{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.871046245098114, "class": 0 } ], "prob": 0.87104625, "class": 0, "models": [ { "m": "az", "prob": 0.87104625, "class": 0 }, { "m": "az/native", "prob": 0.37216827, "class": 0 }, { "m": "az/pe", "prob": 0.14003295, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-13T07:38:46Z" }, "path": "fdffdb9d123650db520c7da7ab503cebe8201d6ba3e0f4e908c9f8a25c52db8d.exe", "raw": { "v": "4", "fs": [ { "f": "O(As)H₂(CmPo₂)Md₂(BiSi)", "k": { "hash.imp": "e5c78f14f4bff91fffa21cc37f6d4857", "pe.timestamp": 1604874025, "hash.authenti": "e1a270750992e1da18942e2006dee555202cb777a62588c9cd69db110c501a87", "hash.rich_header": "e99f09c24e0838e4963cb9f78e64a432965e438983f6ab357912493369a5b6d4", "build.target_arch": "x86", "pe.linker_version": "14.0", "pe.resource_types[0]": "RT_MANIFEST", "pe.rich_header.xor_key": "0x56b3678d", "pe.data_directories[0].rva": 195356, "pe.data_directories[1].rva": 229376, "pe.data_directories[2].rva": 233472, "pe.data_directories[3].rva": 193840, "pe.data_directories[4].rva": 155648, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 200, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 480, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 6648, "pe.data_directories[3].name": "load_config", "pe.data_directories[3].size": 64, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 504, "pe.rich_header_compids[0].count": 13, "pe.rich_header_compids[1].count": 170, "pe.rich_header_compids[2].count": 19, "pe.rich_header_compids[3].count": 3, "pe.rich_header_compids[4].count": 17, "pe.rich_header_compids[5].count": 29, "pe.rich_header_compids[6].count": 18, "pe.rich_header_compids[7].count": 19, "pe.rich_header_compids[8].count": 131, "pe.rich_header_compids[9].count": 1, "binary.top_complex_unnamed[0].cc": 253, "binary.top_complex_unnamed[1].cc": 84, "binary.top_complex_unnamed[2].cc": 65, "binary.top_complex_unnamed[3].cc": 60, "binary.top_complex_unnamed[4].cc": 55, "binary.top_complex_unnamed[5].cc": 51, "binary.top_complex_unnamed[6].cc": 50, "binary.top_complex_unnamed[7].cc": 48, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 17000037, "pe.rich_header_compids[10].count": 1, "pe.rich_header_compids[11].count": 1, "pe.rich_header_compids[12].count": 1, "pe.rich_header_compids[1].compid": 17131109, "pe.rich_header_compids[2].compid": 17065573, "pe.rich_header_compids[3].compid": 13082782, "pe.rich_header_compids[4].compid": 16998061, "pe.rich_header_compids[5].compid": 17129133, "pe.rich_header_compids[6].compid": 17063597, "pe.rich_header_compids[7].compid": 16868965, "pe.rich_header_compids[8].compid": 65536, "pe.rich_header_compids[9].compid": 17063605, "binary.top_complex_unnamed[0].bbs": 483, "binary.top_complex_unnamed[1].bbs": 85, "binary.top_complex_unnamed[2].bbs": 80, "binary.top_complex_unnamed[3].bbs": 110, "binary.top_complex_unnamed[4].bbs": 117, "binary.top_complex_unnamed[5].bbs": 76, "binary.top_complex_unnamed[6].bbs": 112, "binary.top_complex_unnamed[7].bbs": 93, "pe.rich_header_compids[10].compid": 16735925, "pe.rich_header_compids[11].compid": 9895936, "pe.rich_header_compids[12].compid": 16932533, "pe.rich_header_compids[8].