{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.76261127, "class": 0 }, { "m": "az/pe", "prob": 0.99964744, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T04:29:56Z" }, "path": "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe", "raw": { "v": "5", "fs": [ { "f": "O(As)H(Cm)Md", "x": 42, "ff": { "m": { "pe": { "checksum": 237639.0, "checksum_valid": 0.0, "resource_count": 0.0, "overlay_padding": 3072.0, "computed_checksum": 353393.0, "dos_stub_modified": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 311296.0, "entropy": 4.88, "size_bytes": 311296.0 }, "binary": { "is_pie": 0.0, "code_entropy": 6.39, "data_entropy": 0.0, "string_count": 1747.0, "entropy_variance": 7.52, "avg_string_length": 12.79, "max_string_length": 364.0, "code_to_data_ratio": 0.71, "string_length_stddev": 17.73, "largest_section_ratio": 0.68, "sentence_string_count": 295.0, "sentence_string_ratio": 0.17, "high_entropy_string_count": 0.0 }, "sections": { "count": 3.0, "code_size": 212992.0, "entropy_max": 6.39, "entropy_mean": 2.6, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 76, "u8", "!This file was created by ClamAV for internal use and should not be run." ], [ 150, "u8", "ClamAV - A GPL virus scanner - http://www.clamav.net" ], [ 216, "u8", "CLAM" ], [ 456, "u8", ".text" ], [ 536, "u8", ".rsrc" ], [ 8372, "u8", "BloqueaMsn" ], [ 8492, "u8", "frmSplash" ], [ 8518, "u8", "Form2" ], [ 8564, "u8", "trmIntro" ], [ 8598, "u8", "Image1" ], [ 8619, "u8", "GIF89a" ], [ 8666, "u8", "BV96" ], [ 8996, "u8", "Yrff" ], [ 10810, "u8", "r7ebq" ], [ 11638, "u8", "EVHqEX" ], [ 11861, "u8", "WR4E" ], [ 12577, "u8", "GTPATpq" ], [ 12840, "u8", "9hdBFob" ], [ 13019, "u8", "hd5Vo" ], [ 15085, "u8", "DARI" ], [ 17212, "u8", "OXETD" ], [ 17765, "u8", "77ffP" ], [ 20816, "u8", "D0QE" ], [ 23306, "u8", "/Phx" ], [ 26592, "u8", "DCWB" ], [ 27570, "u8", "6a8q" ], [ 28203, "u8", "bW l" ], [ 28550, "u8", "X 7V" ], [ 29470, "u8", "blHf" ], [ 30680, "u8", "3jKL7" ], [ 31282, "u8", "n77nu" ], [ 31452, "u8", "Ry1xh" ], [ 35116, "u8", "qWNEM" ], [ 35906, "u8", "mP0oKEdi" ], [ 37249, "u8", "D wT\u003cP" ], [ 37959, "u8", "aHlf" ], [ 39431, "u8", "mR_pah" ], [ 41191, "u8", "PE_P1" ], [ 41712, "u8", "Bloquea Msn" ], [ 43158, "wide", "C*\\AD:\\Visual\\Proyectos\\VB\\BloqueaMsn\\BloqueaMsn.vbp" ], [ 51280, "u8", "frmBloqueaMsn" ], [ 51296, "u8", "frmAbout" ], [ 51308, "u8", "modSocketMaster" ], [ 51324, "u8", "CSocketMaster" ], [ 51360, "u8", "ModIntro" ], [ 51452, "u8", "Form" ], [ 51476, "u8", "D:\\Instalados\\vb98\\VB6.OLB" ], [ 51564, "u8", "FraLujo" ], [ 51588, "u8", "Lista" ], [ 51612, "u8", "lblAcerca" ], [ 51624, "u8", "lblPorc" ], [ 51648, "u8", "cmdBloquea" ], [ 51660, "u8", "cmdDesbloquea" ], [ 51692, "u8", "Logo" ], [ 51716, "u8", "Sock" ], [ 51740, "u8", "Tiempo" ], [ 51764, "u8", "txtCorreo" ], [ 51780, "u8", "kernel32" ], [ 51796, "u8", "IsDebuggerPresent" ], [ 51872, "u8", "wininet.dll" ], [ 51888, "u8", "InternetCheckConnectionA" ], [ 51972, "u8", "user32" ], [ 51984, "u8", "FindWindowA" ], [ 52000, "u8", "HttpQueryInfoA" ], [ 52072, "u8", "comctl32.dll" ], [ 52092, "u8", "InitCommonControls" ], [ 52168, "u8", "wininet" ], [ 52180, "u8", "InternetOpenA" ], [ 52252, "u8", "InternetConnectA" ], [ 52328, "u8", "HttpOpenRequestA" ], [ 52404, "u8", "HttpSendRequestA" ], [ 52532, "u8", "InternetCloseHandle" ], [ 52604, "u8", "Sock_Connect" ], [ 52620, "u8", "Sock_DataArrival" ], [ 52676, "wide", "http://www.hotmail.com" ], [ 