List of anomalies

This help page describes all anomalies currently implemented inside Malcat’s Anomaly scanner.

Note

This list has been automatically generated on 2024-04-18 07:32:55.

Headers

DemoAce

level:

WARN

category:

headers

filetype:

ACE

architecture:

defined in:

data\anomalies\ACE.py

Packed using a demo version of the ACE compressor

DeletedDirectoryEntry

level:

ODD

category:

headers

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

a non-final direcotry entry is unallocated

NonAsciiDirectoryName

level:

WARN

category:

headers

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

the name of a dirctory entry is not ascii

CLRDuplicatedStream

level:

ERROR

category:

headers

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

Stream name is not unique (confuser)

CLRMetadataHeaderExtraDword

level:

ERROR

category:

headers

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

Extra dword present in #~ header (confuser)

UnusualMetadataTable

level:

ERROR

category:

headers

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

Obsolete metadata table name has been found

UnusualStreamName

level:

ERROR

category:

headers

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

Stream with unusual name has been found

OddSize

level:

ODD

category:

headers

filetype:

architecture:

defined in:

data\anomalies\images.py

Width or height of image is odd

EncryptedFiles

level:

WARN

category:

headers

filetype:

InnoSetup

architecture:

defined in:

data\anomalies\INNO.py

Some files in the archives are password encrypted

PasswordInScript

level:

ERROR

category:

headers

filetype:

InnoSetup

architecture:

defined in:

data\anomalies\INNO.py

Some files in the archives are password encrypted and the password was found inside the install script

Hidden

level:

WARN

category:

headers

filetype:

LNK

architecture:

defined in:

data\anomalies\LNK.py

Command window is hidden at startup

TargetChanged

level:

ERROR

category:

headers

filetype:

LNK

architecture:

defined in:

data\anomalies\LNK.py

The target specified in the property store is not the same as the current lnk target. It was most likely changed after .lnk creation

ObjectStream

level:

ODD

category:

headers

filetype:

PDF

architecture:

defined in:

data\anomalies\PDF.py

A stream containing PDF objects. It is a standard PDF feature, but it could hide objects from static signatures. You should unpack this stream.

DataBetweenHeaderAndFirstSection

level:

WARN

category:

headers

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

There is non-zero data between the PE header and the first section

EmptyDebugPath

level:

ERROR

category:

headers

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

debug path is empty (most likely tampered)

GuiSubsystemNoWindowApi

level:

ODD

category:

headers

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

A GUI windows application does not import any user32 window-related function

PeHeaderAfterFirstSection

level:

WARN

category:

headers

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

The PE header structure is located after the first section’s physical address

SectionTableAfterFirstSection

level:

WARN

category:

headers

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

The section table is located after the first section’s physical address

WeirdDebugInfoType

level:

WARN

category:

headers

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

the Debug infos are not in the usual format

WeirdNumberOfRvaAndSizes

level:

ERROR

category:

headers

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

the field NumberOfRvaAndSizes has a weird value

HasHiddenSheet

level:

ERROR

category:

headers

filetype:

Office.Workbook8

architecture:

defined in:

data\anomalies\Workbook8.py

Excel document contains a hidden or very hidden sheet

LocalFileAndCentralDirectoryFieldDifferent

level:

ERROR

category:

headers

filetype:

ZIP

architecture:

defined in:

data\anomalies\ZIP.py

A local file header field is different than the corresponding central directory field

UnknownCompressionMethod

level:

ERROR

category:

headers

filetype:

ZIP

architecture:

defined in:

data\anomalies\ZIP.py

Compression method of one entry is unknown (sometimes used in malicious APK to evade detection)

UnknownPkzipVersion

level:

ODD

category:

headers

filetype:

ZIP

architecture:

defined in:

data\anomalies\ZIP.py

File version is zero

ZipBomb

level:

ERROR

category:

headers

filetype:

ZIP

architecture:

defined in:

data\anomalies\ZIP.py

Compression ratio > 10000% and final size > 100MB for a file

Embedding

ExeInAce

level:

ERROR

category:

embedding

filetype:

ACE

architecture:

defined in:

data\anomalies\ACE.py

ACE is an outdated compression format. An archive containing executables is most likely malware

OleNative

level:

ERROR

category:

embedding

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

file embedds an OLE object

HasOverlay

level:

