prob": 0.95804197, "class": 0, "models": [ { "m": "az", "prob": 0.6687533, "class": 0 }, { "m": "az/native", "prob": 0.95804197, "class": 0 }, { "m": "az/pe", "prob": 0.72279793, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-13T08:45:33Z" }, "path": "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "29dfe51c05c452826b0c5c7ef5e5f5fd", "pe.checksum": "0x001fd26a", "pe.timestamp": 3949361643, "hash.authenti": "7bfb97dcd6b86c29031400101e3529986158ba8b8e2795713e5981da1a0af130", "build.target_arch": "x86", "pe.linker_version": "48.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.data_directories[0].rva": 1816024, "pe.data_directories[1].rva": 1818624, "pe.data_directories[2].rva": 1875968, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 55132, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.dll_characteristics.no_seh": true, "pe.dll_characteristics.nx_compat": true, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rsrc", "pe.section_characteristics[2].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[0].raw_size": 1808384, "pe.section_characteristics[1].raw_size": 55296, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[0].virtual_size": 1807924, "pe.section_characteristics[1].virtual_size": 55132, "pe.section_characteristics[2].virtual_size": 12, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 1818624, "pe.section_characteristics[2].virtual_address": 1875968, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "42000040" }, "x": 42, "id": 0, "is": [ "CorExeMain" ], "ms": { "pe": { "entry": 1816110.0, "machine": 332.0, "checksum": 2085482.0, "is_dotnet": true, "rsrc_size": 55296.0, "subsystem": 2.0, "timestamp": 3949361643.0, "icon_count": 2.0, "image_base": 4194304.0, "clr_version": "2.5", "has_checksum": true, "rsrc_entropy": 7.22, "entry_section": ".text", "size_of_image": 1884160.0, "file_alignment": 512.0, "resource_count": 2.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON" ], "characteristics": 34.0, "size_of_headers": 512.0, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 1889361.0, "section_alignment": 8192.0, "timestamp_anomaly": true, "resource_timestamp": 0.0, "dll_characteristics": 34112.0, "timestamp_in_future": true, "has_export_timestamp": false, "linker_major_version": 48.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 1864704.0 }, "binary": { "code_size": 1808384.0, "code_entropy": 2.67, "import_count": 1.0, "string_count": 133.0, "section_count": 3.0, "import_density": 0.0, "string_density": 0.08, "overall_entropy": 3.33, "avg_section_size": 621397.31, "dependency_count": 1.0, "entropy_variance": 2.94, "avg_string_length": 6737.55, "max_string_length": 894074.0, "wide_string_count": 2.0, "avg_string_entropy": 2.91, "code_to_data_ratio": 32.4, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.97, "string_length_stddev": 77232.73, "largest_section_ratio": 0.97, "sentence_string_count": 2.0, "sentence_string_ratio": 0.02 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "@.reloc" ], [ 3580, "BSJB" ], [ 5144, "wide", "æÉFêÉǬïñǢô¡" ], [ 5561, "IEnumerable`1" ], [ 5575, "LowLevelListWithIList`1" ], [ 5599, "LowLevelList`1" ], [ 5614, "Microsoft.Win32" ], [ 5652, "System.IO" ], [ 5662, "LSA_OBJECT_ATTRIBUTES" ], [ 5684, "System.Private.Reflection.Metadata" ], [ 5719, "mscorlib" ], [ 5728, "System.Collections.Generic" ], [ 5755, "Microsoft.VisualBasic" ], [ 5781, "get_IsNativeFormatMetadataBased" ], [ 5813, "CompareMethod" ], [ 5827, "Replace" ], [ 5835, "AddRange" ], [ 5844, "MethodHandle" ], [ 5857, "RuntimeTypeHandle" ], [ 5875, "TypeDefinitionHandle" ], [ 5896, "get_NativeFormatHandle" ], [ 5919, "AssemblyName" ], [ 5932, "TryGetMetadataForNamedType" ], [ 5959, "GetType" ], [ 5967, "System.Private.Reflection.Core" ], [ 