MalFe

Please wait ...

Public Datasets

API Temporal Interval Rows: 3083 | Cols: 284 | Reports Used: 3084

Description: Gets running total of the time interval for each API call types for each sample

Dataset SHA256: b992f317ac8315c02511c4e00f5f85a3c857a8d0d2001c1cf756433eaac06969

Features (sample):

Ransomware(2512), Development(20), Education(9), Games(52), Graphics(55), Internet(83), Music / Video(47), Office(54), Security(30), Utilities(222)

	Sample Name	category	label	SetErrorModeTemporalInterval	OleInitializeTemporalInterval	LdrGetDllHandleTemporalInterval	LdrLoadDllTemporalInterval	LdrGetProcedureAddressTemporalInterval	NtOpenSectionTemporalInterval	NtMapViewOfSectionTemporalInterval	RegOpenKeyExWTemporalInterval	RegQueryValueExWTemporalInterval	RegCloseKeyTemporalInterval	NtCloseTemporalInterval	NtOpenKeyTemporalInterval	NtQueryValueKeyTemporalInterval	GetSystemWindowsDirectoryWTemporalInterval	NtCreateFileTemporalInterval	NtCreateSectionTemporalInterval	RegOpenKeyExATemporalInterval	CreateActCtxWTemporalInterval	GetSystemDirectoryWTemporalInterval	GetVolumeNameForVolumeMountPointWTemporalInterval	NtDuplicateObjectTemporalInterval	LoadStringWTemporalInterval	NtCreateMutantTemporalInterval	GetNativeSystemInfoTemporalInterval	RegEnumKeyWTemporalInterval	NtQuerySystemInformationTemporalInterval	RegQueryValueExATemporalInterval	NtQueryDirectoryFileTemporalInterval	GlobalMemoryStatusExTemporalInterval	CoCreateInstanceTemporalInterval	NtAllocateVirtualMemoryTemporalInterval	CreateDirectoryWTemporalInterval	DeleteFileWTemporalInterval	GetFileSizeExTemporalInterval	NtReadFileTemporalInterval	GetFileInformationByHandleExTemporalInterval	GetSystemTimeAsFileTimeTemporalInterval	GetVolumePathNamesForVolumeNameWTemporalInterval	LdrUnloadDllTemporalInterval	CoInitializeExTemporalInterval	NtOpenProcessTemporalInterval	CoUninitializeTemporalInterval	NtFreeVirtualMemoryTemporalInterval	NtOpenFileTemporalInterval	NtQueryInformationFileTemporalInterval	GetFileAttributesWTemporalInterval	FindFirstFileExWTemporalInterval	NtQueryAttributesFileTemporalInterval	NtUnmapViewOfSectionTemporalInterval	SetFilePointerExTemporalInterval	SetFilePointerTemporalInterval	GetTempPathWTemporalInterval	GetFileSizeTemporalInterval	NtWriteFileTemporalInterval	FindResourceExWTemporalInterval	LoadResourceTemporalInterval	SHGetFolderPathWTemporalInterval	NtProtectVirtualMemoryTemporalInterval	GetFileTypeTemporalInterval	ReadProcessMemoryTemporalInterval	GetForegroundWindowTemporalInterval	GetSystemMetricsTemporalInterval	SetFileTimeTemporalInterval	NtSetInformationFileTemporalInterval	SearchPathWTemporalInterval	NtOpenMutantTemporalInterval	RegEnumKeyExWTemporalInterval	DrawTextExWTemporalInterval	GetAsyncKeyStateTemporalInterval	GetDiskFreeSpaceExWTemporalInterval	GetKeyStateTemporalInterval	FindWindowWTemporalInterval	FindWindowExATemporalInterval	CreateThreadTemporalInterval	MoveFileWithProgressWTemporalInterval	SetFileAttributesWTemporalInterval	RemoveDirectoryWTemporalInterval	NtTerminateProcessTemporalInterval	CreateToolhelp32SnapshotTemporalInterval	Process32FirstWTemporalInterval	Process32NextWTemporalInterval	FindWindowExWTemporalInterval	SetEndOfFileTemporalInterval	GetCursorPosTemporalInterval	SetUnhandledExceptionFilterTemporalInterval	OutputDebugStringATemporalInterval	GetSystemInfoTemporalInterval	FindResourceWTemporalInterval	SizeofResourceTemporalInterval	NtDelayExecutionTemporalInterval	GetKeyboardStateTemporalInterval	WSAStartupTemporalInterval	socketTemporalInterval	setsockoptTemporalInterval	NtDeviceIoControlFileTemporalInterval	closesocketTemporalInterval	GetBestInterfaceExTemporalInterval	GetAdaptersAddressesTemporalInterval	NtQueryKeyTemporalInterval	RegCreateKeyExWTemporalInterval	GetAddrInfoWTemporalInterval	GetUserNameExWTemporalInterval	RegSetValueExWTemporalInterval	RegDeleteValueWTemporalInterval	