{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.06094364449381828, "class": 0 } ], "prob": 0.060943644, "class": 0, "models": [ { "m": "az", "prob": 0.060943644, "class": 0 }, { "m": "az/native", "prob": 0.0, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T23:05:05Z" }, "path": "VirusShare_63ee78defd8130dd0289f10568f613bb", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 4, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 45056.0, "entropy": 5.97, "size_bytes": 45056.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 240, "u8", "Rich" ], [ 520, "u8", ".text" ], [ 599, "u8", "@.data" ], [ 680, "u8", ".rsrc" ], [ 719, "u8", "@.reloc" ], [ 1221, "u8", "VPWS" ], [ 1314, "u8", "SVW3" ], [ 1321, "u8", "SSSSV" ], [ 1415, "u8", "QSVW" ], [ 3460, "u8", "QQSVWj" ], [ 4371, "u8", "f90t" ], [ 5085, "u8", "unVPPj" ], [ 6277, "u8", "PQSVW" ], [ 7941, "u8", "Genu" ], [ 7948, "u8", "5ineI" ], [ 7959, "u8", "5ntel" ], [ 9125, "u8", "DtFVW" ], [ 11168, "u8", "Unknown exception" ], [ 11200, "u8", "bad allocation" ], [ 11228, "u8", "bad array new length" ], [ 11258, "wide", "@KERNEL32.DLL" ], [ 11288, "u8", "AcquireSRWLockExclusive" ], [ 11312, "u8", "ReleaseSRWLockExclusive" ], [ 11496, "u8", "AddDllDirectory" ], [ 11510, "wide", "ykernel32.dll" ], [ 11540, "u8", "InitConverter32" ], [ 11556, "u8", "UninitConverter" ], [ 11572, "u8", "IsFormatCorrect32" ], [ 11592, "u8", "RegisterApp" ], [ 11604, "u8", "ForeignToRtf32" ], [ 11620, "u8", "RtfToForeign32" ], [ 11636, "u8", "SetAppVer" ], [ 11648, "u8", "BiffToMetro" ], [ 11658, "wide", "owordcnv.dll" ], [ 11684, "u8", "MSWRINGER" ], [ 11696, "u8", "MSWORD" ], [ 11704, "wide", "MEWord12" ], [ 11724, "wide", "Word12" ], [ 11744, "wide", "embedding" ], [ 11792, "u8", "SetProcessDEPPolicy" ], [ 11812, "u8", "GetSystemDEPPolicy" ], [ 12672, "u8", "USER32.dll" ], [ 12706, "u8", "GetMessageW" ], [ 12720, "u8", "TranslateMessage" ], [ 12740, "u8", "DispatchMessageW" ], [ 12760, "u8", "PostQuitMessage" ], [ 12976, "u8", "api-ms-win-crt-heap-l1-1-0.dll" ], [ 13008, "u8", "api-ms-win-crt-locale-l1-1-0.dll" ], [ 13044, "u8", "api-ms-win-crt-stdio-l1-1-0.dll" ], [ 13076, "u8", "api-ms-win-crt-math-l1-1-0.dll" ], [ 13108, "u8", "api-ms-win-crt-runtime-l1-1-0.dll" ], [ 13144, "base64", "T$T52\f\u0013^4" ], [ 13164, "u8", "OLEAUT32.dll" ], [ 13180, "u8", "KERNEL32.dll" ], [ 13196, "u8", "ole32.dll" ], [ 13534, "u8", "CoRevokeClassObject" ], [ 13556, "u8", "CoInitializeEx" ], [ 13574, "u8", "CoRegisterClassObject" ], [ 13598, "u8", "CoUninitialize" ], [ 13616, "u8", "GetSystemInfo" ], [ 13632, "u8", "RaiseException" ], [ 13650, "u8", "LoadLibraryExA" ], [ 13668, "u8", "VirtualQuery" ], [ 13684, "u8", "VirtualProtect" ], [ 13702, "u8", "GetCommandLineW" ], [ 13720, "u8", "MultiByteToWideChar" ], [ 13742, "u8", "GetLastError" ], [ 13758, "u8", "GlobalAlloc" ], [ 13772, "u8", "GlobalFree" ], [ 13786, "u8", "GetProcAddress" ], [ 13804, "u8", "GlobalLock" ], [ 13818, "u8", "GetModuleHandleW" ], [ 13838, "u8", "FreeLibrary" ], [ 13852, "u8", "WideCharToMultiByte" ], [ 13874, "u8", "GlobalUnlock" ], [ 13890, "u8", "GlobalReAlloc" ], [ 13906, "u8", "LoadLibraryExW" ], [ 13924, "u8", "SetUnhandledExceptionFilter" ], [ 13954, "u8", "UnhandledExceptionFilter" ], [ 13982, "u8", "WerRegisterMemoryBlock" ], [ 