52728, "wide", "Verifique su conexión a Internet" ], [ 52800, "wide", "Verifique" ], [ 52892, "u8", "RtlMoveMemory" ], [ 52908, "u8", "Class" ], [ 53004, "u8", "WSAGetLastError" ], [ 53076, "u8", "GlobalAlloc" ], [ 53144, "u8", "GlobalFree" ], [ 53212, "u8", "WSAStartup" ], [ 53280, "u8", "WSACleanup" ], [ 53348, "u8", "WSAAsyncGetHostByName" ], [ 53444, "u8", "wsock32.dll" ], [ 53460, "u8", "WSAAsyncSelect" ], [ 53532, "u8", "CreateWindowExA" ], [ 53604, "u8", "DestroyWindow" ], [ 53676, "u8", "lstrlenA" ], [ 53744, "u8", "lstrcpyA" ], [ 53812, "u8", "IsWindow" ], [ 53900, "u8", "GetWindowLongA" ], [ 53972, "u8", "SetWindowLongA" ], [ 54044, "u8", "GetModuleHandleA" ], [ 54120, "u8", "GetProcAddress" ], [ 54296, "u8", "C:\\Windows\\system32\\MSVBVM60.DLL\\3" ], [ 54332, "u8", "VBRUN" ], [ 54384, "u8", "socket" ], [ 54448, "u8", "GlobalLock" ], [ 54516, "u8", "GlobalUnlock" ], [ 54716, "u8", "connect" ], [ 54736, "u8", "imgCC" ], [ 54800, "u8", "gethostname" ], [ 54868, "u8", "gethostbyname" ], [ 55004, "u8", "getsockname" ], [ 55072, "u8", "getpeername" ], [ 55140, "u8", "inet_addr" ], [ 55260, "u8", "sendto" ], [ 55324, "u8", "getsockopt" ], [ 55392, "u8", "setsockopt" ], [ 55524, "u8", "recvfrom" ], [ 55592, "u8", "WSACancelAsyncRequest" ], [ 55616, "u8", "WndProc" ], [ 55624, "u8", "RemotePort" ], [ 55636, "u8", "RemoteHost" ], [ 55708, "u8", "listen" ], [ 55772, "u8", "accept" ], [ 55836, "u8", "inet_ntoa" ], [ 55904, "u8", "gethostbyaddr" ], [ 55976, "u8", "ioctlsocket" ], [ 56044, "u8", "closesocket" ], [ 56112, "u8", "RemoteHostIP" ], [ 56128, "u8", "LocalPort" ], [ 56140, "u8", "State" ], [ 56148, "u8", "LocalHostName" ], [ 56164, "u8", "LocalIP" ], [ 56172, "u8", "BytesReceived" ], [ 56188, "u8", "SocketHandle" ], [ 56204, "u8", "Protocol" ], [ 56216, "u8", "CloseSck" ], [ 56228, "u8", "Connect" ], [ 56236, "u8", "Bind" ], [ 56244, "u8", "SendData" ], [ 56256, "u8", "GetData" ], [ 56264, "u8", "PeekData" ], [ 56276, "u8", "Listen" ], [ 56284, "u8", "Accept" ], [ 56292, "u8", "ConnectionRequest" ], [ 56312, "u8", "DataArrival" ], [ 56324, "u8", "Error" ], [ 56332, "u8", "SendComplete" ], [ 56348, "u8", "SendProgress" ], [ 56432, "wide", "El Email no puede estar en blanco!" ], [ 56504, "u8", "imgCorreo" ], [ 56524, "wide", "Email en blanco!" ], [ 56564, "wide", "no es una dirección de Email válida." ], [ 56644, "wide", "Fijate bien!" ], [ 56692, "wide", "Bloquea Msn - Trabajando..." ], [ 56752, "wide", "Conectando..." ], [ 56800, "wide", "messenger.hotmail.com" ], [ 56940, "u8", "tmrImg" ], [ 56948, "u8", "imgWin" ], [ 56956, "u8", "cmdOK" ], [ 57060, "wide", "Confirme" ], [ 57100, "wide", "Desbloqueado!" ], [ 57132, "wide", "Bloquea Msn" ], [ 57160, "wide", "No Debuggers!!!" ], [ 57208, "wide", "OLLYDBG" ], [ 57228, "wide", "HexWorksClass" ], [ 57260, "wide", "TDeDeMainForm" ], [ 57292, "wide", "frhed wndclass" ], [ 57328, "wide", "OWL_Window" ], [ 57356, "wide", "RichEdWClass" ], [ 57420, "wide", "Si cierra la aplicación se detendrá el proceso de bloqueo." ], [ 57672, "u8", "txtDatoVari" ], [ 57684, "u8", "picIcon" ], [ 57692, "u8", "txtDatos" ], [ 57704, "u8", "lblAutor" ], [ 57716, "u8", "tmrAbout" ], [ 57728, "u8", "cmdSound" ], [ 57740, "u8", "AntoIz" ], [ 57764, "u8", "Anto" ], [ 57772, "u8", "AntoDe" ], [ 57780, "u8", "fraAbout" ], [ 57792, "u8", "cmdCopy" ], [ 57816, "u8", "imgWeb" ], [ 57824, "u8", "imgDonar" ], [ 57840, "u8", "lblTitle" ], [ 57892, "u8", "gdi32" ], [ 