ERROR

category:

embedding

filetype:

LNK

architecture:

defined in:

data\anomalies\LNK.py

Shortcut has overlay

EmbeddedFileNonPicture

level:

ERROR

category:

embedding

filetype:

ONE

architecture:

defined in:

data\anomalies\ONE.py

OneNote document embeds a file which is not a recognized picture

EmbeddedFile

level:

ERROR

category:

embedding

filetype:

PDF

architecture:

defined in:

data\anomalies\subobjects.py

Pdf file contains a fils as attachment

EmbeddedProgram

level:

WARN

category:

embedding

filetype:

architecture:

defined in:

data\anomalies\subobjects.py

File embeds a program

WayMorePicturesThanWordText

level:

TRACE

category:

embedding

filetype:

Office.Word

architecture:

defined in:

data\anomalies\subobjects.py

The ratio text size/pictures size < 0.1

VBFormMostlyPicture

level:

ERROR

category:

embedding

filetype:

PE

architecture:

PCODE

defined in:

data\anomalies\vb.py

a VB form is composed mostly of a single 10KB+ picture. Some obfuscators put the payload inside form pictures

Time

DirectoryTimeStampInTheFuture

level:

ERROR

category:

time

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

Directory Timestamp is in the future

DebugTimeDateStampInTheFuture

level:

ERROR

category:

time

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Debug TimeDateStamp is in the future

DebugTimeDifferentThanTimeDateStamp

level:

WARN

category:

time

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Difference between PE TimeDateStamp and Debug TimeDateStamp is bigger than 1 year (and both are sets)

ExportTimeDateStampInTheFuture

level:

ERROR

category:

time

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Export TimeDateStamp is in the future

ExportTimeDifferentThanTimeDateStamp

level:

ODD

category:

time

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Difference between PE TimeDateStamp and export TimeDateStamp is bigger than 10 minutes (and both are sets)

TimeDateStampInTheFuture

level:

ERROR

category:

time

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

PE TimeDateStamp is in the future

TimeDateStampZero

level:

TRACE

category:

time

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

PE TimeDateStamp is not set

FileTimeIsZero

level:

TRACE

category:

time

filetype:

ZIP

architecture:

defined in:

data\anomalies\ZIP.py

a file/central directory time is zero

Code

EmptyVbaProjectStream

level:

ERROR

category:

code

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

The _VBAPROJECT stream is empty, a sign of VBA Purging

HasVisualBasicProject

level:

ERROR

category:

code

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

Document contains a visual basic project

VbaModuleWithoutPerformanceCache

level:

ERROR

category:

code

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

The size of the performance cache of a VBA module is zero, a sign of VBA Purging

CrossSectionJump

level:

ERROR

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

Control flow jumps across section, could be a packed file, a patched file or a file infector

EntryPointInNonExecRegion

level:

ERROR

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

EntryPoint symbol is set and points to a non-executable region

HighXrefLoopingFunction

level:

TRACE

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

Function contains a loop and has a lot of incoming references (string decryption candidate)

HugeFunctionGapAtSectionBoundary

level:

ODD

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

There is a huge gap between start/end of executable section and first/last function of a section with medium-to-high entropy (which is not a know structure). It often means that data is stored there

HugeGapBetweenFunctions

level:

ODD

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

There is a huge gap between two functions with medium-to-high entropy, often means that data is stored there

ManyHighValueImmediates

level:

WARN

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

Function contains at least 5 and more than 10% of high-value immediate operands (i.e. immediate values that contains at least 2 non-zero non-FF bytes and are not a valid address)

ManyUniqueImmediateBytes

level:

WARN

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

More than 48 unique bytes defined across all immediate operands in the function

NonAsciiFunctionName

level:

WARN

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

function with non-ascii names, used by some packers

SequentialFunction

level:

TRACE

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

function with very little intra jumps and calls, usually a crypto function, unrolled loops or data initialisation

SpaghettiFunction

level:

TRACE

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

Function with lots of intra jumps, could be obfuscated

StackArrayInitialisationX64

level:

WARN

category:

code

filetype:

architecture:

X64

defined in:

data\anomalies\code.py

An array of data is dynamically built on the stack, sometimes used to build shellcodes or strings

StackArrayInitialisationX86

level:

WARN

category:

code

filetype:

architecture:

X86

defined in:

data\anomalies\code.py

An array of data is dynamically built on the stack, sometimes used to build shellcodes or strings

XorInLoop

level:

WARN

category:

code

filetype:

architecture:

defined in:

data\anomalies\code.py

XOR instruction in a loop

DangerousProgram

level:

WARN

category:

code

filetype:

LNK

architecture:

defined in:

data\anomalies\LNK.py

Shortcuts points to a dangerous program

ContainsJavascript

level:

ERROR

category:

code

filetype:

PDF

architecture:

defined in:

data\anomalies\PDF.py

PDF file contains javascript code.