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x40f13d", "binary.top_complex_unnamed[0].size": 7528, "binary.top_complex_unnamed[1].addr": "0x424990", "binary.top_complex_unnamed[1].size": 1396, "binary.top_complex_unnamed[2].addr": "0x4200b9", "binary.top_complex_unnamed[2].size": 2822, "binary.top_complex_unnamed[3].addr": "0x40d8bb", "binary.top_complex_unnamed[3].size": 1117, "binary.top_complex_unnamed[4].addr": "0x4093b0", "binary.top_complex_unnamed[4].size": 2442, "binary.top_complex_unnamed[5].addr": "0x410f72", "binary.top_complex_unnamed[5].size": 1174, "binary.top_complex_unnamed[6].addr": "0x401520", "binary.top_complex_unnamed[6].size": 3337, "binary.top_complex_unnamed[7].addr": "0x406d30", "binary.top_complex_unnamed[7].size": 2923, "pe.rich_header_compids[11].product": "Unknown", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".gfids", "pe.section_characteristics[4].name": ".rsrc", "pe.section_characteristics[5].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 13, "pe.rich_header.entries[1].use_count": 170, "pe.rich_header.entries[2].use_count": 19, "pe.rich_header.entries[3].use_count": 3, "pe.rich_header.entries[4].use_count": 17, "pe.rich_header.entries[5].use_count": 29, "pe.rich_header.entries[6].use_count": 18, "pe.rich_header.entries[7].use_count": 19, "pe.rich_header.entries[8].use_count": 131, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 259, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[11].use_count": 1, "pe.rich_header.entries[12].use_count": 1, "pe.rich_header.entries[1].product_id": 261, "pe.rich_header.entries[2].product_id": 260, "pe.rich_header.entries[3].product_id": 199, "pe.rich_header.entries[4].product_id": 259, "pe.rich_header.entries[5].product_id": 261, "pe.rich_header.entries[6].product_id": 260, "pe.rich_header.entries[7].product_id": 257, "pe.rich_header.entries[8].product_id": 1, "pe.rich_header.entries[9].product_id": 260, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[10].product_id": 255, "pe.rich_header.entries[11].product_id": 151, "pe.rich_header.entries[12].product_id": 258, "pe.rich_header.entries[0].build_number": 26213, "pe.rich_header.entries[0].product_name": "Cvtres_VS2013", "pe.rich_header.entries[1].build_number": 26213, "pe.rich_header.entries[1].product_name": "Cpp_VS2015", "pe.rich_header.entries[2].build_number": 26213, "pe.rich_header.entries[2].product_name": "C_VS2015", "pe.rich_header.entries[3].build_number": 41118, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 24237, "pe.rich_header.entries[4].product_name": "Cvtres_VS2013", "pe.rich_header.entries[5].build_number": 24237, "pe.rich_header.entries[5].product_name": "Cpp_VS2015", "pe.rich_header.entries[6].build_number": 24237, "pe.rich_header.entries[6].product_name": "C_VS2015", "pe.rich_header.entries[7].build_number": 26213, "pe.rich_header.entries[7].product_name": "Linker_VS2013", "pe.rich_header.entries[8].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[9].build_number": 24245, "pe.rich_header.entries[9].product_name": "C_VS2015", "pe.section_characteristics[0].raw_size": 147968, "pe.section_characteristics[1].raw_size": 43008, "pe.section_characteristics[2].raw_size": 20480, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[4].raw_size": 512, "pe.section_characteristics[5].raw_size": 6656, "pe.rich_header.entries[10].build_number": 24245, "pe.rich_header.entries[10].product_name": "C_VS2013", "pe.rich_header.entries[11].product_name": "unknown", "pe.rich_header.entries[12].build_number": 24245, "pe.rich_header.entries[12].product_name": "Linker_VS2013_LTCG", "pe.section_characteristics[0].virtual_size": 147515, "pe.section_characteristics[1].virtual_size": 42664, "pe.section_characteristics[2].virtual_size": 23272, "pe.section_characteristics[3].virtual_size": 180, "pe.section_characteristics[4].virtual_size": 480, "pe.section_characteristics[5].virtual_size": 