{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.99328107, "class": 0 }, { "m": "az/pe", "prob": 0.2125, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T04:20:31Z" }, "path": "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 4, "ff": { "i": [ [ "msvbvm60", "CIcos" ], [ "msvbvm60", "adj_fptan" ], [ "msvbvm60", "vbaVarMove" ], [ "msvbvm60", "vbaFreeVar" ], [ "msvbvm60", "vbaStrVarMove" ], [ "msvbvm60", "vbaFreeVarList" ], [ "msvbvm60", "adj_fdiv_m64" ], [ "msvbvm60", "vbaFreeObjList" ], [ "msvbvm60", "adj_fprem1" ], [ "msvbvm60", "vbaRecAnsiToUni" ], [ "msvbvm60", "vbaSetSystemError" ], [ "msvbvm60", "vbaRecDestruct" ], [ "msvbvm60", "vbaHresultCheckObj" ], [ "msvbvm60", "adj_fdiv_m32" ], [ "msvbvm60", "ORDINAL 666" ], [ "msvbvm60", "ORDINAL 591" ], [ "msvbvm60", "ORDINAL 669" ], [ "msvbvm60", "ORDINAL 594" ], [ "msvbvm60", "vbaObjSet" ], [ "msvbvm60", "vbaOnError" ], [ "msvbvm60", "adj_fdiv_m16i" ], [ "msvbvm60", "vbaObjSetAddref" ], [ "msvbvm60", "adj_fdivr_m16i" ], [ "msvbvm60", "vbaFpR8" ], [ "msvbvm60", "CIsin" ], [ "msvbvm60", "vbaChkstk" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "vbaStrCmp" ], [ "msvbvm60", "vbaObjVar" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "ORDINAL 671" ], [ "msvbvm60", "adj_fpatan" ], [ "msvbvm60", "ORDINAL 568" ], [ "msvbvm60", "vbaLateIdCallLd" ], [ "msvbvm60", "vbaRecUniToAnsi" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "CIsqrt" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "adj_fprem" ], [ "msvbvm60", "adj_fdivr_m64" ], [ "msvbvm60", "ORDINAL 716" ], [ "msvbvm60", "vbaFPException" ], [ "msvbvm60", "ORDINAL 644" ], [ "msvbvm60", "CIlog" ], [ "msvbvm60", "vbaNew2" ], [ "msvbvm60", "vbaInStr" ], [ "msvbvm60", "ORDINAL 571" ], [ "msvbvm60", "adj_fdiv_m32i" ], [ "msvbvm60", "adj_fdivr_m32i" ], [ "msvbvm60", "vbaStrCopy" ], [ "msvbvm60", "vbaFreeStrList" ], [ "msvbvm60", "adj_fdivr_m32" ], [ "msvbvm60", "adj_fdiv_r" ], [ "msvbvm60", "ORDINAL 685" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "vbaI4Var" ], [ "msvbvm60", "vbaVarDup" ], [ "msvbvm60", "vbaStrToAnsi" ], [ "msvbvm60", "vbaFpI4" ], [ "msvbvm60", "vbaRecDestructAnsi" ], [ "msvbvm60", "CIatan" ], [ "msvbvm60", "vbaStrMove" ], [ "msvbvm60", "allmul" ], [ "msvbvm60", "vbaLateIdSt" ], [ "msvbvm60", "CItan" ], [ "msvbvm60", "CIexp" ], [ "msvbvm60", "vbaFreeStr" ], [ "msvbvm60", "vbaFreeObj" ], [ "msvbvm60", "ORDINAL 580" ] ], "m": { "pe": { "checksum": 209173.0, "checksum_valid": 1.0, "computed_checksum": 209173.0, "bound_import_count": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 1243922264.0 }, "file": { "size": 188416.0, "entropy": 4.02, "size_bytes": 188416.0 }, "binary": { "is_pie": 0.0, "code_entropy": 4.13, "data_entropy": 0.0, "string_count": 823.0, "entropy_variance": 2.84, "avg_string_length": 6.41, "max_string_length": 59.0, "code_to_data_ratio": 0.98, "string_length_stddev": 4.17, "largest_section_ratio": 0.93, "sentence_string_count": 2.