HiddenOpenAction

level:

ERROR

category:

code

filetype:

PDF

architecture:

defined in:

data\anomalies\PDF.py

PDF file defines an action to be executed when document is opened, and action object is not visible (most likely hidden in an ObjStm)

OpenAction

level:

ODD

category:

code

filetype:

PDF

architecture:

defined in:

data\anomalies\PDF.py

PDF file defines an action to be executed when document is opened.

AutoExecLabel

level:

ERROR

category:

code

filetype:

Office.Workbook8

architecture:

defined in:

data\anomalies\Workbook8.py

Contains a macro which will be executed automatically

HasFormula

level:

WARN

category:

code

filetype:

Office.Workbook8

architecture:

defined in:

data\anomalies\Workbook8.py

Excel documents contains macros

HugeFormula

level:

WARN

category:

code

filetype:

Office.Workbook8

architecture:

defined in:

data\anomalies\Workbook8.py

Excel document contains a large and complex macro

Cryptography

EncryptedRegion

level:

WARN

category:

cryptography

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

File is encrypted

EncryptedWorkbook

level:

WARN

category:

cryptography

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

Workbook is encrypted

Exploit

VulnerableFileType

level:

ERROR

category:

exploit

filetype:

CFB

architecture:

defined in:

data\anomalies\CFB.py

File type is know to be exploited in the wild

Resources

BigStaticArray

level:

ERROR

category:

resources

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

A big static array was found. Static fields are often used to store the packed paylod in obfuscated malware

ExtraSpaceAfterResourcesDataDirectory

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

extra physical data in rsrc section after resource directory data

ExtraSpaceBeforeResourcesDataDirectory

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

extra physical data in rsrc section before resource directory data

InvalidVersionInfoKey

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

A version information key is wrong

PictureResourceWrongType

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

A ICO/BMP/PNG/JPEG resource entry does not contain a valid image file (or only partially)

RcdataNoDelphi

level:

ODD

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

File contains a rcdata resource and is not a delphi application

ResourceDirectoryGap

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

There is a space (bigger than 15 bytes) inside the resource directory region which is not occupied by a resource

UnknownResourceLanguage

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

A resource language is not standard

UnknownRootResourceDirectoryId

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

A root resource directory ID is not standard

UnparsedVersionInfo

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Version informations were not fully parsed

UnsupportedFixedVersionValue

level:

ERROR

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

A field in fixed version info has an unkown/unsupported value, may indicate version info tampering

BigResourceHighEntropy

level:

ODD

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\resources.py

File contain a big resource (> 10% of the file or > 3K) high-entropy resource and is not a picture

HugeResource

level:

TRACE

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\resources.py

More than 33% of the file is composed of non-zero-entropy 10kb+ resource

NonAsciiResourceName

level:

WARN

category:

resources

filetype:

PE

architecture:

defined in:

data\anomalies\resources.py

File contains resources with non-ascii names, used by some packers

Imports

DynamicAssemblyLoadingApi

level:

WARN

category:

imports

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

Extra dword present in #~ header (confuser)

ExternalModule

level:

WARN

category:

imports

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

Assembly uses external modules

NativeMethods

level:

WARN

category:

imports

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

Assembly imports native methods

DownloaderPlugin

level:

WARN

category:

imports

filetype:

InnoSetup

architecture:

defined in:

data\anomalies\INNO.py

The installer includes idp.dll, which is a plugin used to download fiels from internet. Often used by malicious downloaders

BoundImports

level:

ODD

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Bound imports are present

EmptyImportTable

level:

ERROR

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Import Table is empty (no valid thunk)

NoImportTable

level:

ERROR

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

no valid Import Table found

CryptoApiUsage

level:

