{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8143885135650635, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.8143885, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8143885, "class": 0 }, { "m": "az/native", "prob": 0.06514995, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T00:56:47Z" }, "path": "f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)", "x": 6, "ff": { "i": [ [ "kernel32", "WriteFile" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "WaitForMultipleObjects" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "SwitchToThread" ], [ "kernel32", "SuspendThread" ], [ "kernel32", "Sleep" ], [ "kernel32", "SetWaitableTimer" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "SetProcessPriorityBoost" ], [ "kernel32", "SetEvent" ], [ "kernel32", "SetErrorMode" ], [ "kernel32", "SetConsoleCtrlHandler" ], [ "kernel32", "ResumeThread" ], [ "kernel32", "PostQueuedCompletionStatus" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "LoadLibraryW" ], [ "kernel32", "SetThreadContext" ], [ "kernel32", "GetThreadContext" ], [ "kernel32", "GetSystemInfo" ], [ "kernel32", "GetSystemDirectoryA" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetQueuedCompletionStatusEx" ], [ "kernel32", "GetProcessAffinityMask" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "DuplicateHandle" ], [ "kernel32", "CreateWaitableTimerExW" ], [ "kernel32", "CreateThread" ], [ "kernel32", "CreateIoCompletionPort" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "CreateEventA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "AddVectoredExceptionHandler" ] ], "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 940878.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 54.0, "base_relocation_entry_count": 8973.0 }, "file": { "size": 929792.0, "entropy": 5.94, "size_bytes": 929792.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.15, "data_entropy": 2.35, "string_count": 2779.0, "entropy_variance": 4.47, "avg_string_length": 35.32, "max_string_length": 33776.0, "code_to_data_ratio": 0.96, "string_length_stddev": 673.61, "largest_section_ratio": 0.51, "sentence_string_count": 314.0, "sentence_string_ratio": 0.11, "high_entropy_string_count": 0.0 }, "imports": { "count": 40.0 }, "sections": { "count": 6.0, "code_size": 415744.0, "entropy_max": 6.15, "entropy_mean": 3.77, "name_entropy": 3.43, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 392, "u8", ".text" ], [ 471, "u8", "@.data" ], [ 512, "u8", ".idata" ], [ 552, "u8", ".reloc" ], [ 591, "u8", "B.symtab" ], [ 417638, "u8", "time" ], [ 417710, "u8", "Size" ], [ 417734, "u8", "base" ], [ 417746, "u8", "code" ], [ 417764, "u8", "data" ], [ 417776, "u8", "elem" ], [ 417788, "u8", "goid" ], [ 417806, "u8", "head" ], [ 417812, "u8", "heap" ], [ 417818, "u8", "init" ], [ 417878, "u8", "name" ], [ 417902, "u8", "node" ], [ 417986, "u8", "sema" ], [ 417992, "u8", "size" ], [ 417998, "u8", "text" ], [ 418010, "u8", "used" ], [ 418016, "u8", "user" ], [ 418068, "u8", "NumIn" ], [ 418082, "u8", "align" ], [ 418089, "u8", "alloc" ], [ 418110, "u8", "cache" ], [ 418124, "u8", "count" ], [ 418131, "u8", "cutab" ], [ 418145, "u8", "edata" ], [ 418152, "u8", "elems" ], [ 418173, "u8", "equal" ], [ 418180, "u8", "etext" ], [ 418187, "u8", "everr" ], [ 418194, "u8", "extra" ], [ 418222, "u8", "gFree" ], [ 418229, "u8", "gList" ], [ 418243, "u8", "hash0" ], [ 418250, "u8", "incgo" ], [ 418257, "u8", "inter" ], [ 418264, "u8", "limit" ], [ 418278, "u8", "magic" ], [ 418292, "u8", "minLC" ], [ 418320, "u8", "param" ], [ 418355, "u8", "reset" ], [ 418397, "u8", "state" ], [ 418411, "u8", "timer" ], [ 418432, "u8", "wbBuf" ], [ 418439, "u8", "wbuf1" ], [ 418446, "u8", "wbuf2" ], [ 418690, "u8", "errors" ], [ 418698, "u8", "unsafe" ], [ 418802, "u8", "Unwrap" ], [ 418810, "u8", "_defer" ], [ 418818, "u8", "_panic" ], [ 418826, "u8", "abiMap" ], [ 418834, "u8", "allocN" ], [ 418842, "u8", "closed" ], [ 