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 70.0 }, "sections": { "count": 3.0, "code_size": 176128.0, "entropy_max": 4.13, "entropy_mean": 2.08, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 168, "u8", "Rich" ], [ 432, "u8", ".text" ], [ 512, "u8", ".rsrc" ], [ 568, "u8", "MSVBVM60.DLL" ], [ 5376, "u8", "FINJAN" ], [ 5488, "u8", "nationalbudgetter" ], [ 5510, "u8", "ALISMATACEAE" ], [ 5574, "u8", "Opsione12" ], [ 5588, "u8", "ABSORBER" ], [ 5618, "u8", "Opsione13" ], [ 5632, "u8", "Skolemesterere6" ], [ 5669, "u8", "Opsione14" ], [ 5683, "u8", "CIMLINE" ], [ 5712, "u8", "Opsione15" ], [ 5726, "u8", "Bindevvets" ], [ 5758, "u8", "Opsione16" ], [ 5772, "u8", "Tummerumen8" ], [ 5805, "u8", "Opsione17" ], [ 5819, "u8", "Vocally4" ], [ 5849, "u8", "Opsione18" ], [ 5863, "u8", "daggryet" ], [ 5893, "u8", "UnShape" ], [ 6188, "u8", "Verdensmnds" ], [ 10156, "u8", "Slav9" ], [ 10164, "u8", "Unsurpassably4" ], [ 10228, "u8", "raon" ], [ 10288, "u8", "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 10480, "u8", "Form" ], [ 10584, "u8", "shlwapi.dll" ], [ 10600, "u8", "PathStripToRootA" ], [ 10676, "u8", "user32" ], [ 10688, "u8", "IsCharLowerA" ], [ 10760, "u8", "comctl32" ], [ 10776, "u8", "FlatSB_GetScrollProp" ], [ 10856, "u8", "gdi32" ], [ 10868, "u8", "StartDocA" ], [ 10936, "u8", "kernel32" ], [ 10952, "u8", "VirtualUnlock" ], [ 11024, "u8", "GetCursorPos" ], [ 11096, "u8", "shell32.dll" ], [ 11112, "u8", "SHQueryRecycleBinA" ], [ 11188, "u8", "WinExec" ], [ 11252, "u8", "FlashWindowEx" ], [ 11324, "u8", "msvfw32.dll" ], [ 11340, "u8", "GetSaveFileNamePreviewA" ], [ 11420, "u8", "SetTimer" ], [ 11500, "wide", "Spydigere5" ], [ 11528, "wide", "String" ], [ 11648, "wide", "INDETECTABLE" ], [ 11680, "wide", "asuncion" ], [ 11704, "wide", "Dvrgekonge" ], [ 11732, "wide", "jenvidnerne" ], [ 11756, "u8", "__vbaVarMove" ], [ 11776, "wide", "MOLLIENISIA" ], [ 11804, "wide", "Stadfstet" ], [ 11828, "wide", "Dentine8" ], [ 11908, "wide", "indstilleliges" ], [ 11960, "wide", "Halvtredskronesedlernes" ], [ 12012, "wide", "Legemsvelsers1" ], [ 12064, "wide", "rectangled" ], [ 12088, "u8", "VBA6.DLL" ], [ 12132, "u8", "__vbaRecDestruct" ], [ 12152, "u8", "__vbaRecDestructAnsi" ], [ 12176, "u8", "__vbaRecAnsiToUni" ], [ 12208, "u8", "__vbaRecUniToAnsi" ], [ 12228, "u8", "__vbaLateIdSt" ], [ 12244, "u8", "__vbaStrToAnsi" ], [ 12272, "u8", "__vbaObjSetAddref" ], [ 12292, "u8", "__vbaSetSystemError" ], [ 12312, "u8", "__vbaOnError" ], [ 12328, "u8", "__vbaFreeVarList" ], [ 12348, "u8", "__vbaStrVarMove" ], [ 12364, "u8", "__vbaLateIdCallLd" ], [ 12384, "u8", "__vbaFreeStrList" ], [ 12404, "u8", "__vbaStrCopy" ], [ 12420, "u8", "__vbaFreeObjList" ], [ 12464, "u8", "__vbaFreeObj" ], [ 12480, "u8", "__vbaHresultCheckObj" ], [ 12528, "u8", "__vbaFreeVar" ], [ 12544, "u8", "__vbaFreeStr" ], [ 12560, "u8", "__vbaStrMove" ], [ 12598, "u8", "yXtj" ], [ 12668, "u8", "Caqueterie6" ], [ 12802, "u8", "Indsejlingers9" ], [ 12891, "u8", "relumine" ], [ 12935, "u8", "CHOCOLATY" ], [ 12980, "u8", "Truisme2" ], [ 13024, "u8", "haandklde" ], [ 13069, "u8", "COCKLOFT" ], [ 13113, "u8", "Hjrnetand" ], [ 13158, "u8", "rideskolerne" ], [ 13218, "u8", "BMFT" ], [ 13530, "u8", "99EK" ], [ 22078, "u8", "ivJh5" ], [ 22434, "u8", "MRW2DR" ], [ 36412, "u8", "W2DR" ], [ 41864, "u8", "5faVH" ], [ 47114, "u8", "ERW2DR" ], [ 47468, "u8", "3EDR" ], [ 47878, "u8", "STW2DR" ], [ 48584, "u8", "3KGR" ], [ 53016, "u8", "/D5h" ], [ 55346, "u8", "ER5uq" ], [ 59432, "u8", "39GR" ], [ 60618, "u8", "ER7wQ" ], [ 64598, "u8", "CY5jI" ], [ 66164, "u8", "3RDR" ], [ 69476, "u8", "12MR" ], [ 71380, "u8", "D/ERW6DR" ], [ 