6648, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 155648, "pe.section_characteristics[2].virtual_address": 200704, "pe.section_characteristics[3].virtual_address": 225280, "pe.section_characteristics[4].virtual_address": 229376, "pe.section_characteristics[5].virtual_address": 233472, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "42000040" }, "x": 10, "id": 0, "is": [ "WriteConsoleW", "SetEndOfFile", "ReadFile", "HeapSize", "FlushFileBuffers", "ReadConsoleW", "GetConsoleWindow", "SetConsoleCursorPosition", "VirtualProtect", "HeapReAlloc", "GetStdHandle", "ReadConsoleInputW", "SetConsoleMode", "GetConsoleMode", "CreateFileW", "GetProcessHeap", "GetStringTypeW", "SetStdHandle", "SetEnvironmentVariableW", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "WideCharToMultiByte", "MultiByteToWideChar", "GetCPInfo", "GetOEMCP", "GetACP", "IsValidCodePage", "FindNextFileW", "FindFirstFileExW", "FindClose", "DecodePointer", "GetFileAttributesExW", "CreateProcessW", "GetExitCodeProcess", "WaitForSingleObject", "SetFilePointerEx", "GetFileSizeEx", "CloseHandle", "GetFileType", "QueryPerformanceCounter", "GetCurrentProcessId", "GetCurrentThreadId", "GetSystemTimeAsFileTime", "InitializeSListHead", "IsDebuggerPresent", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetStartupInfoW", "IsProcessorFeaturePresent", "GetModuleHandleW", "GetCurrentProcess", "TerminateProcess", "RtlUnwind", "GetLastError", "SetLastError", "EnterCriticalSection", "LeaveCriticalSection", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "FreeLibrary", "GetProcAddress", "LoadLibraryExW", "ExitProcess", "GetModuleHandleExW", "GetLocalTime", "WriteFile", "GetModuleFileNameW", "GetCommandLineA", "GetCommandLineW", "GetConsoleCP", "HeapFree", "HeapAlloc", "CompareStringW", "LCMapStringW", "RaiseException", "AddPortA", "AdvancedDocumentPropertiesA", "XcvDataW", "PrinterMessageBoxW", "EnumPrinterKeyA", "EnumPortsW", "DeletePrinter", "GetPath", "GetCharWidthA", "EnumICMProfilesA", "OffsetClipRgn", "RouterLogEventDataW", "TraceDeregisterA", "RouterAssert", "TraceRegisterExA", "LogEventW", "RouterLogDeregisterW", "TraceDeregisterExW", "TraceGetConsoleA", "LoadPerfCounterTextStringsW", "UnloadPerfCounterTextStringsW", "LoadPerfCounterTextStringsA", "SelectCMM", "GetStandardColorSpaceProfileW", "GetPS2ColorRenderingIntent", "EnumColorProfilesW", "EnumProtocolsW", "AcceptEx", "s_perror", "GetAcceptExSockaddrs", "PostODBCError", "ORDINAL 35", "ValidateErrorQueue", "ORDINAL 42", "ORDINAL 49", "GetDC", "GrayStringA", "SetWindowPos" ], "ms": { "pe": { "entry": 43466.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 512.0, "subsystem": 3.0, "timestamp": 1604874025.0, "image_base": 4194304.0, "has_manifest": true, "rsrc_entropy": 4.71, "entry_section": ".text", "size_of_image": 241664.0, "cfg_func_count": 256.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_MANIFEST" ], "characteristics": 258.0, "has_rich_header": true, "overlay_padding": 48128.0, "size_of_headers": 1024.0, "export_timestamp": 0.0, "import_dll_count": 9.0, "se_handler_count": 4350456.0, "computed_checksum": 291976.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 33088.0, "has_export_timestamp": false, "linker_major_version": 14.