57904, "u8", "GetDeviceCaps" ], [ 57976, "u8", "ReleaseCapture" ], [ 58048, "u8", "PostMessageA" ], [ 58120, "u8", "shell32.dll" ], [ 58136, "u8", "ShellExecuteA" ], [ 58208, "u8", "GetSystemMetrics" ], [ 58284, "u8", "GetDriveTypeA" ], [ 58356, "u8", "GetLocaleInfoA" ], [ 58428, "u8", "GetVersion" ], [ 58496, "u8", "Kernel32.dll" ], [ 58516, "u8", "GetTickCount" ], [ 58588, "u8", "GetSystemPowerStatus" ], [ 58668, "u8", "advapi32.dll" ], [ 58688, "u8", "RegOpenKeyExA" ], [ 58704, "u8", "ReadKey" ], [ 58712, "u8", "GetDirectXVersion" ], [ 58788, "u8", "RegCloseKey" ], [ 58856, "u8", "RegQueryValueExA" ], [ 58932, "u8", "winmm.dll" ], [ 58948, "u8", "waveOutGetNumDevs" ], [ 59024, "u8", "ShellAboutA" ], [ 59092, "u8", "GlobalMemoryStatusEx" ], [ 59168, "u8", "NumberInKB" ], [ 59180, "u8", "GetInfo" ], [ 59232, "wide", "VER 1 MSNP9 MSNP8 CVR0" ], [ 59284, "wide", "\u003eVER 1 MSNP9 MSNP8 CVR0" ], [ 59352, "wide", "VER 4 MSNP9 MSNP8 CVR0" ], [ 59404, "wide", "\u003eVER 4 MSNP9 MSNP8 CVR0" ], [ 59456, "wide", "VER 1" ], [ 59472, "wide", "Bloqueando...5%" ], [ 59516, "wide", "CVR 2 0x0C0A winnt 5.1 i386 MSNMSGR 6.0.0602 MSMSGS" ], [ 59628, "wide", "/login2.srf" ], [ 59656, "wide", "\u003eCVR 2 0x0C0A winnt 5.1 i386 MSNMSGR 6.0.0602 MSMSGS" ], [ 59768, "wide", "CVR 2" ], [ 59784, "wide", "Bloqueando...10%" ], [ 59824, "wide", "USR 3 TWN I" ], [ 59856, "wide", "\u003eUSR 3 TWN I" ], [ 59888, "wide", "XFR 3" ], [ 59904, "wide", "Bloqueando...15%" ], [ 59960, "wide", "VER 4" ], [ 59976, "wide", "Bloqueando...20%" ], [ 60016, "wide", "MSMSGS" ], [ 60036, "wide", "loginnet.passport.com" ], [ 60108, "wide", "CVR 5 0x0C0A winnt 5.1 i386 MSNMSGR 6.0.0602 MSMSGS" ], [ 60220, "wide", "\u003eCVR 5 0x0C0A winnt 5.1 i386 MSNMSGR 6.0.0602 MSMSGS" ], [ 60332, "wide", "CVR 5" ], [ 60348, "wide", "Bloqueando...25%" ], [ 60388, "wide", "USR 6 TWN I" ], [ 60420, "wide", "\u003eUSR 6 TWN I" ], [ 60452, "wide", "USR 6" ], [ 60468, "wide", "Bloqueando...30%" ], [ 60508, "wide", "Bloqueando..." ], [ 60588, "url", "Authorization: Passport1.4 OrgVerb=GET,OrgURL=http://messenger.msn.com,sign-in=" ], [ 60772, "base64", "EgRoJ Soft!" ], [ 60824, "wide", "Ya escribiste la arroba (@)" ], [ 60884, "wide", "Ya existe!" ], [ 60916, "u8", "VBA6.DLL" ], [ 60928, "u8", "__vbaVarForNext" ], [ 60948, "wide", "Desconectado" ], [ 61000, "u8", "__vbaVarForInit" ], [ 61028, "u8", "__vbaErrorOverflow" ], [ 61064, "wide", "Conectado" ], [ 61084, "u8", "__vbaStrToUnicode" ], [ 61116, "u8", "__vbaAryDestruct" ], [ 61136, "u8", "__vbaFreeVar" ], [ 61164, "u8", "__vbaGenerateBoundsError" ], [ 61232, "u8", "__vbaAryCopy" ], [ 61248, "u8", "__vbaStrVarVal" ], [ 61264, "u8", "__vbaVarTstEq" ], [ 61312, "u8", "__vbaVarMove" ], [ 61372, "u8", "__vbaEnd" ], [ 61384, "u8", "__vbaExitProc" ], [ 61404, "u8", "__vbaFreeStrList" ], [ 61436, "u8", "__vbaFreeObjList" ], [ 61456, "u8", "__vbaLenBstr" ], [ 61484, "u8", "__vbaStrMove" ] ], "v": { "file.stem": "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1296124995, "file.basename": "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe", "pe.image_base": 4194304, "pe.image_size": 311296, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 8312, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "b32ec332ea617a6e978b40762f6e6cba42d5a64f", "pe.image_hash.sha256": "2b6765a3c3e013856c1c6de1c30bf5467a04cedfbbd6525131f66e1ec570118b", "pe.image_hash.sha384": "99653327de4f9e5ea59e504991b135a055e9dfd4365d76a50fd987a89f4ccfb14b62e838937568ce53aa156f39ffb8bd", "pe.image_hash.sha512": "6327f206a258b44020d01172d9a257539bf713dcf3f7ff438d43862f30e4d732b32553610681459169f01f459fccb9df40ea97d55c3c8abe26bb1c0af0d9d4ca", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "pe.data_directories[0].rva": 