InternetQueryOptionATemporalInterval	URLDownloadToFileWTemporalInterval	IsDebuggerPresentTemporalInterval	CreateProcessInternalWTemporalInterval	GetTimeZoneInformationTemporalInterval	LookupAccountSidWTemporalInterval	SendNotifyMessageWTemporalInterval	UuidCreateTemporalInterval	GetFileVersionInfoSizeWTemporalInterval	GetFileVersionInfoWTemporalInterval	NtEnumerateValueKeyTemporalInterval	EnumWindowsTemporalInterval	OpenSCManagerWTemporalInterval	GetComputerNameWTemporalInterval	GetUserNameWTemporalInterval	NetShareEnumTemporalInterval	GetFileInformationByHandleTemporalInterval	DeviceIoControlTemporalInterval	ShellExecuteExWTemporalInterval	RegQueryInfoKeyWTemporalInterval	RegEnumValueWTemporalInterval	RegDeleteKeyWTemporalInterval	NtReadVirtualMemoryTemporalInterval	NtOpenKeyExTemporalInterval	NtSetValueKeyTemporalInterval	NtCreateKeyTemporalInterval	GetVolumePathNameWTemporalInterval	GetFileAttributesExWTemporalInterval	GetUserNameExATemporalInterval	RegCreateKeyExATemporalInterval	CryptAcquireContextWTemporalInterval	NtEnumerateKeyTemporalInterval	NtDeleteKeyTemporalInterval	OpenServiceWTemporalInterval	NtOpenDirectoryObjectTemporalInterval	CreateJobObjectWTemporalInterval	SetInformationJobObjectTemporalInterval	RegEnumKeyExATemporalInterval	__exception__TemporalInterval	GetShortPathNameWTemporalInterval	LoadStringATemporalInterval	FindResourceATemporalInterval	DrawTextExATemporalInterval	RegQueryInfoKeyATemporalInterval	RegSetValueExATemporalInterval	SHGetSpecialFolderLocationTemporalInterval	NtCreateThreadExTemporalInterval	NtResumeThreadTemporalInterval	gethostbynameTemporalInterval	GetSystemDirectoryATemporalInterval	FindResourceExATemporalInterval	GetDiskFreeSpaceWTemporalInterval	CertOpenStoreTemporalInterval	CryptDecodeObjectExTemporalInterval	CertControlStoreTemporalInterval	CryptHashDataTemporalInterval	NtOpenThreadTemporalInterval	MessageBoxTimeoutWTemporalInterval	LookupPrivilegeValueWTemporalInterval	CryptAcquireContextATemporalInterval	SetFileInformationByHandleTemporalInterval	RemoveDirectoryATemporalInterval	SetWindowsHookExWTemporalInterval	CopyFileWTemporalInterval	GetFileVersionInfoSizeExWTemporalInterval	GetFileVersionInfoExWTemporalInterval	CoInitializeSecurityTemporalInterval	WSASocketWTemporalInterval	WSAConnectTemporalInterval	UnhookWindowsHookExTemporalInterval	CertOpenSystemStoreWTemporalInterval	getaddrinfoTemporalInterval	InternetCrackUrlWTemporalInterval	CoCreateInstanceExTemporalInterval	CoGetClassObjectTemporalInterval	IWbemServices_ExecQueryTemporalInterval	SetStdHandleTemporalInterval	GlobalMemoryStatusTemporalInterval	NetGetJoinInformationTemporalInterval	CryptCreateHashTemporalInterval	GetComputerNameATemporalInterval	InternetOpenATemporalInterval	InternetOpenUrlATemporalInterval	InternetCloseHandleTemporalInterval	ReadCabinetStateTemporalInterval	InternetOpenWTemporalInterval	InternetConnectWTemporalInterval	HttpOpenRequestWTemporalInterval	HttpSendRequestWTemporalInterval	NtDeleteValueKeyTemporalInterval	HttpQueryInfoATemporalInterval	RegEnumValueATemporalInterval	CryptProtectMemoryTemporalInterval	CreateServiceWTemporalInterval	WriteConsoleATemporalInterval	CopyFileATemporalInterval	WriteProcessMemoryTemporalInterval	SendNotifyMessageATemporalInterval	RegDeleteKeyATemporalInterval	WriteConsoleWTemporalInterval	JsGlobalObjectDefaultEvalHelperTemporalInterval	ObtainUserAgentStringTemporalInterval	StartServiceWTemporalInterval	NtQueueApcThreadTemporalInterval	RtlAddVectoredContinueHandlerTemporalInterval	CryptExportKeyTemporalInterval	CryptGenKeyTemporalInterval	CryptEncryptTemporalInterval	NetUserGetInfoTemporalInterval	GetUserNameATemporalInterval	InternetOpenUrlWTemporalInterval	systemTemporalInterval	GetAdaptersInfoTemporalInterval	Module32FirstWTemporalInterval	NtGetContextThreadTemporalInterval	Module32NextWTemporalInterval	RtlAddVectoredExceptionHandlerTemporalInterval	