5998, "Internal.Reflection.Core" ], [ 6023, "STAThreadAttribute" ], [ 6042, "WriteByte" ], [ 6059, "Win32Native" ], [ 6143, ".exe" ], [ 6148, "Initialize" ], [ 6159, "Microsoft.VisualStudio.Threading" ], [ 6192, "NewLateBinding" ], [ 6207, "ToString" ], [ 6216, "GetString" ], [ 6226, "get_Length" ], [ 6237, "System.Reflection.Runtime.General" ], [ 6271, "LateCall" ], [ 6280, "MemoryStream" ], [ 6293, "System" ], [ 6300, "Boolean" ], [ 6308, "get_ExecutionDomain" ], [ 6328, "InitializeExecutionDomain" ], [ 6354, "Join" ], [ 6359, "ReflectionDomainSetupImplementation" ], [ 6395, "ReflectionExecutionDomainCallbacksImplementation" ], [ 6444, "ExecutionEnvironmentImplementation" ], [ 6479, "System.Reflection" ], [ 6497, "QMethodDefinition" ], [ 6515, "QTypeDefinition" ], [ 6531, "MissingManifestResourceException" ], [ 6564, "Internal.Reflection.Core.Execution" ], [ 6599, "System.Private.Reflection.Execution" ], [ 6635, "Internal.Reflection.Execution" ], [ 6665, "ReflectionCoreExecution" ], [ 6689, "StringComparison" ], [ 6706, "FieldInfo" ], [ 6716, "MethodInfo" ], [ 6727, "ConstructorInfo" ], [ 6743, "PropertyInfo" ], [ 6756, "ReflectionDomainSetup" ], [ 6778, "Char" ], [ 6783, "MetadataReader" ], [ 6798, "get_NativeFormatReader" ], [ 6821, "System.Private.TypeLoader" ], [ 6847, "System.Resources.ResourceManager" ], [ 6880, ".ctor" ], [ 6886, ".cctor" ], [ 6893, "Microsoft.VisualBasic.CompilerServices" ], [ 6932, "System.Resources" ], [ 6949, "Strings" ], [ 6957, "ReflectionExecutionDomainCallbacks" ], [ 6992, "Equals" ], [ 6999, "get_Chars" ], [ 7009, "RegistryChangeNotificationFilters" ], [ 7043, "TryGetMethodForStartAddress" ], [ 7071, "Internal.Runtime.Augments" ], [ 7097, "RuntimeAugments" ], [ 7113, "Concat" ], [ 7120, "Internal.Metadata.NativeFormat" ], [ 7151, "Object" ], [ 7158, "LateGet" ], [ 7166, "Split" ], [ 7172, "ExecutionEnvironment" ], [ 7193, "Convert" ], [ 7201, "ToArray" ], [ 7209, "Assembly" ], [ 7218, "op_Equality" ], [ 18681, "BB VA tFF A U A A A F A A A vqq vqq A A twF A A A A A A A DF A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A" ], [ 1806857, "Assembly" ], [ 1806875, "Load" ], [ 1808414, "mscoree.dll" ], [ 1809672, "wwt7awww" ], [ 1809717, "wVRVsCGCV5wwsg" ], [ 1809764, "uu4pt" ], [ 1809835, "7rwwqa" ], [ 1809953, "wusu4" ], [ 1810451, "Xxxw" ], [ 1813395, "{{zxxxttxzyz{{" ], [ 1813443, "ytsnhhghhknsxz" ], [ 1813489, "zskcWLHBBABHMcgkx{" ], [ 1813536, "yncLA30(''((,17BMgoz" ], [ 1814496, "12128" ], [ 1814511, "^3122''@4)!" ], [ 1814544, "/7737T" ], [ 1814559, "97762" ], [ 1814739, "7AAAAAAAAAAEA@!" ], [ 1817103, "ngghb^TPFFEFJSY_bm" ], [ 1817196, "nrsqeO-" ], [ 1817227, "twwwqS/" ], [ 1818996, "wide", "/ P6pL" ], [ 1819351, "OQQJ" ], [ 1819579, "IHDR" ], [ 1825291, "A504" ], [ 1825763, ".swv" ], [ 1829556, "/cKA" ], [ 1831349, "6S L" ], [ 1832752, "ozu5" ], [ 1836684, "T6EA" ], [ 1839465, "IIQN" ], [ 1843523, "N6FG" ], [ 1846386, "IEND" ], [ 1848176, "jiiAhhf" ], [ 1849511, "8UVW" ], [ 1850279, "5fgi" ], [ 1857487, "Wiij" ], [ 1857608, "xxy.\u0026\u0026'e[[]" ], [ 1861015, "Ippq" ], [ 1862912, "edbDedb" ], [ 1863487, "RSVZ" ], [ 1864028, "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ] ], "sz": 1864704, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0xdfc" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Strings", "StringComparison", "ToString", "GetString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic.CompilerServices", "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code UA token", "e": [ " UA " ], "i": "objectives/anti-analysis/geofencing/region/country-code-d::country-code-ua", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.91" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1140", "c": 0.8999999761581421, "d": "VB LateGet dispatch token", "e": [ "LateGet" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token", "l": 1, "m": "B0030" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 3949361643.