14008, "u8", "GetTickCount" ], [ 14024, "u8", "GetSystemTimeAsFileTime" ], [ 14050, "u8", "GetCurrentThreadId" ], [ 14072, "u8", "GetCurrentProcessId" ], [ 14094, "u8", "HeapSetInformation" ], [ 14116, "u8", "GetProcessHeap" ], [ 14134, "u8", "QueryPerformanceCounter" ], [ 14160, "u8", "TerminateProcess" ], [ 14180, "u8", "IsProcessorFeaturePresent" ], [ 14208, "u8", "InitializeSListHead" ], [ 14230, "u8", "IsDebuggerPresent" ], [ 14250, "u8", "GetStartupInfoW" ], [ 14268, "u8", "GetCurrentProcess" ], [ 14288, "u8", "__CxxFrameHandler3" ], [ 14310, "u8", "memmove" ], [ 14320, "u8", "memset" ], [ 14330, "u8", "_except_handler4_common" ], [ 14356, "u8", "__std_exception_destroy" ], [ 14382, "u8", "_CxxThrowException" ], [ 14404, "u8", "__std_exception_copy" ], [ 14428, "u8", "_register_onexit_function" ], [ 14456, "u8", "terminate" ], [ 14468, "u8", "_controlfp_s" ], [ 14484, "u8", "_initialize_onexit_table" ], [ 14512, "u8", "_register_thread_local_exe_atexit_callback" ], [ 14558, "u8", "_cexit" ], [ 14568, "u8", "_seh_filter_exe" ], [ 14594, "u8", "exit" ], [ 14602, "u8", "_initterm_e" ], [ 14616, "u8", "_set_app_type" ], [ 14632, "u8", "_get_narrow_winmain_command_line" ], [ 14668, "u8", "_initialize_narrow_environment" ], [ 14702, "u8", "_configure_narrow_argv" ], [ 14728, "u8", "_crt_atexit" ], [ 14742, "u8", "_initterm" ], [ 14754, "u8", "_c_exit" ], [ 14764, "u8", "__setusermatherr" ], [ 14784, "u8", "__p__commode" ], [ 14800, "u8", "_set_fmode" ], [ 14814, "u8", "_configthreadlocale" ], [ 14836, "u8", "free" ], [ 14844, "u8", "_callnewh" ], [ 14856, "u8", "_set_new_mode" ], [ 14872, "u8", "malloc" ], [ 14968, "u8", "RSDSN" ], [ 14992, "unicode-escape", "d:\\dbs\\el\\oc\\target†\\ship\\postc2r\\xone\\wordconv.pdb" ], [ 15049, "u8", "e\\wordconv.pdb" ], [ 15248, "u8", "GCTL" ], [ 15412, "u8", ".?AVbad_alloc@std@@" ], [ 15440, "u8", ".?AVexception@std@@" ], [ 15468, "u8", ".?AVbad_array_new_length@std@@" ], [ 15508, "u8", ".?AVtype_info@@" ], [ 16092, "u8", "AppVIsvSubsystems32.dll" ], [ 16550, "wide", "VS_VERSION_INFO" ], [ 16642, "wide", "StringFileInfo" ], [ 16678, "wide", "040904E4" ], [ 16702, "wide", "CompanyName" ], [ 16728, "wide", "Microsoft Corporation" ], [ 16778, "wide", "FileDescription" ], [ 16812, "wide", "Word Converter" ], [ 16850, "wide", "FileVersion" ], [ 16914, "wide", "InternalName" ], [ 16940, "wide", "WordConv" ], [ 16966, "wide", "LegalTrademarks1" ], [ 17000, "wide", "Microsoft® is a registered trademark of Microsoft Corporation." ], [ 17134, "wide", "LegalTrademarks2" ], [ 17168, "wide", "Windows® is a registered trademark of Microsoft Corporation." ], [ 17298, "wide", "OriginalFilename" ], [ 17332, "wide", "WordConv.exe" ], [ 17366, "wide", "ProductName" ], [ 17392, "wide", "Microsoft Office 2016" ], [ 17442, "wide", "ProductVersion" ], [ 17510, "wide", "MOSEVersion" ], [ 17536, "wide", "BETA" ], [ 17554, "wide", "SDClient" ], [ 17572, "wide", "_qcloud2" ], [ 17598, "wide", "VarFileInfo" ], [ 17630, "wide", "Translation" ], [ 17660, "u8", "FE2X" ], [ 18783, "u8", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\" ?