{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9999949336051941, "class": 2, "threshold": 0.9999842643737793 } ], "prob": 0.99999493, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.99991643, "class": 0 }, { "m": "az/native", "prob": 1.0, "class": 1 }, { "m": "az/pe", "prob": 1.0, "class": 1 } ], "version": "v17.17", "threshold": 0.99998426, "analyzed_at": "2026-05-31T06:13:07Z" }, "path": "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 142, "ff": { "i": [ [ "kernel32", "LoadLibraryA" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "VirtualProtect" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "ExitProcess" ], [ "msvcrt", "iob" ] ], "m": { "pe": { "checksum": 124473.0, "icon_count": 2.0, "checksum_valid": 0.0, "resource_count": 2.0, "computed_checksum": 141559.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "entry_in_writable_section": 1.0 }, "file": { "size": 101040.0, "entropy": 7.98, "size_bytes": 101040.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 7.7, "data_entropy": 8.0, "overlay_size": 6320.0, "string_count": 1283.0, "overlay_ratio": 0.06, "overlay_entropy": 7.4, "entropy_variance": 0.02, "avg_string_length": 5.46, "max_string_length": 54.0, "code_to_data_ratio": 0.07, "string_length_stddev": 4.61, "largest_section_ratio": 0.87, "sentence_string_count": 16.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 7.0 }, "sections": { "count": 3.0, "code_size": 6656.0, "entropy_max": 8.0, "entropy_mean": 7.85, "name_entropy": 3.09, "writable_count": 3.0, "executable_count": 2.0, "nonstandard_count": 2.0, "executable_writable_count": 2.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", "UPX0" ], [ 416, "u8", "UPX1" ], [ 456, "u8", ".rsrc" ], [ 496, "u8", "3.08" ], [ 3135, "u8", "HNXbH" ], [ 3167, "u8", "cdQ%c%B" ], [ 3635, "u8", "a62Fp" ], [ 4953, "u8", "/Xih{qE" ], [ 5139, "u8", "rwOlPvM$msm22it6Yx6rp28NeadxoSZ2" ], [ 5179, "u8", "593f89b38c3786798d509f" ], [ 5222, "u8", "d4e962364" ], [ 5259, "u8", "n+oPa99f97b85J" ], [ 5281, "u8", "52892j0bc74" ], [ 5294, "u8", "mkW\t4a01d?ba4c" ], [ 5330, "u8", "fbe357aL1" ], [ 5359, "u8", "c99584" ], [ 5630, "u8", "r69e" ], [ 5782, "u8", "b/-LIBGCCW" ], [ 5802, "u8", "SJLJ-GTHR-MING" ], [ 5830, "u8", "ptr-\u003esize =" ], [ 5848, "u8", "of(:__SHARED)" ], [ 5868, "u8", ":%u: 5il/ assertion `" ], [ 5922, "u8", "N-f.sGetAtomNameA" ], [ 6148, "u8", "ModuleH" ], [ 6167, "u8", "StartupInf" ], [ 6181, "u8", "o SUnh.dup}3" ], [ 6225, "u8", "enviZn" ], [ 6236, "u8", "fmxe(s_ap" ], [ 6279, "u8", "fflush" ], [ 6307, "u8", "emcpyr" ], [ 6465, "u8", "OI8@.bV" ], [ 6824, "u8", "WYWH" ], [ 6892, "u8", "XPTPSW" ], [ 11267, "u8", "DXMjnx" ], [ 15865, "u8", "WZHU" ], [ 16709, "u8", "4VEI" ], [ 18958, "u8", "isEy" ], [ 20724, "u8", "WRXE" ], [ 20862, "u8", "6g0b" ], [ 21775, "u8", "UKIY" ], [ 22876, "u8", "UDTH" ], [ 23557, "u8", "vcDyYI" ], [ 23624, "u8", "/Xrf" ], [ 24040, "u8", "PAAZy" ], [ 27262, "u8", "KRNFXj" ], [ 28220, "u8", "/Jcv" ], [ 28247, "u8", "IozAs" ], [ 29227, "u8", "fMgFN" ], [ 31190, "u8", "xCgXQ" ], [ 33431, "u8", "uD cR" ], [ 36567, "u8", "fpFj" ], [ 39224, "u8", "JZYoA" ], [ 39389, "u8", "txKi" ], [ 40735, "u8", "WegIV" ], [ 42620, "u8", "cwEo" ], [ 45609, "u8", "lwqlfmBl" ], [ 47253, "u8", "YRpKH" ], [ 49685, "u8", "LYWqC" ], [ 50668, "u8", "SoxcP" ], [ 50871, "u8", "Srqq" ], [ 51292, "u8", "lSZ9b" ], [ 51436, "u8", "nEpr" ], [ 53233, "u8", "/FrZ" ], [ 54326, "u8", "nB a" ], [ 56353, "u8", "VpIMJ6e" ], [ 56935, "u8", "Wbfc" ], [ 62830, "u8", "BJwaD" ], [ 63470, "u8", "b}a{" ], [ 64335, "u8", "381w" ], [ 64529, "u8", "9ian" ], [ 65295, "u8", "SWVzw8O" ], [ 65367, "u8", ".2M@ltT" ], [ 65651, "u8", "igJUI" ], [ 68256, "u8", "42seG" ], [ 79751, "u8", "44IC" ], [ 83749, "u8", "Osqr6" ], [ 85162, "u8", "h99f" ], [ 86003, "u8", "Xdcp" ], [ 88246, "u8", "K3J6" ], [ 89272, "u8", "iU8og7" ], [ 92812, "u8", "IY9S" ], [ 94365, "u8", "N pa" ], [ 94504, "u8", "KERNEL32.DLL" ], [ 94517, "u8", "msvcrt.dll" ], [ 94530, "u8", "LoadLibraryA" ], [ 94544, "u8", "GetProcAddress" ], [ 94560, "u8", "VirtualProtect" ], [ 94576, "u8", "VirtualAlloc" ], [ 94590, "u8", "VirtualFree" ], [ 94604, "u8", "ExitProcess" ], [ 94782, "u8", "Z0X03" ], [ 94949, "u8", "AddTrust AB1\u00260$" ], [ 94971, "u8", "AddTrust External TTP Network1\"0" ], [ 95011, "u8", "AddTrust External CA Root0" ], [ 95040, "u8", "050607080910Z" ], [ 