{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.550173, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T12:09:17Z" }, "path": "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 4, "ff": { "i": [ [ "msvbvm60", "ORDINAL 582" ], [ "msvbvm60", "ORDINAL 585" ], [ "msvbvm60", "MethCallEngine" ], [ "msvbvm60", "ORDINAL 519" ], [ "msvbvm60", "ORDINAL 660" ], [ "msvbvm60", "ORDINAL 669" ], [ "msvbvm60", "ORDINAL 595" ], [ "msvbvm60", "ORDINAL 522" ], [ "msvbvm60", "ORDINAL 631" ], [ "msvbvm60", "ORDINAL 525" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "ORDINAL 527" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "ORDINAL 600" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 712" ], [ "msvbvm60", "ORDINAL 609" ], [ "msvbvm60", "ProcCallEngine" ], [ "msvbvm60", "ORDINAL 536" ], [ "msvbvm60", "ORDINAL 537" ], [ "msvbvm60", "ORDINAL 645" ], [ "msvbvm60", "ORDINAL 571" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "ORDINAL 614" ], [ "msvbvm60", "ORDINAL 616" ], [ "msvbvm60", "ORDINAL 617" ], [ "msvbvm60", "ORDINAL 618" ], [ "msvbvm60", "ORDINAL 619" ], [ "msvbvm60", "ORDINAL 581" ] ], "m": { "pe": { "checksum": 113503.0, "checksum_valid": 1.0, "computed_checksum": 113503.0, "bound_import_count": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 1243922264.0 }, "file": { "size": 90112.0, "entropy": 4.8, "size_bytes": 90112.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.07, "string_count": 574.0, "entropy_variance": 2.52, "avg_string_length": 23.48, "max_string_length": 132.0, "code_to_data_ratio": 1.0, "string_length_stddev": 27.55, "largest_section_ratio": 0.91, "sentence_string_count": 208.0, "sentence_string_ratio": 0.36, "high_entropy_string_count": 0.0 }, "imports": { "count": 31.0 }, "sections": { "count": 3.0, "code_size": 81920.0, "entropy_max": 5.07, "entropy_mean": 3.48, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 152, "u8", "Rich" ], [ 432, "u8", ".text" ], [ 512, "u8", ".rsrc" ], [ 568, "u8", "MSVBVM60.DLL" ], [ 4472, "u8", "Project1" ], [ 4592, "u8", "HYDR602M" ], [ 4605, "u8", "HYDR6020 - Storm Sewer Design" ], [ 4658, "u8", "Form2" ], [ 4692, "u8", "MS Sans SerifA" ], [ 4719, "u8", "Frame1" ], [ 4760, "u8", "Opt80" ], [ 4813, "u8", "Opt132" ], [ 4824, "u8", "Option2" ], [ 4867, "u8", "Label11" ], [ 4879, "u8", "80 Column Output" ], [ 4929, "u8", "Label10" ], [ 4941, "u8", "132 Column Output" ], [ 4993, "u8", "txtDesigner" ], [ 5029, "u8", "txtProject" ], [ 5064, "u8", "txtRemarks" ], [ 5099, "u8", "txtRegion" ], [ 5133, "u8", "txtReturn" ], [ 5167, "u8", "txtStage" ], [ 5200, "u8", "txtThick" ], [ 5233, "u8", "txtVHCoef" ], [ 5267, "u8", "VScroll1" ], [ 5308, "u8", "txtLineNum" ], [ 5360, "u8", "txtUpperEnd" ], [ 5413, "u8", "txtLowerEnd" ], [ 5466, "u8", "txtPipeLength" ], [ 5523, "u8", "txtDistance" ], [ 5578, "u8", "txtdSlope" ], [ 5631, "u8", "txtArea" ], [ 5682, "u8", "txtCoeff" ], [ 5734, "u8", "txttimec" ], [ 5786, "u8", "txtCSlope" ], [ 5830, "u8", "txtDiameter" ], [ 5876, "u8", "txtUpperFlow" ], [ 5923, "u8", "txtLowerFlow" ], [ 5970, "u8", "txtStreet" ], [ 6012, "u8", "Frame2" ], [ 6053, "u8", "optMetric" ], [ 6110, "u8", "optEnglish" ], [ 6125, "u8", "Option1" ], [ 6170, "u8", "Label8" ], [ 6181, "u8", "Metric" ], [ 6221, "u8", "Label4" ], [ 6232, "u8", "English" ], [ 6274, "u8", "lblElevations" ], [ 6292, "u8", "===Elevations (ft)====" ], [ 6348, "u8", "Label9" ], [ 6359, "u8", "Street" ], [ 6399, "u8", "lblLowerFlow" ], [ 6416, "u8", "Lower Line" ], [ 6460, "u8", "lblUpperFlow" ], [ 6477, "u8", "Upper line" ], [ 6522, "u8", "lblDiameter" ], [ 