\u003e" ], [ 18841, "u8", "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 18916, "u8", "\u003cnoInherit /\u003e" ], [ 18932, "u8", "\u003cassemblyIdentity processorArchitecture=\"x86\" type=\"win32\" name=\"wordconv\" version=\"1.0.0.0\" /\u003e" ], [ 19030, "u8", "\u003cdescription\u003eWord Converter\u003c/description\u003e" ], [ 19074, "u8", "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 19129, "u8", "\u003csecurity\u003e" ], [ 19143, "u8", "\u003crequestedPrivileges\u003e" ], [ 19169, "u8", "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], [ 19236, "u8", "\u003c/requestedPrivileges\u003e" ], [ 19263, "u8", "\u003c/security\u003e" ], [ 19278, "u8", "\u003c/trustInfo\u003e" ], [ 19293, "u8", "\u003c/assembly\u003e" ], [ 19306, "u8", "PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDI" ], [ 19515, "u8", "2$23282\u003e2E2K2P2W2]2b2i2o2t2{2" ], [ 21196, "u8", "Washington1" ], [ 21217, "u8", "Redmond1" ], [ 21235, "u8", "Microsoft Corporation1!0" ], [ 21267, "u8", "Microsoft Time-Stamp PCA0" ], [ 21295, "u8", "160907175852Z" ], [ 21310, "u8", "180907175852Z0" ], [ 21389, "u8", "Microsoft Corporation1" ], [ 21435, "u8", "nCipher DSE ESN:2137-37A0-4AAA1%0#" ], [ 21476, "u8", "Microsoft Time-Stamp Service0" ], [ 21878, "u8", "M0K0I" ], [ 21888, "u8", "Chttp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" ], [ 21969, "u8", "L0J0H" ], [ 21985, "u8", "\u003chttp://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" ], [ 22457, "u8", "Microsoft Corporation1#0!" ], [ 22489, "u8", "Microsoft Code Signing PCA0" ], [ 22519, "u8", "170811201115Z" ], [ 22534, "u8", "180811201115Z0" ], [ 22645, "u8", "MOPR1" ], [ 22660, "u8", "Microsoft Corporation0" ], [ 23047, "u8", "G0E1" ], [ 23061, "u8", "MOPR1402" ], [ 23075, "u8", "+229803+1abf9e5f-ced0-42e6-a65d-d9350959fe0e0" ], [ 23160, "u8", "O0M0K" ], [ 23170, "u8", "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" ], [ 23253, "u8", "N0L0J" ], [ 23269, "u8", "\u003ehttp://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" ], [ 23688, "u8", "microsoft1-0+" ], [ 23708, "u8", "$Microsoft Root Certificate Authority0" ], [ 23749, "u8", "100831221932Z" ], [ 23764, "u8", "200831222932Z0y1" ], [ 24388, "u8", "I0G0E" ], [ 24398, "u8", "?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" ], [ 24475, "u8", "H0F0D" ], [ 24491, "u8", "8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" ], [ 25221, "u8", "070403125309Z" ], [ 25236, "u8", "210403130309Z0w1" ], [ 25851, "u8", "$Microsoft Root Certificate Authority" ], [ 26738, "u8", "Microsoft Code Signing PCA" ], [ 26914, "wide", "Microsoft Offic" ], [ 26951, "u8", "http://office.microsoft.com 0" ], [ 27384, "u8", "Microsoft Time-Stamp PCA" ], [ 27590, "u8", "M5NE" ], [ 27888, "u8", "N0L0" ], [ 28085, "u8", "Microsoft Corporation1(0\u0026" ], [ 28117, "u8", "Microsoft Code Signing PCA 20110" ], [ 28152, "u8", "170811202024Z" ], [ 28167, "u8", "180811202024Z0t1" ], [ 28704, "u8", "+230012+c804b5ea-49b4-4238-8362-d851fa2254fc0" ], [ 28799, "u8", "Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" ], [ 28880, "u8", "U0S0Q" ], [ 28896, "u8", "Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" ], [ 29618, "u8", "Microsoft Corporation1200" ], [ 29649, "u8", ")Microsoft Root Certificate Authority 20110" ], [ 29695, "u8", "110708205909Z" ], [ 30556, "u8", "S0Q0O" ], [ 30566, "u8", "Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" ], [ 30653, "u8", "R0P0N" ], [ 30669, "u8", "Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" ], [ 