95055, "u8", "200530104838Z0" ], [ 95108, "u8", "Salt Lake City1" ], [ 95133, "u8", "The USERTRUST Network1!0" ], [ 95165, "u8", "http://www.usertrust.com1" ], [ 95200, "u8", "UTN-USERFirst-Object0" ], [ 95654, "u8", "3http://crl.usertrust.com/AddTrustExternalCARoot.crl05" ], [ 95736, "u8", "http://ocsp.usertrust.com0" ], [ 96293, "u8", "Greater Manchester1" ], [ 96322, "u8", "Salford1" ], [ 96340, "u8", "COMODO CA Limited1$0\"" ], [ 96368, "u8", "COMODO Time Stamping Signer0" ], [ 96831, "u8", "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05" ], [ 97414, "u8", "110824000000Z" ], [ 97515, "u8", "COMODO CA Limited1!0" ], [ 97543, "u8", "COMODO Code Signing CA 20" ], [ 98027, "u8", "1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t" ], [ 98106, "u8", "1http://crt.usertrust.com/UTNAddTrustObject_CA.crt0%" ], [ 98647, "u8", "120614000000Z" ], [ 98662, "u8", "130614235959Z0" ], [ 98702, "u8", "0421" ], [ 98716, "u8", "SAN MARTIN1" ], [ 98756, "u8", "JR. LIMA 11541" ], [ 98780, "u8", "JORGE CHONG VELASCO1" ], [ 98810, "u8", "JORGE CHONG VELASCO0" ], [ 99025, "u8", "Fcfd" ], [ 99308, "u8", "https://secure.comodo.net/CPS0A" ], [ 99355, "u8", "0http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r" ], [ 99433, "u8", "0http://crt.comodoca.com/COMODOCodeSigningCA2.crt0$" ], [ 99496, "u8", "http://ocsp.comodoca.com0" ], [ 99533, "u8", "dklyuchn@adobe.com0" ], [ 99942, "u8", "COMODO Code Signing CA 2" ], [ 100114, "wide", "$Adobe Flash Playe" ], [ 100155, "u8", "http://www.adobe.com0" ], [ 100615, "u8", "UTN-USERFirst-Object" ] ], "v": { "file.stem": "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c", "pe.imphash": "4bfd1be901a4c0d571291552b2d7a34c", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1346036040, "binary.packer": "upx", "file.basename": "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c.exe", "pe.image_base": 4194304, "pe.image_size": 225280, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 132992, "pe.headers_size": 4096, "pe.entry_section": "UPX1", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 6320, "pe.image_hash.sha1": "961b3b04c180c31a763183c8ca5242f31e21d07a", "pe.image_hash.sha256": "517aca4011b6c0fb422eb0087cd6da9ed5b4a95d90be4ab66249b3400d681352", "pe.image_hash.sha384": "30893c276438898441475d99349d5b5cb4af2501b4dd8f843bb684af5e654ef782e983dddf98f4470f67b83953bd521e", "pe.image_hash.sha512": "9b92ad91f6c7ff9a1e6034277d6de08d9e1cf2e036c87c0517d175387f9249da69f569e1d3a244e0abb012587d4480f272fe456ce7c8b68144dc56a0931ed051", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.resource_timestamp": 1346036040, "pe.characteristics_raw": 783, "pe.linker_major_version": 2, "pe.linker_minor_version": 56, "pe.signatures[0].issuer": "CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "pe.signatures[0].serial": "00b3d16e076017ab249650624177877a9d", "pe.signatures[0].subject": "CN=JORGE CHONG VELASCO,O=JORGE CHONG VELASCO,STREET=JR. LIMA 1154,L=TARAPOTO,ST=SAN MARTIN,POSTALCODE=042,C=PE", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 222408, "pe.data_directories[1].rva": 135168, "pe.data_directories[2].rva": 94720, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2013-06-14T23:59:59Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 216, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 87240, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 6320, "pe.signatures[0].not_before": "2012-06-14T00:00:00Z", "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].thumbprint_sha1": "cd24e86c4d0ecc29cf9433feb3d1dddf01a7c5a4", "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "020831e856b4b46d3a0c656dee1addf50b4a72dd", "pe.signatures[0].thumbprint_sha256": "456f615c71f21987ed0de952185fef0ec513c28e3fdadf736cc90eba34ee699d", "pe.signatures[0].signature_algorithm": "sha1WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1" }, "id": "pe", "sc": [ [ "UPX0", 512, 0, 0.0, "rwx" ], [ "UPX1", 512, 6656, 7.7, "rwx" ], [ ".rsrc", 7168, 87552, 8.0, "rw-" ] ] }, "id": 0, "sz": 101040, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: JORGE CHONG VELASCO", "e": [ "JORGE CHONG VELASCO" ], "i": "metadata/signed/unknown::jorge-chong-velasco", "l": 2 }, { "c": 1.0, "d": "Signed by JORGE CHONG VELASCO", "e": [ "JORGE CHONG VELASCO" ], "i": "metadata/signed/leaf::jorge-chong-velasco", "l": 3 }, { "c": 1.0, "d": "Binary contains a UPX packing marker", "i": "anti-static/packer/upx", "l": 4 }, { "c": 1.0, "d": "UPX decompression failed: IO error: No such file or directory (os error 2)", "i": "anti-static/packer/upx/decompression-failed", "l": 5 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 87552, entropy: 8.00)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x17135" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1283.