6538, "u8", "Pipe Diam (in)" ], [ 6586, "u8", "lblCslope" ], [ 6600, "u8", "Const Slope (ft/ft)" ], [ 6653, "u8", "Label7" ], [ 6664, "u8", "Runoff Coeff." ], [ 6711, "u8", "Label6" ], [ 6769, "u8", "Label1" ], [ 6780, "u8", "======Drainage Area=======" ], [ 6840, "u8", "lblStage" ], [ 6853, "u8", "Stage at outfall (ft)" ], [ 6908, "u8", "lblThick" ], [ 6921, "u8", "Roadway Thickness (in)" ], [ 6977, "u8", "lblReturn" ], [ 6991, "u8", "Return year Period" ], [ 7043, "u8", "lblRain" ], [ 7055, "u8", "Rainfall Region" ], [ 7104, "u8", "lblCoeff" ], [ 7117, "u8", "Time Conc. (min)" ], [ 7167, "u8", "lblArea" ], [ 7179, "u8", "Acres" ], [ 7218, "u8", "lblDistance" ], [ 7234, "u8", "Hydr Len(ft)" ], [ 7280, "u8", "lblPipeLength" ], [ 7298, "u8", "Pipe Length (ft)" ], [ 7348, "u8", "lblLowerEnd" ], [ 7364, "u8", "Lower End" ], [ 7407, "u8", "lblUpperEnd" ], [ 7423, "u8", "Upper End" ], [ 7466, "u8", "lblLineNum" ], [ 7481, "u8", "Line Num" ], [ 7523, "u8", "Label5" ], [ 7534, "u8", "Remarks" ], [ 7575, "u8", "Label3" ], [ 7586, "u8", "Project Number" ], [ 7634, "u8", "Label2" ], [ 7645, "u8", "Designer Name" ], [ 7692, "u8", "lblVHCoef" ], [ 7706, "u8", "Velocity Head Coef." ], [ 7760, "u8", "mnuFile" ], [ 7789, "u8", "mnuNew" ], [ 7814, "u8", "mnuOpen" ], [ 7841, "u8", "mnuSave" ], [ 7868, "u8", "mnuSaveAS" ], [ 7882, "u8", "\u0026Save As" ], [ 7900, "u8", "mnuExit" ], [ 7928, "u8", "mnuRunOK" ], [ 7955, "u8", "mnuEdit" ], [ 7984, "u8", "mnuInsert" ], [ 7998, "u8", "\u0026Insert a line" ], [ 8022, "u8", "mnuRepeat" ], [ 8036, "u8", "\u0026Repeat this Line" ], [ 8063, "u8", "mnuDelete" ], [ 8077, "u8", "\u0026Delete this line" ], [ 8105, "u8", "mnuHelp1" ], [ 8135, "u8", "mnuAbout" ], [ 8164, "u8", "mnuHelp" ], [ 9148, "wide", "*\\AC:\\Glenn\\hydr2009\\hydr6020.vbp" ], [ 22820, "u8", "HYDR6020" ], [ 22832, "u8", "HYDRWINS" ], [ 22844, "u8", "REMARKS" ], [ 22852, "u8", "GETSTRG" ], [ 22860, "u8", "opendialog" ], [ 23148, "u8", "Form" ], [ 23172, "u8", "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 24080, "wide", "Metric" ], [ 24100, "wide", "English" ], [ 24208, "wide", "Designer" ], [ 25028, "wide", "* Project Rain return outfall roadway v head" ], [ 25252, "wide", "Stage at outfall (ft)" ], [ 25688, "wide", "METRIC" ], [ 25884, "u8", "VBA6.DLL" ], [ 25932, "wide", "Save Changes to" ], [ 25972, "wide", "newfile" ], [ 26040, "wide", "HYDR6020.EXE" ], [ 26096, "wide", "HYDR6020.TMP" ], [ 26128, "wide", "HYDR6020.PRT" ], [ 26160, "wide", "HYDR602M.INI" ], [ 26200, "wide", "HYDR6020 - Storm Sewer Design -" ], [ 26304, "wide", "LADOTD HYDR6020 Storm Sewer Design Program." ], [ 26408, "wide", "Revised as of March 20, 2012" ], [ 26480, "wide", "hydrview HYDR6020.DOC" ], [ 26528, "wide", "hydrview" ], [ 26564, "wide", "HYDR6020 - Storm Sewer Design - new file" ], [ 26652, "wide", "HYDR6020 Files (*.620)|*.620|All Files (*.*)|*.*" ], [ 26812, "u8", "comdlg32.dll" ], [ 26832, "u8", "GetOpenFileNameA" ], [ 26908, "u8", "GetSaveFileNameA" ], [ 28592, "wide", "===Elevations (m) ====" ], [ 28660, "wide", "Const Slope (m/m)" ], [ 28704, "wide", "Stage at outfall (m)" ], [ 28752, "wide", "Roadway Thickness (mm)" ], [ 28816, "wide", "Hydr len(m)" ], [ 28844, "wide", "Pipe Diam (mm)" ], [ 28880, "wide", "Pipe Length (m)" ], [ 28916, "wide", "===Elevations (ft)====" ], [ 28968, "wide", "Const Slope (ft/ft)" ], [ 29040, "wide", "Roadway Thickness (in)" ], [ 29092, "wide", "Acres" ], [ 29108, "wide", "Hydr len(ft)" ], [ 29140, "wide", "Pipe Diam (in)" ], [ 29176, "wide", "Pipe Length (ft)" ], [ 29216, "wide", "METIN" ], [ 29232, "wide", "METOUT" ], [ 29420, "wide", "|--STRUCTURE-| PIPE |------DRAINAGE AREA--------| |ACRES X COEFF |TRAVEL | TIME | RAIN- | CONST.