213124, "pe.data_directories[1].rva": 303104, "pe.data_directories[2].rva": 560, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 5856, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 88, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 752, "pe.coff.dos_header_pe_pointer": 208 }, "id": "pe", "sc": [ [ ".text", 4096, 212992, 6.39, "r-x" ], [ ".data", 217088, 86016, 0.0, "rw-" ], [ ".rsrc", 303104, 8192, 1.4, "r--" ] ] }, "id": 0, "sz": 311296, "ts": [ { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1747.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8500000238418579, "d": "VBScript filename or interpreter reference", "e": [ "wscript" ], "i": "objectives/persistence/system/init/script::vbs-script-marker", "l": 1, "el": [ "0x102f4" ] }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2, "el": [ "0x96" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xcaa0" ] }, { "d": "windir environment variable", "e": [ "WinDir" ], "i": "micro-behaviors/os/env/vars/system-info::windir-var", "l": 2, "el": [ "0xfcfc" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": "SYSTEMROOT environment variable", "e": [ "SystemRoot" ], "i": "micro-behaviors/os/env/vars/system-info::systemroot-var", "l": 2, "el": [ "0xfcac" ] }, { "c": 0.8999999761581421, "d": "InternetConnect API name as string", "e": [ "InternetConnectA" ], "i": "micro-behaviors/communications/http/get::internet-connect-str", "l": 1, "el": [ "0xcc1c" ] }, { "a": "T1546.015", "c": 0.949999988079071, "d": "Executable path in TypeLib redirection", "e": [ "C:\\Windows\\system32\\MSVBVM60.DLL" ], "i": "objectives/persistence/system/registry/com-hijack::typelib-executable-path", "l": 1, "el": [ "0xd418" ] }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1, "el": [ "0xd28c" ] }, { "c": 0.9900000095367432, "d": "CLAM COFF timestamp marker", "e": [ "43 4c 41 4d" ], "i": "metadata/binary/anomaly/rewrite::clamav-coff-timestamp", "l": 1, "el": [ "0xd8" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1747.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "0xe3f4" ] }, { "c": 0.8999999761581421, "d": "InternetCloseHandle API name", "e": [ "InternetCloseHandle" ], "i": "micro-behaviors/communications/http/get::internet-close-handle-str", "l": 1, "el": [ "0xcd34" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.699999988079071, "d": "gethostbyname import string", "e": [ "gethostbyname" ], "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "l": 2, "el": [ "0xd654" ] }, { "c": 0.9900000095367432, "d": "ClamAV holder DOS stub banner", "e": [ "21 54 68 69 73 20 66 69 6c 65 20 77 61 73 20 63 72 65 61 74 65 64 20 62 79 20 43 6c 61 6d 41 56" ], "i": "metadata/binary/anomaly/rewrite::clamav-holder-banner", "l": 1, "el": [ "0x4c" ] }, { "a": "T1055", "c": 0.8799999952316284, "d": "Go RtlMoveMemory API name", "e": [ "RtlMoveMemory" ], "i": "objectives/evasion/process/injection/shellcode::go-rtlmovememory-api", "l": 1, "m": "B0033", "el": [ "0xce9c" ] }, { "a": "T1204", "c": 0.699999988079071, "d": "Virus reference", "e": [ "virus" ], "i": "micro-behaviors/data/text/malware/terms::virus-marker", "l": 2, "el": [ "0x96" ] }, { "d": "COMPUTERNAME environment variable", "e": [ "ComputerName" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2, "el": [ "0xf43c" ] }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcA" ], "i": "micro-behaviors/ui/window/manage/control::call-window-proc", "l": 2, "el": [ "0x10b40" ] }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\ directory path", "e": [ "C:\\Windows\\system32\\MSVBVM60" ], "i": "micro-behaviors/fs/path/system::windows-root", "l": 2, "m": "E1083", "el": [ "0xd418" ] }, { "c": 1.0, "d": "Overrides WndProc method", "e": [ "WndProc" ], "i": "objectives/collection/clipboard/monitor::wndproc-override", "l": 1, "el": [ "0xd940" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "ClamAV scanner banner string", "e": [ "43 6c 61 6d 41 56 20 2d 20 41 20 47 50 4c 20 76 69 72 75 73 20 73 63 61 6e 6e 65 72" ], "i": "metadata/binary/anomaly/rewrite::clamav-gpl-banner", "l": 1, "el": [ "0x96" ] }, { "c": 0.7200000286102295, "d": "Winsock connect API string", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "l": 1, "el": [ "0xd5bc" ] }, { "c": 0.6000000238418579, "d": "winmgmts WMI moniker (WSH WMI access)", "e": [ "winmgmts:\\\\.\\root\\cimv2" ], "i": "objectives/execution/interpreter/scripting/host::winmgmts-string", "l": 3, "el": [ "0xf394" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0xfecc" ] }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1, "el": [ "0xcfdc" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.39" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "virus word", "e": [ "virus" ], "i": "objectives/impact/infect/lexicon::virus-word", "l": 1, "el": [ "0x96" ] }, { "c": 0.4000000059604645, "d": "version word (lowercase)", "e": [ "version" ], "i": "metadata/package/versioning::version-word-lower", "l": 2, "el": [ "0x116e8" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "SetWindowLongA string", "e": [ "SetWindowLongA" ], "i": "objectives/command-and-control/dropper/binder::set-window-long-a-text", "l": 1, "el": [ "0xd2d4" ] }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1, "el": [ "0xd2d4" ] }, { "d": "NUMBER_OF_PROCESSORS environment variable", "e": [ "NUMBER_OF_PROCESSORS" ], "i": "micro-behaviors/os/env/vars/system-info::number-of-processors-var", "l": 2, "el": [ "0xfbe0" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "SetLayeredWindowAttributes string", "e": [ "SetLayeredWindowAttributes" ], "i": "objectives/command-and-control/dropper/binder::set-layered-window-attributes-text", "l": 1, "el": [ "0xff30" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "cmd" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x10324" ] }, { "d": "Windows directory path reference", "e": [ "C:\\Windows" ], "i": "micro-behaviors/fs/path/system::windows-dir", "l": 2, "el": [ "0xd418" ] }, { "a": "T1082", "c": 0.8500000238418579, "d": "CPU registry key enumeration path", "e": [ "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\Processornamestring" ], "i": "objectives/discovery/system/fingerprint/hardware::central-processor-reg", "l": 1, "el": [ "0xfa0c" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\Processornamestring" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0xfa0c" ] }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1, "el": [ "0xcb04" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "4b", "4e", "46", "47" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x2df4a", "0x2127e", "0x1c82e", "0x2bd97" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "CSocketMaster.Connect", "STATE: sckConnected", "Connection refused.", "Connection timed out.", "OK Connecting to:", "ConnectionRequest", "Sock_Connect", "Connect", "InternetConnectA", "Connection reset by peer.", "InternetCheckConnectionA", "CSocketMaster.ConnectToIP", "STATE: sckConnecting" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012", "el": [ "0x12384", "0x124e0", "0x10f4c", "0x114a4", "0x126ec", "0xdbe4", "0xcd7c", "0xdba4", "0xcc1c", "0x10f78", "0xcab0", "0x126b4", "0x12718" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Value", "RegQueryValueExA" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x1bd6c", "0xe5e8" ] }, { "c": 1.0, "d": "Call to GetDriveTypeA by raw bytes", "e": [ "GetDriveTypeA" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type-raw", "l": 1, "el": [ "0xe3ac" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0xd368" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.39)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xcdae" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "GetWindowLongA string", "e": [ "GetWindowLongA" ], "i": "objectives/command-and-control/dropper/binder::get-window-long-a-text", "l": 1, "el": [ "0xd28c" ] }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied." ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2, "el": [ "0x10db0" ] }, { "c": 0.8999999761581421, "d": "HttpQueryInfo API name as string", "e": [ "HttpQueryInfoA" ], "i": "micro-behaviors/communications/http/get::http-query-info-str", "l": 1, "el": [ "0xcb20" ] }, { "c": 1.0, "d": "scanner word", "e": [ "scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1, "el": [ "0x96" ] }, { "c": 0.8999999761581421, "d": "InternetOpen API name as string", "e": [ "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::internet-open-str", "l": 1, "el": [ "0xcbd4" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "script host marker encoded", "e": [ "wscript.shell" ], "i": "metadata/lang/encoded/wide::shell-interpreter-script-host", "l": 1, "el": [ "0x102f4" ] }, { "c": 0.9900000095367432, "d": "Layered window opacity API", "e": [ "SetLayeredWindowAttributes" ], "i": "well-known/malware/trojan/shellobject/hijack::layered-window-attributes", "l": 1, "el": [ "0xff30" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4b", "46", "47", "4e" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "0x2df4a", "0x1c82e", "0x2bd97", "0x2127e" ] }, { "c": 1.0, "d": "CS spawn x86 pattern", "e": [ "00 0D 00 80 00 00" ], "i": "well-known/malware/rat/cobalt-strike::cfg-spawn-x86", "l": 1, "el": [ "0xba9d" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "HttpSendRequest API name as string", "e": [ "HttpSendRequestA" ], "i": "micro-behaviors/communications/http/get::http-send-request-str", "l": 1, "el": [ "0xccb4" ] }, { "c": 0.7200000286102295, "d": "Winsock socket API string", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::ws2-socket-api-string", "l": 1, "el": [ "0xd470" ] }, { "c": 0.8999999761581421, "d": "HttpOpenRequest API name as string", "e": [ "HttpOpenRequestA" ], "i": "micro-behaviors/communications/http/get::http-open-request-str", "l": 1, "el": [ "0xcc68" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2, "el": [ "0xe540" ] }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001", "el": [ "0xca54" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1747.