418850, "u8", "common" ], [ 418858, "u8", "divMul" ], [ 418866, "u8", "divmod" ], [ 418874, "u8", "etypes" ], [ 418882, "u8", "gcdata" ], [ 418890, "u8", "goexit" ], [ 418898, "u8", "inList" ], [ 418906, "u8", "insert" ], [ 418914, "u8", "isFree" ], [ 418922, "u8", "labels" ], [ 418930, "u8", "layout" ], [ 418938, "u8", "length" ], [ 418946, "u8", "mFixup" ], [ 418954, "u8", "mcache" ], [ 418962, "u8", "mcount" ], [ 418970, "u8", "nelems" ], [ 418978, "u8", "nfiles" ], [ 418986, "u8", "noscan" ], [ 418994, "u8", "npages" ], [ 419002, "u8", "offset" ], [ 419010, "u8", "palloc" ], [ 419018, "u8", "parent" ], [ 419026, "u8", "pcache" ], [ 419034, "u8", "period" ], [ 419042, "u8", "procid" ], [ 419050, "u8", "ptrbit" ], [ 419058, "u8", "qcount" ], [ 419066, "u8", "refill" ], [ 419074, "u8", "remove" ], [ 419082, "u8", "retPop" ], [ 419090, "u8", "signed" ], [ 419098, "u8", "status" ], [ 419106, "u8", "string" ], [ 419114, "u8", "thread" ], [ 419122, "u8", "ticket" ], [ 419130, "u8", "timers" ], [ 419138, "u8", "tryGet" ], [ 419146, "u8", "vdsoPC" ], [ 419154, "u8", "vdsoSP" ], [ 419162, "u8", "xcount" ], [ 419170, "u8", "runtime" ], [ 419186, "u8", "syscall" ], [ 419303, "u8", "Timeout" ], [ 419312, "u8", "aborted" ], [ 419321, "u8", "alllink" ], [ 419330, "u8", "balance" ], [ 419339, "u8", "blocked" ], [ 419348, "u8", "buckets" ], [ 419357, "u8", "cgoCtxt" ], [ 419366, "u8", "chanDir" ], [ 419375, "u8", "closing" ], [ 419384, "u8", "dequeue" ], [ 419393, "u8", "destroy" ], [ 419402, "u8", "discard" ], [ 419411, "u8", "dispose" ], [ 419420, "u8", "enqueue" ], [ 419429, "u8", "filetab" ], [ 419438, "u8", "framepc" ], [ 419447, "u8", "funcoff" ], [ 419456, "u8", "growing" ], [ 419465, "u8", "gsignal" ], [ 419474, "u8", "hasName" ], [ 419483, "u8", "hasmain" ], [ 419492, "u8", "isBlank" ], [ 419501, "u8", "isEmpty" ], [ 419510, "u8", "libcall" ], [ 419519, "u8", "lockedg" ], [ 419528, "u8", "lockedm" ], [ 419537, "u8", "makeArg" ], [ 419546, "u8", "methods" ], [ 419555, "u8", "morebuf" ], [ 419564, "u8", "nameOff" ], [ 419573, "u8", "pkgPath" ], [ 419582, "u8", "pkgpath" ], [ 419591, "u8", "preempt" ], [ 419600, "u8", "ptrSize" ], [ 419609, "u8", "ptrdata" ], [ 419618, "u8", "pushAll" ], [ 419627, "u8", "pushcnt" ], [ 419636, "u8", "putFast" ], [ 419645, "u8", "racectx" ], [ 419654, "u8", "runnext" ], [ 419672, "u8", "sigmask" ], [ 419681, "u8", "sortkey" ], [ 419690, "u8", "started" ], [ 419699, "u8", "startpc" ], [ 419708, "u8", "success" ], [ 419717, "u8", "takeAll" ], [ 419726, "u8", "textOff" ], [ 419735, "u8", "topbits" ], [ 419744, "u8", "tophash" ], [ 419753, "u8", "typeOff" ], [ 419762, "u8", "typemap" ], [ 419771, "u8", "waiting" ], [ 419870, "u8", "Required" ], [ 419880, "u8", "asserted" ], [ 419890, "u8", "baseaddr" ], [ 419900, "u8", "bytedata" ], [ 419910, "u8", "callingG" ], [ 419920, "u8", "concrete" ], [ 419930, "u8", "cuOffset" ], [ 419940, "u8", "dataqsiz" ], [ 419950, "u8", "dispatch" ], [ 419960, "u8", "dlogPerM" ], [ 419970, "u8", "doesPark" ], [ 419980, "u8", "dstSpill" ], [ 419990, "u8", "elemsize" ], [ 420000, "u8", "elemtype" ], [ 420010, "u8", "fastrand" ], [ 420020, "u8", "flushGen" ], [ 420030, "u8", "freeWait" ], [ 420040, "u8", "freelink" ], [ 420050, "u8", "isSelect" ], [ 420060, "u8", "libcallg" ], [ 420070, "u8", "lockAddr" ], [ 420080, "u8", "lockSlow" ], [ 420090, "u8", "mstartfn" ], [ 420100, "u8", "mustFind" ], [ 420110, "u8", "mustLoad" ], [ 420120, "u8", "ncgocall" ], [ 420130, "u8", "needzero" ], [ 420140, "u8", "nextFree" ], [ 420150, "u8", "nextwhen" ], [ 420160, "u8", "noptrbss" ], [ 420170, "u8", "objIndex" ], [ 420180, "u8", "overflow" ], [ 420190, "u8", "pcHeader" ], [ 420200, "u8", "pointers" ], [ 420210, "u8", "putBatch" ], [ 420220, "u8", "raceaddr" ], [ 420230, "u8", "runqhead" ], [ 420240, "u8", "runqtail" ], [ 420260, "u8", "scanWork" ], [ 420270, "u8", "sigcode0" ], [ 420280, "u8", "sigcode1" ], [ 420290, "u8", "specials" ], [ 