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "api_hashing_indicator_count": 1.0 }, "file": { "size": 268288.0 }, "binary": { "code_size": 147968.0, "func_count": 371.0, "has_overlay": true, "code_entropy": 6.68, "data_entropy": 6.29, "func_density": 2.57, "import_count": 117.0, "overlay_size": 48128.0, "string_count": 586.0, "avg_func_size": 266.7, "overlay_ratio": 0.18, "section_count": 6.0, "avg_complexity": 8.54, "import_density": 0.81, "max_complexity": 253.0, "string_density": 4.06, "overall_entropy": 5.26, "overlay_entropy": 8.0, "avg_basic_blocks": 14.5, "avg_section_size": 36522.67, "dependency_count": 9.0, "entropy_variance": 2.07, "avg_string_length": 16.72, "complexity_per_kb": 0.06, "max_string_length": 94.0, "wide_string_count": 71.0, "avg_string_entropy": 3.0, "code_to_data_ratio": 2.08, "data_to_file_ratio": 0.08, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.55, "total_basic_blocks": 5378.0, "func_analysis_depth": 2.0, "string_length_stddev": 13.68, "largest_section_ratio": 0.55, "sentence_string_count": 141.0, "sentence_string_ratio": 0.24, "writable_section_count": 1.0, "behavioral_import_ratio": 0.03, "executable_section_count": 1.0, "high_entropy_string_count": 2.0, "nonstandard_section_count": 1.0, "high_complexity_func_count": 6.0, "unnamed_complex_func_count": 6.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 223, "V89LV" ], [ 528, ".text" ], [ 607, "@.data" ], [ 648, ".gfids" ], [ 687, "@.rsrc" ], [ 727, "@.reloc" ], [ 24536, "wide", "Bjjjjj" ], [ 42041, "Genu" ], [ 42059, "5ntel" ], [ 45081, "UQPXY]Y[" ], [ 48016, "RZUT]QSVW" ], [ 48216, "F1VYP" ], [ 49048, "QQSV" ], [ 50239, "F8SP" ], [ 50315, "RZUT]QSVQ^W" ], [ 57750, "WXVZ" ], [ 58188, "PVWS" ], [ 58712, "SV8A" ], [ 66127, "PVRQ" ], [ 66236, "WZ8P" ], [ 66362, "PSRW" ], [ 68259, "RPVY" ], [ 75713, "VY358dC" ], [ 75897, "QWWP" ], [ 76738, "P_YY" ], [ 76935, "W_SVW" ], [ 77478, "SVWP_" ], [ 83229, "QSVW" ], [ 88484, "S[UT]SV" ], [ 89188, "QQTX" ], [ 92755, "v5j0" ], [ 92941, "SPSVQ" ], [ 94019, "QWPV" ], [ 94424, "W_UT]QQVW" ], [ 97664, "PATH" ], [ 100286, "PSSQ" ], [ 101094, "SSSQ" ], [ 104495, "WSVPP" ], [ 107237, "9E WW" ], [ 111091, "PPPPPWS" ], [ 111150, "QQQP" ], [ 111281, "PP9E u\u003cPPVWP" ], [ 113607, "VWS_" ], [ 116905, "PPPV" ], [ 117084, "DSVW" ], [ 117301, "YT_P" ], [ 118270, "WXWZ" ], [ 125762, "RZUT]QQV3" ], [ 126471, "VPRQ" ], [ 126931, "Systj" ], [ 133735, "WVSY" ], [ 133812, "WSVY" ], [ 134033, "WPSY" ], [ 138157, "WXPVS" ], [ 144343, "RYSZQ[PYVX^" ], [ 148185, "QRXPY" ], [ 149664, "wide", "api-ms-win-core-fibers-l1-1-1" ], [ 149724, "wide", "api-ms-win-core-synch-l1-2-0" ], [ 149784, "wide", "kernel32" ], [ 149812, "FlsAlloc" ], [ 149832, "FlsFree" ], [ 149840, "FlsGetValue" ], [ 149860, "FlsSetValue" ], [ 149880, "InitializeCriticalSectionEx" ], [ 150324, "__cdecl" ], [ 150332, "__pascal" ], [ 150344, "__stdcall" ], [ 150356, "__thiscall" ], [ 150368, "__fastcall" ], [ 150380, "__vectorcall" ], [ 150396, "__clrcall" ], [ 150408, "__eabi" ], [ 150424, "__restrict" ], [ 150436, "__unaligned" ], [ 150448, "restrict(" ], [ 150468, "delete" ], [ 150504, "operator" ], [ 150684, "`local static guard'" ], [ 150720, "`vbase destructor'" ], [ 150740, "`vector deleting destructor'" ], [ 150772, "`default constructor closure'" ], [ 150804, "`scalar deleting destructor'" ], [ 150836, "`vector constructor iterator'" ], [ 150868, "`vector destructor iterator'" ], [ 150900, "`vector vbase constructor iterator'" ], [ 150936, "`virtual displacement map'" ], [ 150964, "`eh vector constructor iterator'" ], [ 151000, "`eh vector destructor iterator'" ], [ 151032, "`eh vector vbase constructor iterator'" ], [ 151072, "`copy constructor closure'" ], [ 151100, "`udt returning'" ], [ 151128, "`local vftable'" ], [ 151144, "`local vftable constructor closure'" ], [ 151188, "delete[]" ], [ 