| REQD. | Q | CONST" ], [ 29860, "wide", "INPUT DATA:" ], [ 29916, "wide", "LINE |UPPER LOWER |LENGTH| HYDL SLOPE INCR. TOTAL|RUNOFF| | TIME | OF | FALL | SLOPE | HYDR. | CAPAC.| CLE" ], [ 30188, "wide", "NUM END END (FT)|(FT) (%) ACRES|COEF CONC FT/FT (IN)| UPPER LOWER (FT)" ], [ 30356, "wide", "*** ERROR *** NODE NUMBER" ], [ 30688, "wide", "AREA" ], [ 30704, "wide", "LIN UPP LOW LEN |HYDL SLOP AREA|OFF OF SLOPE DIAM| ELEVATION ELEV." ], [ 30872, "wide", "ANY OTHER NODE" ], [ 31184, "wide", "OUTPUT RESULTS - PART 1" ], [ 31240, "wide", "PIPE|---DRAINAGE----|RUN TIME CONST PIPE| FLOW LINE STREET" ], [ 31412, "wide", "|--STRUCTURE-| Q | PIPE | V |VELOC.|FRICT.|JUNCTION|HYDRAULIC GRADE| FLOW LINE | STREET |HYDRAULIC| |" ], [ 31684, "wide", "DESIGN STAGE ELEVATION AT OUTFALL =" ], [ 31772, "wide", "*** ERROR IN ABOVE INPUT LINE ***" ], [ 31852, "wide", "LINE |UPPER LOWER | | DIAM | | HEAD | LOSS | LOSS |LINE ELEVATION | ELEVATION | ELEV |CLEARANCE| REMARKS " ], [ 32124, "wide", "STATE PROJECT NUMBER" ], [ 32220, "wide", "STORM SEWER DESIGN" ], [ 32276, "wide", "DESIGN STORM =" ], [ 32604, "wide", "HYDRAULICS SECTION" ], [ 32648, "wide", "PAGE" ], [ 32764, "wide", "YEARS" ], [ 33072, "wide", "OUTPUT RESULTS - PART 2" ], [ 33136, "wide", "LOUISIANA DEPARTMENT OF TRANSPORTATION AND DEVELOPMENT" ], [ 33252, "wide", "HYDR6020-" ], [ 33288, "wide", "|--STRUCTURE-| PIPE |-------DRAINAGE AREA--------| |ACRES X COEFF |" ], [ 33456, "wide", "LINE |UPPER LOWER |LENGTH| DIST SLOPE INCR. TOTAL|RUNOFF| |" ], [ 33956, "wide", "|--STRUCTURE-|TRAVEL | TIME | RAIN- | CONST.| REQD. | Q | CONST" ], [ 34112, "wide", "LINE |UPPER LOWER | TIME | OF | FALL | SLOPE | HYDR. | CAPAC.| CLEAR" ], [ 34284, "wide", "NO. | END END |IN PIPE|CONCEN.| INTENS.|(FT/FT)| SLOPE | (CFS) | (FT)" ], [ 34524, "wide", "|-STRUCTURE-| Q | PIPE | V |VELOC.|FRICT.|JUNCTION|HYDRAULIC GRADE" ], [ 34764, "wide", "LINE |UPPER LOWER| | DIAM | | HEAD | LOSS | LOSS |LINE ELEVATION" ], [ 35100, "wide", "LINE |UPPER LOWER| ELEVATION | ELEV |CLEARANCE| REMARKS |" ], [ 35428, "wide", "OUTPUT RESULTS - PART 3" ], [ 35628, "wide", "ERROR - INVALID REGION" ], [ 35692, "wide", "PLOT" ], [ 35740, "wide", "NO. | END END | UPPER LOWER | (FT) | (FT) | |" ], [ 35932, "wide", "OUTPUT RESULTS - PART 4" ], [ 36008, "wide", "** ERROR ** END OF FILE WHILE READING HEADINGS" ], [ 36196, "wide", "YOU MUST CODE A NUMBER FOR EVERY ITEM, EVEN IF IT IS 0." ], [ 36316, "wide", "ITEMS MUST BE SEPARATED BY A SPACE OR A COMMA, BUT DO NOT HAVE" ], [ 36448, "wide", "TO BE IN ANY PARTICULAR COLUMN." ], [ 36520, "wide", "THIS IS A REVISION ADDED 04/25/89 TO MAKE IT EASIER TO INPUT" ], [ 36688, "wide", "THE DATA ON A PC. GLENN CHUSTZ." ], [ 36856, "wide", "*** ERROR *** LOWER END NUMBER MAY NOT BE 0" ], [ 36952, "wide", "*** ERROR *** HYDRAULIC LENGTH \u003c= 0 AND ACRES NOT = 0" ], [ 37068, "wide", "*** ERROR *** INVALID DRAINAGE SLOPE:" ], [ 37152, "wide", "*** ERROR *** INVALID RUNOFF COEFFICIENT:" ], [ 37244, "wide", "*** ERROR *** INVALID DIAMETER:" ], [ 37316, "wide", "*** WARNING ***" ], [ 37368, "wide", "INCH PIPE MAY NOT BE AVAILABLE COMMERCIALLY." ], [ 37464, "wide", "*** ERROR *** INVALID CONSTRUCTION SLOPE:" ], [ 37556, "wide", "*** ERROR *** INVALID PIPE LENGTH:" ], [ 37636, "wide", "*** ERROR *** FLOW LINE ELEVATION NOT SPECIFIED" ], [ 37740, "wide", "*** ERROR *** YOU CANT SPECIFY BOTH UPPER AND LOWER" ], [ 37852, "wide", "FLOW LINE ELEVATIONS" ], [ 37900, "wide", "*** ERROR *** THERE MUST BE ONE AND ONLY ONE LOWER" ], [ 38012, "wide", "NODE WITH A VALUE OF 999" ], [ 38068, "wide", "DOES NOT CONNECT TO" ], [ 38116, "wide", "*** ERROR *** TOO MANY PIPES LEADING INTO JUNCTION" ], [ 38224, "wide", "*** ERROR *** MORE THAN ONE PIPE COMING OUT OF NODE" ], [ 38332, "wide", "** ERROR ** THERE IS AN ERROR IN THE PIPE NETWORK" ], [ 38440, "wide", "THE FOLLOWING PIPES CANNOT BE PUT IN ORDER" ], [ 38596, "wide", "*** ERROR *** AREA MUST NOT BE 0 FOR LEAD-IN PIPE." ], [ 38704, "wide", "(LINE NUMBER" ], [ 38756, "wide", "*** ERROR *** PIPE SIZE OF" ], [ 38836, "wide", "EXCEEDS MAXIMUM" ], [ 38880, "wide", "ALLOWABLE SIZE OF 144 INCHES." ], [ 39052, "wide", "EXIT LOSS =" ], [ 39084, "wide", "MANNING" ], [ 39108, "wide", "S ROUGHNESS COEFFICIENT OF" ], [ 39200, "wide", "VELOCITY HEAD WAS USED FOR LOSSES AT MANHOLES." ], [ 39300, "wide", "ROADWAY THICKNESS=" ], [ 39372, "wide", "INCHES." ], [ 39428, "wide", "PART FULL" ], [ 39460, "wide", "FLOW LINE ?" ], [ 39492, "wide", "STREET ELEV?" ], [ 39524, "wide", "HYDR. LEN. ?" ], [ 39556, "wide", "CONC. TIME ?" ], [ 39588, "wide", "PIPE DIAM. ?" ], [ 39620, "wide", "DRAIN SLOPE?" ], [ 39652, "wide", "CONST CLEAR?" ], [ 39684, "wide", "*** Warning *** Pipes less than 15 inches in diameter may be used to evaluate" ], [ 39848, "wide", "existing systems only. They may not be used for design." ], [ 40080, "wide", "HYDRWINT.PRT" ], [ 40116, "wide", "HYDR2009.EXE $" ], [ 83004, "u8", "MethCallEngine" ], [ 83022, "u8", "EVENT_SINK_AddRef" ], [ 83042, "u8", "DllFunctionCall" ], [ 83060, "u8", "EVENT_SINK_Release" ], [ 83082, "u8", "EVENT_SINK_QueryInterface" ], [ 83110, "u8", "__vbaExceptHandler" ], [ 83132, "u8", "ProcCallEngine" ], [ 86358, "wide", "VS_VERSION_INFO" ], [ 86450, "wide", "VarFileInfo" ], [ 86482, "wide", "Translation" ], [ 86518, "wide", "StringFileInfo" ] ], "v": { "file.stem": "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863", "pe.imphash": "383d41ecbf6ea9f143e6832b80d57316", "pe.machine": "i386", "pe.rich.key": 2288612339, "pe.rich.hash": "9fd14c40d4dca5e21aa54c626075766f", "pe.subsystem": "windows_gui", "pe.timestamp": 1332249936, "file.basename": "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863.exe", "pe.image_base": 4194304, "pe.image_size": 98304, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4412, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "1a05726f70f38cd95bda7cc8422b49ad2888aabb", "pe.image_hash.sha256": "ea4532b1b513560be3120c908f05d328c8c6e65ae53180bfc2ad2c4fd8c4e214", "pe.image_hash.sha384": "8fe36e208cc6ed0efe11c3e1967cd7556be5dbf29d81fcd1275cf87b23bac6bc7c3d782f617467b1e3264ca166f494ee", "pe.image_hash.sha512": "fa86e78017397cf1c16630b712eca69736ea2f22f2c61e4f0f524cf6433d4bb314ef41cc909f6e9c6c847e091d319dca171bb18ee4c7455c93e590d1daa38e8d", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 82820, "pe.data_directories[1].rva": 94208, "pe.data_directories[2].rva": 552, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2256, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 128, "pe.rich.entries[0].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.coff.dos_header_pe_pointer": 184, "pe.rich.entries[0].product_id": 8169, "pe.bound_imports[0].time_date_stamp": 1247533676 }, "id": "pe", "sc": [ [ ".text", 4096, 81920, 5.07, "r-x" ], [ ".data", 0, 0, 0.0, "rw-" ], [ ".rsrc", 86016, 4096, 1.9, "r--" ] ] }, "id": 0, "sz": 90112, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".TMP" ], "i": "objectives/impact/infect/binary/rewrite::tmp-extension-staging", "l": 1, "el": [ "0x65f0" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x68bc" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 31.