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "c": 0.75, "d": "Text section dominates file", "e": [ "binary.text_to_file_ratio = 0.97" ], "i": "metadata/binary/layout::text-section-dominates-file", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.91" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.33" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection", "System.Reflection.Runtime.General" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.03" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.8600000143051147, "d": "VB late binding token", "e": [ "LateCall" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-latecall-token", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.33" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.9200000166893005, "d": "Large binary with few functions", "e": [ "binary.func_count = 0.00" ], "i": "metadata/package/metrics::recovered-function-count-under-10", "l": 2 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "c": 0.8399999737739563, "d": "Large binary with few imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "System.Resources.ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2 }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 7.22" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-high-rsrc-entropy", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 133.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.02" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 55296, entropy: 7.22)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "a": "T1140", "c": 0.9200000166893005, "d": "VB NewLateBinding dispatch helper", "e": [ "NewLateBinding" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding", "l": 1, "m": "B0030" }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.949999988079071, "d": "PE compile timestamp far in future", "e": [ "pe.timestamp = 3949361643.00" ], "i": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "l": 4 }, { "a": "T1027", "c": 0.8500000238418579, "d": "One .text section dominates file", "e": [ "binary.text_to_file_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::text-heavy-binary", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE timestamp anomaly detected", "e": [ "pe.timestamp_anomaly = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::timestamp-anomaly", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.75, "d": "DJB2 hash algorithm constant (5381)", "e": [ "05 15 00 00" ], "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "l": 1, "m": "B0032.014" }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 3949361643.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.22)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 3, "m": "C0027" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Giant embedded string blob metric", "e": [ "binary.max_string_length = 894074.00" ], "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorExeMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "pe.is_dotnet = 1.00", "BSJB", "mscoree.dll" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 }, { "c": 0.8500000238418579, "d": "Low entropy .NET text carrier", "e": [ "pe.is_dotnet = 1.00", "mscoree.dll", "BSJB", "binary.section_count = 3.00", "binary.string_count = 133.00", "binary.overall_entropy = 3.33", "binary.text_to_file_ratio = 0.97" ], "i": "metadata/binary/layout::dotnet-low-entropy-text-carrier", "l": 1 }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3", "path": "f8b2a61980a813aed9ddfc78a0c8bd5ba66e6cc4c6afc6ac15b0b2486328d8d3.exe", "type": "pe" } ], "tv": "92e78" } }