151200, "`omni callsig'" ], [ 151216, "`placement delete closure'" ], [ 151244, "`placement delete[] closure'" ], [ 151276, "`managed vector constructor iterator'" ], [ 151316, "`managed vector destructor iterator'" ], [ 151356, "`eh vector copy constructor iterator'" ], [ 151396, "`eh vector vbase copy constructor iterator'" ], [ 151440, "`dynamic initializer for '" ], [ 151468, "`dynamic atexit destructor for '" ], [ 151504, "`vector copy constructor iterator'" ], [ 151540, "`vector vbase copy constructor iterator'" ], [ 151584, "`managed vector copy constructor iterator'" ], [ 151628, "`local static thread guard'" ], [ 151672, "Type Descriptor'" ], [ 151692, "Base Class Descriptor at (" ], [ 151720, "Base Class Array'" ], [ 151740, "Class Hierarchy Descriptor'" ], [ 151772, "Complete Object Locator'" ], [ 151841, "700WP" ], [ 151857, "`h````" ], [ 151892, "wide", "(null)" ], [ 151908, "(null)" ], [ 154424, "wide", "minkernel\\crts\\ucrt\\inc\\corecrt_internal_strtox.h" ], [ 154528, "wide", "__crt_strtox::floating_point_value::as_double" ], [ 154620, "wide", "_is_double" ], [ 154648, "wide", "__crt_strtox::floating_point_value::as_float" ], [ 154740, "wide", "!_is_double" ], [ 154896, "INITY" ], [ 154904, "inity" ], [ 154944, "wide", "mscoree.dll" ], [ 154968, "CorExitProcess" ], [ 154984, "COMSPEC" ], [ 154992, "cmd.exe" ], [ 156758, "wide", "Bapi-ms-win-core-datetime-l1-1-1" ], [ 156824, "wide", "api-ms-win-core-file-l1-2-2" ], [ 156880, "wide", "api-ms-win-core-localization-l1-2-1" ], [ 156952, "wide", "api-ms-win-core-localization-obsolete-l1-2-0" ], [ 157048, "wide", "api-ms-win-core-processthreads-l1-1-2" ], [ 157124, "wide", "api-ms-win-core-string-l1-1-0" ], [ 157184, "wide", "api-ms-win-core-sysinfo-l1-2-1" ], [ 157248, "wide", "api-ms-win-core-winrt-l1-1-0" ], [ 157308, "wide", "api-ms-win-core-xstate-l2-1-0" ], [ 157368, "wide", "api-ms-win-rtcore-ntuser-window-l1-1-0" ], [ 157448, "wide", "api-ms-win-security-systemfunctions-l1-1-0" ], [ 157536, "wide", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], [ 157608, "wide", "ext-ms-win-ntuser-windowstation-l1-1-0" ], [ 157704, "wide", "api-ms-win-appmodel-runtime-l1-1-2" ], [ 157776, "wide", "user32" ], [ 157792, "wide", "api-ms-" ], [ 157808, "wide", "ext-ms-" ], [ 157828, "AreFileApisANSI" ], [ 157852, "CompareStringEx" ], [ 157916, "LCMapStringEx" ], [ 157940, "LocaleNameToLCID" ], [ 157964, "AppPolicyGetProcessTerminationMethod" ], [ 158016, "UTF-16LEUNICODE" ], [ 158048, "NAN(SNAN)" ], [ 158060, "nan(snan)" ], [ 158072, "NAN(IND)" ], [ 158084, "nan(ind)" ], [ 158488, "Sunday" ], [ 158496, "Monday" ], [ 158504, "Tuesday" ], [ 158512, "Wednesday" ], [ 158524, "Thursday" ], [ 158536, "Friday" ], [ 158544, "Saturday" ], [ 158604, "January" ], [ 158612, "February" ], [ 158624, "March" ], [ 158632, "April" ], [ 158640, "June" ], [ 158648, "July" ], [ 158656, "August" ], [ 158664, "September" ], [ 158676, "October" ], [ 158684, "November" ], [ 158696, "December" ], [ 158716, "MM/dd/yy" ], [ 158728, "dddd, MMMM dd, yyyy" ], [ 158816, "wide", "Sunday" ], [ 158832, "wide", "Monday" ], [ 158848, "wide", "Tuesday" ], [ 158864, "wide", "Wednesday" ], [ 158884, "wide", "Thursday" ], [ 158904, "wide", "Friday" ], [ 158920, "wide", "Saturday" ], [ 159036, "wide", "January" ], [ 159052, "wide", "February" ], [ 159072, "wide", "March" ], [ 159084, "wide", "April" ], [ 159096, "wide", "June" ], [ 159108, "wide", "July" ], [ 159120, "wide", "August" ], [ 159136, "wide", "September" ], [ 159156, "wide", "October" ], [ 