ODD

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\symbols.py

Crypto-related apis are used

DelayImports

level:

WARN

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\symbols.py

There are delay imports

DotnetCryptoApiUsage

level:

WARN

category:

imports

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\symbols.py

Assembly uses typical method for encrypting/decrypting stuff

DotnetDownloaderApiUsage

level:

WARN

category:

imports

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\symbols.py

Assembly uses typical method for downloading stuff

DotnetDynamicLoadingApiUsage

level:

WARN

category:

imports

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\symbols.py

Assembly uses typical method for dynamic code loading

DownloaderApiUsage

level:

ODD

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\symbols.py

Downloader-related apis are used

ImportByHash

level:

ERROR

category:

imports

filetype:

architecture:

defined in:

data\anomalies\symbols.py

APIs are imported by hash

PossibleDownloaderApiDynamicImport

level:

ERROR

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\symbols.py

A downloader-related api (recv, InternetConnect, etc.) is present as string in the binary, but is not imported

PossiblePackerApiDynamicImport

level:

ERROR

category:

imports

filetype:

PE

architecture:

defined in:

data\anomalies\symbols.py

A packer-related api (VirtualProtect, ResumeThread, etc.) is present as string in the binary, but is not imported

VBExternalApi

level:

WARN

category:

imports

filetype:

PE

architecture:

X86: 1>]

defined in:

data\anomalies\vb.py

VB project uses external Win32 APIs (most likely via DllFunctionCall)

UnreferencedImports

level:

WARN

category:

imports

filetype:

architecture:

defined in:

data\anomalies\xref.py

More than half of the imports are not referenced, it could mean that the APIs are just decoys, or that the file is packed

Strings

NoUserString

level:

ERROR

category:

strings

filetype:

PE

architecture:

DOTNET

defined in:

data\anomalies\dotnet.py

No user string could be found

BigStringHiScore

level:

WARN

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string has more than 256 characters and high interest score

DynamicDllString

level:

ERROR

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string is constructed dynamically and is a windows DLL name, most likely used by some malicious shellcode

DynamicString

level:

WARN

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string is constructed dynamically

FewStrings

level:

ODD

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

file does not have many identified strings (less than 1% of the file is composed of strings)

HugeStringBase64

level:

ERROR

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string has more than 256 characters and base64 encoding

HugeStringBinary

level:

ERROR

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string has more than 1024 characters and binary encoding

HugeStringHexa

level:

ERROR

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string has more than 1024 characters and hexa encoding

ManyBase64Strings

level:

WARN

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

contains many b64 strings

StringBase64

level:

WARN

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string has more than 16 characters is encoded using base64

VeryHugeString

level:

ODD

category:

strings

filetype:

architecture:

defined in:

data\anomalies\strings.py

string has more than 65k characters

Sections

StrippedSections

level:

WARN

category:

sections

filetype:

ELF

architecture:

defined in:

data\anomalies\ELF.py

sections have been stripped

CodeSectionNotExecutable

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

code section is not executable

DllNoRelocation

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

dll has no relocation information

DuplicatedSectionName

level:

ODD

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

section name has already been used before in section table

ExecutableSectionNoCode

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

executable section has the flag code not set

InvalidBaseOfCode

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

at least one code section starts before BaseOfCode, or BaseOfCode is not the start of a code section

InvalidBaseOfData

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

at least one data section starts before BaseOfData, or BaseOfData is not the start of a data section

InvalidSizeOfCode

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

SizeofCode is not the sum of all code sections (raw or virtual)

InvalidSizeOfInitializedData

level:

ODD

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

SizeOfInitializedData is not the sum of all ininitalized data sections (raw or virtual)

InvalidSizeOfUninitializedData

level:

ODD

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

SizeOfUninitializedData is not the sum of all uninitalized data sections (raw or virtual)

LotsOfSections

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

more than 96 sections (Windows XP’s maximum) in PE

PointerToRawDataNotAligned

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

PointerToRawData is not aligned to FileAlignment

PurelyPhysicalSection

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

a section is physical-only and will thus not be mapped in memory

PurelyVirtualExecutableSection

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

a section is virtual-only and executable (packer?)