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x238" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "txtStage", "Stage at outfall (ft)", "lblStage", "DESIGN STAGE ELEVATION AT OUTFALL =", "Stage at outfall (m)" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-3", "l": 1, "m": "B0023", "el": [ "0x142f", "0x1ac5", "0x1ab8", "0x7bc4", "0x7020" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x14462" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x15156" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 31.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 574.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x15232" ] }, { "a": "T1014", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".EXE" ], "i": "objectives/evasion/kernel-hide/rootkit::executable-read-patch-markers--rx-7", "l": 1, "el": [ "0x65b8" ] }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "ProcCallEngine", "MethCallEngine", "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x144bc", "0x1443c", "0x144a6" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.36" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1247533676,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.91" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x152ee" ] }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x1030" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0x5a84" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x15322" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 31.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".EXE", ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x65b8", "0x15344" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x6d37" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "NODE WITH A VALUE OF 999" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x947c" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x1525e" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x151f6" ] }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code IN token (repeated)", "e": [ "-IN ", " IN ", "|IN ", "(IN)" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-in", "l": 1, "m": "B0007.003", "el": [ "0x96c4", "0x7c1c", "0x85ec", "0x75ec" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code BY token", "e": [ " BY " ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-by", "l": 1, "m": "B0007.003", "el": [ "0x8ddc" ] }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 31.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.91" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 31.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x23fd" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 81920, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.91" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x23fd" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 31.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x15344" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.91" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 582, ORDINAL 585, MethCallEngine, ORDINAL 519, ORDINAL 660, ... +26 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "31 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "MSVBVM60.DLL", "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x238", "0x14462" ] } ], "sha": "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863", "path": "fdf3b7e3175b7ce71931711c7ca46e87bec0e252803a69030bada5480ccb5863.exe", "type": "pe" } ], "tv": "52045" } }