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InternetCheckConnectionA", "GetSystemPowerStatus", "DestroyWinsockMessageWindow", "SetLayeredWindowAttributes" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xcab0", "0xe4dc", "0x11818", "0xff30" ] }, { "c": 0.800000011920929, "d": "winmm library import", "e": [ "winmm.dll" ], "i": "objectives/evasion/anti-av/import-pollution::winmm-library", "l": 1, "el": [ "0xe634" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "Select * from" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3, "el": [ "0xf354" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 212992, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0xa8fd" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x14a9" ] }, { "a": "T1071.001", "c": 0.75, "d": "Encoded HTTP URL", "e": [ "Authorization: Passport1.4 OrgVerb=GET,OrgURL=http://messenger.msn.com,sign-in=", "https://www.paypal.com/cgi-bin/webscr?cmd=_donations\u0026business=TUP6YZ72AS7VC\u0026lc=DO\u0026item_name=Donar a ..." ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-http-url", "l": 3, "el": [ "0xecac", "0x10324" ] }, { "c": 1.0, "d": "Windows path-like string pattern", "e": [ "s:\\\\.\\root\\cimv2" ], "i": "micro-behaviors/data/text/path::windows-path-like-string", "l": 2, "el": [ "0xf394" ] }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Authorization: Passport1.4 OrgVerb=GET,OrgURL=http://messenger.msn.com,sign-in=" ], "i": "micro-behaviors/communications/http/headers::auth-header", "l": 3, "m": "C0002", "el": [ "0xecac" ] }, { "c": 0.7200000286102295, "d": "WinInet DLL import name", "e": [ "WININET.dll" ], "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "l": 3, "el": [ "0xcaa0" ] }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Stack-built WinInet library reference", "e": [ "wininet.dll" ], "i": "micro-behaviors/communications/http/get::wininet-library-stackstring", "l": 4, "el": [ "0xcaa0" ] }, { "a": "T1497", "c": 0.6000000238418579, "d": "OllyDbg debugger", "e": [ "OLLYDBG" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::ollydbg", "l": 2, "m": "B0007", "el": [ "0xdf78" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "WinInet HTTP request APIs as strings", "e": [ "WININET.dll", "HttpSendRequestA", "HttpOpenRequestA", "InternetCloseHandle", "HttpQueryInfoA", "InternetConnectA" ], "i": "micro-behaviors/communications/http/get::wininet-http-request-strings", "l": 3, "el": [ "0xcaa0", "0xccb4", "0xcc68", "0xcd34", "0xcb20", "0xcc1c" ] }, { "a": "T1027.009", "c": 0.996999979019165, "d": "VB6 layered-window dispatch string cluster", "e": [ "SetWindowLongA", "GetWindowLongA", "SetLayeredWindowAttributes" ], "i": "objectives/command-and-control/dropper/binder::vb6-window-dispatch-text-cluster", "l": 1, "el": [ "0xd2d4", "0xd28c", "0xff30" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "WinInet APIs resolved dynamically", "e": [ "HttpSendRequestA", "HttpQueryInfoA", "HttpOpenRequestA", "InternetConnectA", "InternetCloseHandle", "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::wininet-dynamic-load", "l": 4, "el": [ "0xccb4", "0xcb20", "0xcc68", "0xcc1c", "0xcd34", "0xcbd4" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "Authorization: Passport1.4 OrgVerb=GET,O \u003curl\u003e", "https://www.paypal.com/cgi-bin/webscr?cm \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:60588", "offset:66340" ] } ], "sha": "fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-06/fb2f32a74864309c7fa49bc5ded04863f3d9b72a1f907675a7ab8d2bb2bb081d.exe", "type": "pe" } ], "tv": "52045" } }