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021", "el": [ "0x3650c" ] }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2, "el": [ "0x36514" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1283.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.70" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2, "el": [ "0x36510" ] }, { "a": "T1027.002", "c": 0.800000011920929, "d": "Entry point in non-standard section", "e": [ "UPX1 (size: 6656, entropy: 7.70, perms: rwx)" ], "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "l": 1, "m": "F0001" }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1!0" ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "0x1739d" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.87" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "UHARC linker major version", "e": [ "2" ], "i": "metadata/binary/framework::uharc-linker-major", "l": 2, "el": [ "value:pe.linker_major_version" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "a": "T1036.001", "c": 0.8799999952316284, "d": "UTN USERFirst Object string in overlay", "e": [ "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05", "UTN-USERFirst-Object0", "UTN-USERFirst-Object", "1http://crl.usertrust.com/UTN-USERFirst-Object.crl0t" ], "i": "objectives/evasion/masquerade/binary::overlay-utn-object-string", "l": 1, "el": [ "0x17a3f", "0x173e0", "0x18907", "0x17eeb" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.70" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 1.0, "d": "Issued by Comodo Code Signing CA", "e": [ "CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB" ], "i": "metadata/signed/certificate::pe-cert-issuer-comodo", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "COMODO certificate string in overlay", "e": [ "COMODO CA Limited1$0\"", "COMODO CA Limited1!0" ], "i": "objectives/evasion/masquerade/binary::overlay-comodo-string", "l": 1, "el": [ "0x17854", "0x17ceb" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "0x3650c" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x36518" ] }, { "a": "T1027", "c": 0.4000000059604645, "d": "Low entropy variance (uniform packing)", "e": [ "binary.entropy_variance = 0.02" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::entropy-variance-low", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 7.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x17150" ] }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x36504" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1283.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8999999761581421, "d": "Very low code-to-data ratio (large PE payload)", "e": [ "binary.code_to_data_ratio = 0.07" ], "i": "objectives/anti-static/obfuscation/payload/section::low-code-to-data-ratio-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.70" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "0x17170" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 7.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.9900000095367432, "d": "Exactly seven imports", "e": [ "imports.count = 7.00" ], "i": "well-known/malware/worm/mydoom::metric-import-count-7", "l": 1 }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1, "el": [ "0x178", "0x1a0" ] }, { "c": 1.0, "d": "Downgrade standalone UPX packer finding", "i": "metadata/binary/framework::upx-packer-downgrade", "l": 2 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 6656, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 7.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x36508" ] }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.87" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvcrt (iob)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "6 symbols" ] }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 2, "m": "B0032", "el": [ "0x36504" ] } ], "sha": "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c", "path": "f9a9115df68906f1f934abaea063a673f7b4bb5cd998ebd8da731371abc1f53c.exe", "type": "pe" } ], "tv": "52045" } }