30780, "u8", "3http://www.microsoft.com/pkiops/docs/primarycps.htm0@" ], [ 31398, "u8", "WqVNHE" ], [ 31541, "u8", "Microsoft Code Signing PCA 2011" ], [ 32415, "u8", "nCipher DSE ESN:57C8-2D15-1C8B1%0#" ], [ 32456, "u8", "Microsoft Time-Stamp Service" ], [ 32625, "u8", ")Microsoft Root Certificate Authority 20100" ], [ 32671, "u8", "100701213655Z" ], [ 32764, "u8", "Microsoft Corporation1\u00260$" ], [ 32796, "u8", "Microsoft Time-Stamp PCA 20100" ], [ 33284, "u8", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" ], [ 33383, "u8", "\u003ehttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" ], [ 33493, "u8", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@" ], [ 33562, "wide", "Legal_Policy_Statement‮" ], [ 34320, "u8", "160907175653Z" ], [ 34335, "u8", "180907175653Z0" ], [ 34913, "u8", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" ], [ 35012, "u8", "\u003ehttp://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" ], [ 35747, "u8", "nCipher NTS ESN:2665-4C3F-C5DE1+0)" ], [ 35787, "u8", "\"Microsoft Time Source Master Clock0" ], [ 35848, "u8", "20180208212713Z" ], [ 36385, "u8", "Microsoft Time-Stamp PCA 2010" ] ], "v": { "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1517990709, "pe.image_base": 4194304, "pe.image_size": 40960, "pe.machine_id": 332, "pe.os_version": "6.1", "pe.entry_point": 8824, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 16048, "pe.section_alignment": 4096, "pe.subsystem_version": "6.1", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.linker_major_version": 14, "pe.linker_minor_version": 11, "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "33000001797c2e574e52e1cad6000100000179", "pe.signatures[0].subject": "CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2018-08-11T20:11:15Z", "pe.signatures[0].not_before": "2017-08-11T20:11:15Z", "pe.coff.dos_header_pe_pointer": 272, "pe.signatures[0].nested.issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].nested.serial": "33000000c4e989f87a8150e9ff0000000000c4", "pe.signatures[0].nested.subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].nested.verified": true, "pe.signatures[0].thumbprint_sha1": "5ead300dc7e4d637948ecb0ed829a072bd152e17", "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].nested.not_after": "2018-08-11T20:20:24Z", "pe.signatures[0].signature_digest": "51c5b4bb702881d7c75806b9cec40915e2517a84", "pe.signatures[0].nested.not_before": "2017-08-11T20:20:24Z", "pe.signatures[0].thumbprint_sha256": "fb2e0c65764535337434c74236bf4a109fd96e6d392828251d95086b6fd819c7", "pe.signatures[0].signature_algorithm": "sha1WithRSAEncryption", "pe.signatures[0].nested.thumbprint_sha1": "9aca9419e53d3c9e56396dd2335ff683a8b0b8f3", "pe.signatures[0].nested.cert_chain_depth": 2, "pe.signatures[0].nested.digest_algorithm": "sha256", "pe.signatures[0].nested.eku_code_signing": true, "pe.signatures[0].nested.signature_digest": "e00a7ff41c2734192a40a1c1fa29e58335d7b1edc56aaa1871f14a74f4c05751", "pe.signatures[0].nested.thumbprint_sha256": "2839f2027bfb2a6ad7f70a3f38dfd7d4ab244892e18829b21070a9b542ae7ade", "pe.signatures[0].nested.signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1", "pe.signatures[0].nested.signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 45056, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/unknown::microsoft-corporation", "l": 