RelocSectionNoRelocation

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

.reloc section does not contains relocations

RelocationsNotInRelocSection

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

relocations are not in .reloc

SectionEmptyName

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

section name is null

SectionGap

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

there is a physical gap between two sections

SectionMostlyVirtual

level:

ODD

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

section is composed of mostly virtual space

SectionNameUnknown

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

section name is not one of the typical PE section name

SectionReservedCharacteritics

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

reserved flags are set in the section characteristic

SectionWX

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

section is executable and writeable

SectionWeirdRights

level:

WARN

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

sections has a standard name but the sections rights are not the usual ones (like .text not having +X”)

SizeOfRawDataNotAligned

level:

ERROR

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

SizeOfRawData is not aligned to FileAlignment

UnbalancedVirtualPhysicalRatio

level:

TRACE

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

huge difference between the physical and virtual size of a section

WeirdFileAlignment

level:

ODD

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

FileAlignment is not 512 nor 4096

WeirdSectionAlignment

level:

ODD

category:

sections

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

SectionAlignment is not 4096 nor 8192

Debug

GoNoPclnTable

level:

ERROR

category:

debug

filetype:

PE

architecture:

defined in:

data\anomalies\golang.py

File is a golang executable but no golang pcln table could be found (maybe stripped / modified)

Metadata

CreatedInsideVirtualMachine

level:

WARN

category:

metadata

filetype:

LNK

architecture:

defined in:

data\anomalies\LNK.py

According to tracker data, the .lnk file was generated inside a VM

Entropy

BssNonEmpty

level:

WARN

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\misc.py

Bss Region/section is not empty

HighEntropy

level:

ODD

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\misc.py

File has high entropy overall (> 200)

PumpedOverlay

level:

ERROR

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\misc.py

Overlay is huge and of low entropy

RegionHighEntropy

level:

TRACE

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\misc.py

Region/section has high entropy overall (> 200)

UnknownOverlayMediumToHighEntropy

level:

WARN

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\misc.py

File contains an overlay which is not of known type and has medium-to-high entropy

BmpHighEntropy

level:

ERROR

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\subobjects.py

More than 10% of the file is composed of a high-entropy picture

SingleBigPictureHighEntropy

level:

ODD

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\subobjects.py

More than 10% of the file is composed of a high-entropy picture

BigBufferNoXrefMediumToHighEntropy

level:

WARN

category:

entropy

filetype:

architecture:

defined in:

data\anomalies\xref.py

a medium-to-high-entropy 10KB+ buffer, which is not part of a known structure and has no cross-reference inside: most likely a big crypto data block. File must have at least one function for this anomaly to run

BloatedExecutableFile

level:

WARN

category:

entropy

filetype:

ZIP

architecture:

defined in:

data\anomalies\ZIP.py

ZIP file contains an executable which has a huge compression ratio > 20x (most likely to abuse sandbox upload size limit)

Packers

MultiplePackers

level:

ERROR

category:

packers

filetype:

architecture:

defined in:

data\anomalies\misc.py

File is packed using multiple packers, very suspicious

Packed

level:

ODD

category:

packers

filetype:

architecture:

defined in:

data\anomalies\misc.py

File is packed using a legit or less-legit obfuscator

Exports

DllNoExportTable

level:

ERROR

category:

exports

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

no valid ExportDirectory found and PE is a DLL

EmptyExportTable

level:

ERROR

category:

exports

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Export Table is empty (no valid export but ExportDirectory found)

Integrity

InvalidChecksum

level:

ERROR

category:

integrity

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

PE Header checksum is wrong

NoChecksum

level:

TRACE

category:

integrity

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

PE Header checksum is not set

NoValidCertificate

level:

ERROR

category:

integrity

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Certificate data directory does not point to a valid certificate (maybe corrupted ?)

TruncatedFile

level:

ERROR

category:

integrity

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

some or all section bytes are not present on disk (Windows may not load it)

UnsignedMicrosoft

level:

ERROR

category:

integrity

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Version information tells us it is a microsoft file but no certificate has been found

Rich

RichExportNoExportTable

level:

WARN

category:

rich

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

export entry in rich header but no export table present

RichMultipleLinkers

level:

WARN

category:

rich

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

multiple linker entries in rich header

RichUnknownTool

level:

ODD

category:

rich

filetype:

PE

architecture:

defined in:

data\anomalies\PE.py

Tool entry is not known (either a new version or has been patched)