75120, "u8", "W6DR" ], [ 75832, "u8", "3OGR" ], [ 76214, "u8", "ER5gY" ], [ 77562, "u8", "G47eG" ], [ 77998, "u8", "2BIxV" ], [ 80954, "u8", "IXD5" ], [ 89576, "u8", "3BDR" ], [ 92779, "u8", "Myo9R" ], [ 96693, "u8", "HER7" ], [ 97021, "u8", "KER7" ], [ 101154, "u8", "asMm" ], [ 101496, "u8", "WeER7ou" ], [ 131364, "u8", "VIMR" ], [ 133527, "u8", "RVVDR" ], [ 135868, "u8", "FEER" ], [ 137236, "u8", "34GR" ], [ 141152, "u8", "y37g" ], [ 142007, "u8", "RW2DR" ], [ 143551, "u8", "B5jUQ" ], [ 143595, "u8", "37vaV" ], [ 152076, "u8", "3NGR" ], [ 152473, "u8", "LTB5naN5faV7" ], [ 157891, "u8", "lW6DR" ], [ 172130, "u8", "PhwkI" ], [ 177546, "u8", "141.69.224.80:80" ], [ 179106, "u8", "_adj_fptan" ], [ 179190, "u8", "_adj_fdiv_m64" ], [ 179226, "u8", "_adj_fprem1" ], [ 179326, "u8", "_adj_fdiv_m32" ], [ 179372, "u8", "_adj_fdiv_m16i" ], [ 179410, "u8", "_adj_fdivr_m16i" ], [ 179450, "u8", "__vbaChkstk" ], [ 179464, "u8", "EVENT_SINK_AddRef" ], [ 179512, "u8", "DllFunctionCall" ], [ 179530, "u8", "_adj_fpatan" ], [ 179584, "u8", "EVENT_SINK_Release" ], [ 179606, "u8", "_CIsqrt" ], [ 179616, "u8", "EVENT_SINK_QueryInterface" ], [ 179644, "u8", "__vbaExceptHandler" ], [ 179666, "u8", "_adj_fprem" ], [ 179680, "u8", "_adj_fdivr_m64" ], [ 179698, "u8", "__vbaFPException" ], [ 179754, "u8", "_adj_fdiv_m32i" ], [ 179772, "u8", "_adj_fdivr_m32i" ], [ 179826, "u8", "_adj_fdivr_m32" ], [ 179844, "u8", "_adj_fdiv_r" ], [ 179940, "u8", "_CIatan" ], [ 179966, "u8", "_allmul" ], [ 184662, "wide", "VS_VERSION_INFO" ], [ 184754, "wide", "VarFileInfo" ], [ 184786, "wide", "Translation" ], [ 184822, "wide", "StringFileInfo" ], [ 184882, "wide", "CompanyName" ], [ 184908, "wide", "BambooHR" ], [ 184934, "wide", "FileDescription" ], [ 184994, "wide", "LegalCopyright" ], [ 185050, "wide", "LegalTrademarks" ], [ 185110, "wide", "ProductName" ], [ 185162, "wide", "FileVersion" ], [ 185214, "wide", "ProductVersion" ], [ 185270, "wide", "InternalName" ], [ 185296, "wide", "Verdensmnds" ], [ 185326, "wide", "OriginalFilename" ], [ 185360, "wide", "Verdensmnds.exe" ], [ 185421, "u8", "117.16.16.16:50" ] ], "v": { "file.stem": "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef", "pe.imphash": "f7e6b297ef01e2dbc17547af7c51f860", "pe.machine": "i386", "pe.rich.key": 2295254027, "pe.rich.hash": "792ab8d59fde05571bbbca108d4087b6", "pe.subsystem": "windows_gui", "pe.timestamp": 1468149184, "file.basename": "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef.exe", "pe.image_base": 4194304, "pe.image_size": 192512, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 5316, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "61454f8a364c879887260a1d7bd8d8c479672794", "pe.image_hash.sha256": "fe52952421f2b608244ec79ca1c4c90269d8be6edd86b5550581cc5468a8f19b", "pe.image_hash.sha384": "c2ed11257b7d886981406d612f19e9172b2ae43a0a3c66c70385e5649915c1b61aa02c8d5dbe6c468d14b78d567e0265", "pe.image_hash.sha512": "01c5cfd97d35537b852b1e11615ea2e9677f534cc35402ff6dcfaba7e89c8d0c45fde020d2b94b6ce555eee9ae35811b7f3ddb2cb5166fb9197af15d928d614f", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 178756, "pe.data_directories[1].rva": 188416, "pe.data_directories[2].rva": 552, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2464, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 284, "pe.rich.entries[0].build_id": 14, "pe.rich.entries[1].build_id": 9, "pe.rich.entries[2].