420300, "u8", "spinning" ], [ 420310, "u8", "statsSeq" ], [ 420320, "u8", "stktopsp" ], [ 420330, "u8", "sudogbuf" ], [ 420340, "u8", "sweepgen" ], [ 420350, "u8", "throwing" ], [ 420360, "u8", "tracebuf" ], [ 420370, "u8", "traceseq" ], [ 420380, "u8", "tracking" ], [ 420390, "u8", "tryMerge" ], [ 420400, "u8", "uncommon" ], [ 420410, "u8", "waitlink" ], [ 420420, "u8", "waitlock" ], [ 420430, "u8", "waitsema" ], [ 420440, "u8", "waittail" ], [ 420450, "u8", "writebuf" ], [ 420537, "u8", "*chan int" ], [ 420570, "u8", "Temporary" ], [ 420581, "u8", "allocBits" ], [ 420592, "u8", "ancestors" ], [ 420603, "u8", "assignArg" ], [ 420614, "u8", "assignReg" ], [ 420625, "u8", "caughtsig" ], [ 420636, "u8", "deferpool" ], [ 420647, "u8", "enoptrbss" ], [ 420658, "u8", "freeindex" ], [ 420669, "u8", "gcbssmask" ], [ 420680, "u8", "goidcache" ], [ 420691, "u8", "itablinks" ], [ 420702, "u8", "libcallpc" ], [ 420713, "u8", "libcallsp" ], [ 420724, "u8", "lockedExt" ], [ 420735, "u8", "lockedInt" ], [ 420746, "u8", "locksHeld" ], [ 420757, "u8", "mallocing" ], [ 420768, "u8", "nevacuate" ], [ 420779, "u8", "nextwaitm" ], [ 420790, "u8", "noptrdata" ], [ 420801, "u8", "noverflow" ], [ 420812, "u8", "numTimers" ], [ 420823, "u8", "openDefer" ], [ 420834, "u8", "pclntable" ], [ 420845, "u8", "pkghashes" ], [ 420856, "u8", "printlock" ], [ 420867, "u8", "profilehz" ], [ 420878, "u8", "ptrToThis" ], [ 420889, "u8", "recovered" ], [ 420900, "u8", "retOffset" ], [ 420922, "u8", "scanAlloc" ], [ 420933, "u8", "schedlink" ], [ 420944, "u8", "schedtick" ], [ 420955, "u8", "schedwhen" ], [ 420966, "u8", "sizeclass" ], [ 420977, "u8", "spanclass" ], [ 420988, "u8", "stackLock" ], [ 420999, "u8", "startAddr" ], [ 421010, "u8", "syscallpc" ], [ 421021, "u8", "syscallsp" ], [ 421032, "u8", "traceback" ], [ 421043, "u8", "typelinks" ], [ 421054, "u8", "waitsince" ], [ 421114, "u8", "*chan bool" ] ], "v": { "file.stem": "f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260", "pe.imphash": "c7269d59926fa4252270f407e4dab043", "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "file.basename": "f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260.exe", "pe.image_base": 4194304, "pe.image_size": 1314816, "pe.machine_id": 34404, "pe.os_version": "6.1", "build.username": "86135", "pe.entry_point": 365120, "build.user_home": "/Users/86135", "pe.headers_size": 1536, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "90512be2353849e846f64712ded365cd40ea730b", "build.username_from": "byte_scan", "pe.image_hash.sha256": "aef2d5265500932eab1bd147beebf343959784c44a84a9cf0e5ea04fa5877672", "pe.image_hash.sha384": "67bca4195783af670f82b0d624b74641210975a4d9837163e880464fe91c6b5c2411717741f7fc27e48d876f0fa90dd3", "pe.image_hash.sha512": "776e87e82daf421905f3c16a1a06a7401bb02f2dbaa42ffb23b6c1782fa0eff435deaec18a3ff568079ce31f287dbd95c6e4796ecc0194df558b0564db1df4d1", "pe.section_alignment": 4096, "pe.subsystem_version": "6.1", "build.source_paths[0]": "/Users/86135/go/src/awesomeProject/2.go", "build.source_paths[1]": "C:/Users/86135/go/src/awesomeProject/2.go", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 546, "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 3, "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 1286144, "pe.data_directories[1].rva": 1290240, "pe.data_directories[2].rva": 901152, "pe.dll_characteristics_raw": 33120, "pe.number_of_rva_and_sizes": 16, "pe.coff.symbol_table_offset": 929280, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 1164, "pe.data_directories[1].name": "base_relocation", "pe.data_directories[1].size": 18378, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 328, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 54, "pe.base_relocations.entry_count": 8973 }, "id": "pe", "sc": [ [ ".text", 1536, 415744, 6.15, "r-x" ], [ ".rdata", 417280, 477184, 5.15, "r--" ], [ ".data", 894464, 14848, 2.22, "rw-" ], [ ".idata", 909312, 1536, 3.61, "rw-" ], [ ".reloc", 910848, 18432, 5.44, "r--" ], [ ".symtab", 929280, 512, 0.02, "r--" ] ] }, "id": 0, "sz": 929792, "ts": [ { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2779.