159172, "wide", "November" ], [ 159192, "wide", "December" ], [ 159228, "wide", "MM/dd/yy" ], [ 159248, "wide", "dddd, MMMM dd, yyyy" ], [ 160248, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 160632, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 160860, ".com" ], [ 160865, ".exe" ], [ 160870, ".bat" ], [ 160875, ".cmd" ], [ 160884, "log10" ], [ 160900, "asin" ], [ 160908, "acos" ], [ 166113, "160.134.63.204:5352" ], [ 169637, "184.85.116.130:16269" ], [ 171442, "21.191.18.231:55615" ], [ 173871, "\u003cV/\u003e" ], [ 181924, "wide", "az-az-cyrl" ], [ 181948, "wide", "az-az-latn" ], [ 182008, "wide", "bs-ba-latn" ], [ 182140, "wide", "div-mv" ], [ 182876, "wide", "kok-in" ], [ 183144, "wide", "quz-bo" ], [ 183160, "wide", "quz-ec" ], [ 183176, "wide", "quz-pe" ], [ 183288, "wide", "sma-no" ], [ 183304, "wide", "sma-se" ], [ 183320, "wide", "smj-no" ], [ 183336, "wide", "smj-se" ], [ 183352, "wide", "smn-fi" ], [ 183368, "wide", "sms-fi" ], [ 183396, "wide", "sr-ba-cyrl" ], [ 183420, "wide", "sr-ba-latn" ], [ 183444, "wide", "sr-sp-cyrl" ], [ 183468, "wide", "sr-sp-latn" ], [ 183528, "wide", "syr-sy" ], [ 183640, "wide", "uz-uz-cyrl" ], [ 183664, "wide", "uz-uz-latn" ], [ 183712, "wide", "zh-chs" ], [ 183728, "wide", "zh-cht" ], [ 184960, "atan" ], [ 184968, "atan2" ], [ 184988, "ceil" ], [ 184996, "floor" ], [ 185036, "_hypot" ], [ 185080, "_nextafter" ], [ 189406, "GetStdHandle" ], [ 189422, "VirtualProtect" ], [ 189440, "SetConsoleCursorPosition" ], [ 189468, "GetConsoleWindow" ], [ 189486, "KERNEL32.dll" ], [ 189514, "DeletePrinter" ], [ 189530, "EnumPortsW" ], [ 189544, "EnumPrinterKeyA" ], [ 189562, "PrinterMessageBoxW" ], [ 189596, "AdvancedDocumentPropertiesA" ], [ 189624, "WINSPOOL.DRV" ], [ 189640, "EnumICMProfilesA" ], [ 189660, "GetCharWidthA" ], [ 189676, "GetPath" ], [ 189686, "OffsetClipRgn" ], [ 189700, "GDI32.dll" ], [ 189712, "RouterLogEventDataW" ], [ 189734, "TraceDeregisterA" ], [ 189754, "RouterAssert" ] ], "sz": 268288, "ts": [ { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 117.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "d": ".bat extension reference", "e": [ ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-file-l1-2-2", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-processthreads-l1-1-2" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1604874025.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.68)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "fdffdb9d123650db520c7da7ab503cebe8201d6ba3e0f4e908c9f8a25c52db8d.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 5378.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "UnloadPerfCounterTextStringsW", "LoadPerfCounterTextStringsA", "CompareStringW", "FreeEnvironmentStringsW", "GetStringTypeW", "LCMapStringEx", "CompareStringEx", "LCMapStringW", "LoadPerfCounterTextStringsW", "GetEnvironmentStringsW", "api-ms-win-core-string-l1-1-0", "GrayStringA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8500000238418579, "d": "Windows spooler library dependency", "e": [ "WINSPOOL.DRV" ], "i": "micro-behaviors/os/service/export::winspool-drv-dependency", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.68" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 5.82)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1604874025.