2 }, { "c": 1.0, "d": "Signed by Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/leaf::microsoft-corporation", "l": 3 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "c804b5ea-49b4-4238-8362-d851fa2254fc", "1abf9e5f-ced0-42e6-a65d-d9350959fe0e" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.949999988079071, "d": "Microsoft code-signing certificate chain", "e": [ "Microsoft Code Signing PCA 2011" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "l": 2 }, { "c": 0.9700000286102295, "d": "Office AppV sideload DLL reference", "e": [ "AppVIsvSubsystems32.dll" ], "i": "objectives/command-and-control/dropper/sideload::office-appv-sideload-dll-ref", "l": 1 }, { "a": "T1036", "c": 0.8999999761581421, "d": "Dense Microsoft certificate text", "e": [ "Microsoft Corporation0", "Microsoft® is a registered trademark of Microsoft Corporation.", "Microsoft Corporation1!0", "Microsoft Corporation1", "Microsoft Corporation1#0!", "Microsoft Corporation1(0\u0026", "Microsoft Corporation1200", "Microsoft Corporation1\u00260$", "Windows® is a registered trademark of Microsoft Corporation.", "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/binary::dense-microsoft-cert-text", "l": 1, "m": "OB0006" }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "wordconv.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD", "PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "_get_narrow_winmain_command_line" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.949999988079071, "d": "Microsoft timestamp certificate chain", "e": [ "Microsoft Time-Stamp Service", "Microsoft Time-Stamp PCA 2010" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_63ee78defd8130dd0289f10568f613bb" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2 }, { "c": 1.0, "d": "Issued by a Microsoft Code Signing PCA", "e": [ "CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US" ], "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.9900000095367432, "d": "Office postc2r build-pipeline PDB path", "e": [ "d:\\dbs\\el\\oc\\target†\\ship\\postc2r\\xone\\wordconv.pdb" ], "i": "objectives/command-and-control/dropper/sideload::office-postc2r-pdb-path", "l": 1 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "ykernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SetProcessDEPPolicy", "UnhandledExceptionFilter", "WideCharToMultiByte", "InitializeSListHead", "MicrosoftTimeStampPCA", "AcquireSRWLockExclusive", "MultiByteToWideChar", "SetUnhandledExceptionFilter", "WerRegisterMemoryBlock", "GetSystemTimeAsFileTime", "GetCurrentProcessId", "GetSystemDEPPolicy", "ReleaseSRWLockExclusive" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 45056 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 1.0, "d": "Microsoft certificate chain markers", "e": [ "Microsoft Time-Stamp PCA 2010", "Microsoft Code Signing PCA 2011", "Microsoft Time-Stamp Service", "Microsoft Corporation" ], "i": "metadata/signed/platform::microsoft-certificate-chain", "l": 1 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "\u003cbinary data\u003e \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 } ], "sha": "fce063494b1a77709dd81d447e71edeb1b757e72a4f3d4d4a34ac2eb25d43e45", "path": "VirusShare_63ee78defd8130dd0289f10568f613bb", "type": "pe" } ], "tv": "7924e" } }