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 3, "pe.rich.entries[2].use_count": 1, "pe.coff.dos_header_pe_pointer": 184, "pe.rich.entries[0].product_id": 7299, "pe.rich.entries[1].product_id": 8783, "pe.rich.entries[2].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1247533676 }, "id": "pe", "sc": [ [ ".text", 4096, 176128, 4.13, "r-x" ], [ ".data", 180224, 4096, 0.0, "rw-" ], [ ".rsrc", 184320, 4096, 2.13, "r--" ] ] }, "id": 0, "sz": 188416, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "ShellObject 117.16.16.16:50 endpoint", "e": [ "117.16.16.16:50" ], "i": "well-known/malware/trojan/shellobject/vb6-recycler::c2-117-16-16-16-50", "l": 1, "el": [ "0x2d44d" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x2958" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 70.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x238" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 70.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x2bd38" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x2d156" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 70.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 823.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x2d232" ] }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x2bdbc" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1, "el": [ "0x29b4" ] }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1247533676,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x2d3b6" ] }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x1074" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0x2830" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x2d3ee" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 70.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x2d410" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 70.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x2d316" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "String", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x2d08", "0x2d1f6" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x2d266" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 70.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x190b" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 176128, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "141.69.224.80:80", "117.16.16.16:50" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1, "el": [ "0x2b58a", "0x2d44d" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x190b" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x2d410" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSaveFileNamePreviewA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x2c4c" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (CIcos, adj_fptan, vbaVarMove, vbaFreeVar, vbaStrVarMove, ... +65 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "70 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "MSVBVM60.DLL", "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x238", "0x2bd38" ] } ], "sha": "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef", "path": "fc55920200c36ee47942792a3be6e7f8b00e46fd83ae7bcd826fd32e547836ef.exe", "type": "pe" } ], "tv": "52045" } }