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.00" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "Admin", "ADMIN" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "d": "password keyword", "e": [ "Invalid User name or Password!", "3. Edit User name / Password", "Confirm NEW Password :", "Only THREE attempts shall be allowed to enter username and password.", "Confirm Password :", "Cannot find the given combination of USER NAME and PASSWORD!", "Password and confirm password does not match!", "Password :", "Are you sure you want to CHANGE user name and/or password? \u003cY/N\u003e :", "Password :", "NEW Password :", "Password :" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 117.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "a0 60 42 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-windowstation-l1-1-0", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 586.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 241664.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 371.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 117.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage/control::set-window-pos", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 117.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 117.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "fdffdb9d123650db520c7da7ab503cebe8201d6ba3e0f4e908c9f8a25c52db8d.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.26" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "SelectCMM import (decoy triad)", "e": [ "SelectCMM" ], "i": "objectives/anti-static/obfuscation/imports::selectcmm-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "46", "41" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 117.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.800000011920929, "d": "Accesses ComSpec environment variable", "e": [ "COMSPEC" ], "i": "micro-behaviors/os/env/vars/access::comspec-env-var", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 371.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 117.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 0.8600000143051147, "d": "PE has medium sized overlay", "e": [ "binary.overlay_size = 48128.00" ], "i": "metadata/binary/section/metrics::medium-overlay-pe", "l": 1 }, { "d": "PATH environment variable", "e": [ "PATH" ], "i": "micro-behaviors/os/env/vars/access::path-var", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-file-l1-2-2", "Bapi-ms-win-core-datetime-l1-1-1", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-", "api-ms-win-core-string-l1-1-0", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-winrt-l1-1-0" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.800000011920929, "d": "Query file attributes and timestamps", "e": [ "GetFileAttributesExW" ], "i": "micro-behaviors/fs/file/timestamp::get-file-attributes-ex", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 371.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.00" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.54" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.800000011920929, "d": "cmd.exe command interpreter reference", "e": [ "cmd.exe" ], "i": "micro-behaviors/process/create/exec::cmd-exe-reference", "l": 3 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "DarkGate C2 record with embedded key anchor", "e": [ "8bunz8" ], "i": "well-known/malware/trojan/darkgate::c2-record-key-anchor", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 117.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 3 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 512.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.24" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "160.134.63.204:5352", "184.85.116.130:16269", "21.191.18.231:55615" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "fdffdb9d123650db520c7da7ab503cebe8201d6ba3e0f4e908c9f8a25c52db8d.