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x11e5" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 2779.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2, "el": [ "0xdc130" ] }, { "c": 0.20000000298023224, "d": "encrypted-file trailer vocabulary", "e": [ "magic" ], "i": "micro-behaviors/data/text/keywords/lexicon::encrypted-trailer-vocab", "l": 1, "el": [ "0x661e6" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 14848)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2, "el": [ "0xdc048" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1, "el": [ "0x2fd27" ] }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2, "el": [ "0xdc120" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x475cb9" ] }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "0xdc028" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "0xdc108" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0xdc068" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0xde240" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2, "el": [ "0xdc0d8" ] }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2, "el": [ "0xde06e" ] }, { "a": "T1055", "c": 0.8799999952316284, "d": "Go syscall Proc.Call trampoline", "e": [ "syscall.(*Proc).Call" ], "i": "objectives/evasion/process/injection/shellcode::go-syscall-proc-call", "l": 1, "m": "B0033", "el": [ "0x9ac2e" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is already connected", "transport endpoint is not connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2, "el": [ "0x47b1b8", "0x47ab2d" ] }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1, "el": [ "0x2642c" ] }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2, "el": [ "0xde2d2" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1, "el": [ "0xe51d", "0x2541b" ] }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "input/output error" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1, "el": [ "0x477049" ] }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0xdc0b8", "0xdc0b0" ] }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2, "el": [ "0xde134" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x479a62" ] }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039", "el": [ "0xdc148" ] }, { "d": "overflow keyword", "e": [ "runtime.(*bmap).overflow", "runtime.(*bmap).setoverflow", "runtime.(*hmap).incrnoverflow", "oldoverflow", "…panicfloatruntime.panicoverflowruntime.setBadSignalMsg…", "…flowruntime.(*hmap).newoverflowruntime.(*bmap).overflo…", "incrnoverflow", "noverflow", "newoverflow", "overflow", "runtime.panicoverflow", "…ocruntime.(*hmap).incrnoverflowruntime.(*hmap).newover…", "…verflowruntime.(*bmap).overflowruntime.(*bmap).setover…", "setoverflow", "integer overflow", "…flowruntime.(*bmap).setoverflowruntime.(*hmap).createO…" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1, "el": [ "0x93c04", "0x93c1d", "0x93bca", "0x67093", "0x493d60", "0x493d60", "0x67413", "0x66bc1", "0x67079", "0x66954", "0x9847e", "0x493d60", "0x493d60", "0x670ee", "0x476a0a", "0x493d60" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0xdc140" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0xdc078" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0xde31a" ] }, { "d": "Regex component marker", "e": [ "runtime.main", "runtime.main.", "runtime.goexit" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-1", "l": 1, "el": [ "0x97347", "0x97354", "0x99ee9" ] }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "0xdc100" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0xdc118" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2, "el": [ "0xdc040" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.15" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "0xdc0e0" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "0xdc110" ] }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039", "el": [ "0xdc088" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x10249" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042", "el": [ "0xdc030" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xde028" ] }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001", "el": [ "0x2a211" ] }, { "d": "Regex component marker", "e": [ "runtime.goexit", "runtime.main" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-2", "l": 1, "el": [ "0x99ee9", "0x97347" ] }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2, "el": [ "0xde1e2" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0xdc020" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2, "el": [ "0xdc0d0" ] }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "0xdc100", "0xdc110" ] }, { "d": "Regex component marker", "e": [ "runtime.mstart" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-3", "l": 1, "el": [ "0x99b3a" ] }, { "c": 1.0, "d": "go/rs language suffix", "e": [ "runtime.rt0_go" ], "i": "micro-behaviors/data/text/malware/terms::malware-lang-suffix", "l": 1, "el": [ "0x99b1b" ] }, { "c": 0.8799999952316284, "d": "Go PE retains .symtab section", "e": [ ".symtab" ], "i": "metadata/lang/compiler/systems::go-pe-symtab", "l": 2 }, { "c": 0.75, "d": "Go time.Sleep delay call", "e": [ "time.Sleep" ], "i": "micro-behaviors/time/sleep/interval::go-time-sleep", "l": 2, "el": [ "0x99a25" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xb2b" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "runtime.pcdatavalue2", "runtime.pcdatavalue", "go.buildidsync/atomic.StoreUintptrinternal/cpu.Initializeinternal/cpu.processOptionsinternal/cpu.indexByteinternal/cpu.doin", "runtime.pcvalueCacheKey", "runtime.pcvalue", "value too large for defined data type" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x98a5a", "0x98a32", "0x493d60", "0x98934", "0x98924", "0x47aedf" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2, "el": [ "0xdc050" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0xbf3" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2779.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2779.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "*map.bucket[string]bool", "runtime.errorString.Error", "*map[string]bool", "string", "*map[string]int64", "*runtime.stringInterfacePtr", "runtime.errorAddressString.Error", "runtime.cmpstring", "*runtime.stringer", "*map.bucket[string]time.abbr", "*runtime.errorString", "*runtime.errorAddressString", "*map[string]time.abbr", "*map.bucket[string]int64", "internal/bytealg.IndexByteString", "*func() string" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x68135", "0x93554", "0x678a8", "0x66522", "0x67a39", "0x68385", "0x9356e", "0x92c9c", "0x67b0a", "0x68436", "0x67f18", "0x6834b", "0x67fcc", "0x681ce", "0x92cef", "0x675e2" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2, "el": [ "0xdc0d8" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2779.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8999999761581421, "d": "Register vectored exception handler", "e": [ "AddVectoredExceptionHandler" ], "i": "micro-behaviors/os/exception/error-handling::add-vectored-exception-handler", "l": 1, "m": "B0001", "el": [ "0xdc158" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-sleep-command-token", "l": 1, "m": "B0025", "el": [ "0x47539d" ] }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/call::resume-thread-dup", "l": 2, "el": [ "0xde15c" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0xde028" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "SetThreadContext API reference", "e": [ "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::set-thread-context-dup", "l": 2, "el": [ "0xde1aa" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0xde2fc" ] }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 2, "el": [ "0xde0dc" ] }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "04 03 26 04", "01 0a 00 02" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1, "el": [ "0xb1c32", "0xbcfb0" ] }, { "a": "T1005", "c": 0.8999999761581421, "d": "GetThreadContext API reference", "e": [ "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::get-thread-context-dup", "l": 2, "el": [ "0xde1be" ] }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "runtime.initLongPathSupport", "go.buildidsync/atomic.StoreUintptrinternal/cpu.Initializeinternal/cpu.processOptionsinternal/cpu.indexByteinternal/cpu.doin", "pkgPath", "runtime.name.pkgPath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012", "el": [ "0x969d5", "0x493d60", "0x666f5", "0x993c5" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0xdc0f8" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "cache", "*runtime.mcache", "runtime.getMCache", "mspancache", "nil in cachenon-empty mark queue", "pcache", "mcache", "runtime.(*mspan).refillAllocCache", "stackcache", "refillAllocCache", "goidcacheend", "sudogcache", "runtime.(*mcache).nextFree", "*runtime.pageCache", "allocCache", "goidcache" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "0x6613e", "0x677e9", "0x939e7", "0x66e26", "0x7a234", "0x664d2", "0x6648a", "0x94067", "0x66ec2", "0x679c8", "0x6726c", "0x66ece", "0x939bb", "0x67c96", "0x66d72", "0x66b48" ] }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3, "el": [ "0xdc0b8" ] }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2, "el": [ "0xdc098" ] }, { "c": 0.949999988079071, "d": "Dense embedded domain list", "e": [ "runtime.bmap", "runtime.gobuf", "runtime.mspan", "runtime.hchan", "runtime.stack", "runtime.waitq", "runtime.sudog", "runtime.hmap", "cpu.option", "runtime.timer", "runtime.tflag", "runtime.mutex", "runtime.itab", "runtime.note", "runtime.name" ], "i": "metadata/package/quality::dense-domain-list", "l": 1, "el": [ "0x6736e", "0x67612", "0x67632", "0x67622", "0x67652", "0x67692", "0x67662", "0x6737d", "0x66fdd", "0x67682", "0x67672", "0x67642", "0x6738c", "0x673aa", "0x6739b" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 40.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.8999999761581421, "d": "Create extended waitable timer", "e": [ "CreateWaitableTimerExW" ], "i": "micro-behaviors/time/schedule/waitable::create-waitable-timer-ex", "l": 2, "el": [ "0xde2b8" ] }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 1, "el": [ "0xdc0f0" ] }, { "c": 0.949999988079071, "d": "links kernel32 (WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, ... +35 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "40 symbols" ] }, { "c": 0.800000011920929, "d": "Get and set context", "e": [ "GetThreadContext", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-set", "l": 1, "el": [ "0xde1be", "0xde1aa" ] }, { "c": 0.8999999761581421, "d": "Create and arm waitable timer", "e": [ "SetWaitableTimer", "CreateWaitableTimerExW" ], "i": "micro-behaviors/time/schedule/waitable::create-and-set-waitable-timer", "l": 1, "el": [ "0xde0dc", "0xde2b8" ] }, { "c": 0.800000011920929, "d": "Set context plus resume", "e": [ "ResumeThread", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-set-resume", "l": 1, "el": [ "0xde15c", "0xde1aa" ] }, { "c": 0.8799999952316284, "d": "Get set resume thread context", "e": [ "ResumeThread", "GetThreadContext", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-suspend", "l": 1, "el": [ "0xde15c", "0xde1be", "0xde1aa" ] }, { "c": 0.800000011920929, "d": "Get context plus resume", "e": [ "GetThreadContext", "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-resume", "l": 1, "el": [ "0xde1be", "0xde15c" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 1, "el": [ "0xdc110", "0xdc100" ] } ], "sha": "f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-11/f8e9fe17af49f851225f1e4cf191d75f19831f74bcfc13c26cb9d1e5da409260.exe", "type": "pe" } ], "tv": "ca5ef" } }