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "High entropy .data section", "e": [ ".data (size: 20480, entropy: 6.75)" ], "i": "objectives/anti-static/obfuscation/payload/section::high-entropy-dot-data-section", "l": 3, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "21.191.18.231:55615", "160.134.63.204:5352", "184.85.116.130:16269" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-rdata-pair", "l": 3 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "e8 60 42 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "160.134.63.204:5352", "184.85.116.130:16269", "21.191.18.231:55615" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "LoadPerfCounterTextStringsW", "GetStandardColorSpaceProfileW", "GetAcceptExSockaddrs", "EnumColorProfilesW", "AdvancedDocumentPropertiesA", "LoadPerfCounterTextStringsA", "InitializeSListHead", "RouterLogDeregisterW", "GetCurrentProcessId", "AppPolicyGetProcessTerminationMethod", "RouterLogEventDataW", "GetSystemTimeAsFileTime", "UnhandledExceptionFilter", "InitializeCriticalSectionEx", "SetConsoleCursorPosition", "UnloadPerfCounterTextStringsW" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 371.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "c": 0.9300000071525574, "d": "External IPv4:port literal in rdata", "e": [ "160.134.63.204:5352", "184.85.116.130:16269", "21.191.18.231:55615" ], "i": "objectives/command-and-control/infrastructure/ip-port::external-ipv4-port-rdata-large", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 48128.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.949999988079071, "d": "links WINSPOOL.DRV (AddPortA, AdvancedDocumentPropertiesA, XcvDataW, PrinterMessageBoxW, EnumPrinterKeyA, ... +2 more)", "e": [ "WINSPOOL.DRV" ], "i": "metadata/dylib::winspool/drv", "l": 2 }, { "c": 0.949999988079071, "d": "links ODBC32.dll (PostODBCError, ORDINAL 35, ValidateErrorQueue, ORDINAL 42, ORDINAL 49)", "e": [ "ODBC32.dll" ], "i": "metadata/dylib::odbc32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDC, GrayStringA, SetWindowPos)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (WriteConsoleW, SetEndOfFile, ReadFile, HeapSize, FlushFileBuffers, ... +74 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links loadperf.dll (LoadPerfCounterTextStringsW, UnloadPerfCounterTextStringsW, LoadPerfCounterTextStringsA)", "e": [ "loadperf.dll" ], "i": "metadata/dylib::loadperf/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links mscms.dll (SelectCMM, GetStandardColorSpaceProfileW, GetPS2ColorRenderingIntent, EnumColorProfilesW)", "e": [ "mscms.dll" ], "i": "metadata/dylib::mscms/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSWSOCK.dll (EnumProtocolsW, AcceptEx, s_perror, GetAcceptExSockaddrs)", "e": [ "MSWSOCK.dll" ], "i": "metadata/dylib::mswsock/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetPath, GetCharWidthA, EnumICMProfilesA, OffsetClipRgn)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links rtutils.dll (RouterLogEventDataW, TraceDeregisterA, RouterAssert, TraceRegisterExA, LogEventW, ... +3 more)", "e": [ "rtutils.dll" ], "i": "metadata/dylib::rtutils/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 117.00", "pe.has_rich_header = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "fdffdb9d123650db520c7da7ab503cebe8201d6ba3e0f4e908c9f8a25c52db8d", "path": "fdffdb9d123650db520c7da7ab503cebe8201d6ba3e0f4e908c9f8a25c52db8d.exe", "type": "pe" } ], "tv": "92e78" } }