NtSuspendThreadTemporalInterval	OpenSCManagerATemporalInterval	OpenServiceATemporalInterval	NtQueryMultipleValueKeyTemporalInterval	MessageBoxTimeoutATemporalInterval	ControlServiceTemporalInterval	NtTerminateThreadTemporalInterval	EncryptMessageTemporalInterval	DecryptMessageTemporalInterval	DeleteServiceTemporalInterval	FindWindowATemporalInterval	RtlRemoveVectoredExceptionHandlerTemporalInterval	ioctlsocketTemporalInterval	connectTemporalInterval	selectTemporalInterval	SetWindowsHookExATemporalInterval	CreateServiceATemporalInterval	bindTemporalInterval	listenTemporalInterval	getsocknameTemporalInterval	acceptTemporalInterval	InternetCrackUrlATemporalInterval	InternetConnectATemporalInterval	HttpOpenRequestATemporalInterval	HttpSendRequestATemporalInterval	sendtoTemporalInterval	shutdownTemporalInterval	RtlDecompressBufferTemporalInterval	NtSetContextThreadTemporalInterval	Thread32FirstTemporalInterval	Thread32NextTemporalInterval	CreateRemoteThreadTemporalInterval	InternetReadFileTemporalInterval	CreateRemoteThreadExTemporalInterval	timeGetTimeTemporalInterval	DnsQuery_ATemporalInterval	InternetGetConnectedStateTemporalInterval	RegisterHotKeyTemporalInterval	CryptDecryptTemporalInterval	CopyFileExWTemporalInterval	NtDeleteFileTemporalInterval	sendTemporalInterval	DeleteUrlCacheEntryATemporalInterval	EnumServicesStatusWTemporalInterval	recvTemporalInterval	NtWriteVirtualMemoryTemporalInterval	InternetSetOptionATemporalInterval	NtLoadDriverTemporalInterval	__anomaly__TemporalInterval	EnumServicesStatusATemporalInterval	RegDeleteValueATemporalInterval	CertCreateCertificateContextTemporalInterval	InternetSetStatusCallbackTemporalInterval	IWbemServices_ExecMethodTemporalInterval	AssignProcessToJobObjectTemporalInterval	StartServiceATemporalInterval	CryptProtectDataTemporalInterval	CryptUnprotectDataTemporalInterval	CryptUnprotectMemoryTemporalInterval	SHA256
0	EternalRocks	Ransomware	1	64.07900	0.000000	91.125000	64.328000	91.281000	51.469000	62.34400	64.390000	64.406000	64.406000	91.281000	61.093000	61.093000	0.203000	62.328000	62.3280	0.078000	7.656000	1.610000	0.00000	90.625000	0.016000	61.42200	0.000000	0.000000	61.079	0.000000	60.328000	60.281	0.000000	64.172000	51.094000	0.000000	0.000000	60.203000	0.000000	61.453000	0.00000	6.297000	4.594000	60.859000	0.000000	63.265000	60.297000	0.00000	61.125000	0.000000	0.063000	1.610000	0.0	51.329000	0.0	60.407000	51.671000	0.000	0.00	0.797000	63.110000	52.53200	0.0	0.000000	0.000000	0.000000	0.00	0.0	59.844	60.062000	0.000	0.0	0.0	0.0	0.0	0.0	5.579000	0.00000	0.0000	0.0	0.000000	0.0	0.0	0.0	0.000000	0.0000	0.0	0.000000	0.0	60.625000	0.0	0.0	118.000000	0.0	0.000000	0.000000	0.063000	0.000000	0.063000	0.000000	0.000000	61.265000	0.000000	0.000000	0.000000	0.000000	0.000000	0.0	0.0	0.000000	0.00000	2.141	0.00000	0.0	0.000000	0.000000	0.000000	0.0	0.000	0.00	0.000000	0.0	0.0	0.0	0.0	0.00000	0.687000	0.375000	0.0	0.0	61.265	0.0	0.0	0.00000	58.985000	0.0	0.000000	0.0	0.0	0.0	0.00	0.000000	0	0	0.000000	0.0	0.0	0.000000	0.0	0.0	0.0	0.000000	0.000000	0.0	60.641000	0.0	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	0.000000	0.0	0.000000	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	0.000000	0.406	0.0	0.0	0	0.0	0.000000	0.00000	0.000000	0.00000	0.0	0.000000	0.0	0.0	0.00000	0.000000	0.000000	0.000000	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.000	0.0	0.000000	0.0	0.000000	0.0	0.0	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.000000	0.000000	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.000	3b4497c7f8c89bf22c984854ac7603573a53b95ed147e80c0f19e549e2b65693
1	GandCrab.exe	Ransomware	1	0.00000	0.000000	0.000000	13.172000	13.172000	0.000000	0.00000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.0000	0.000000	0.000000	0.000000	0.00000	0.000000	0.000000	0.00000	0.000000	0.000000	0.000	0.000000	0.000000	0.000	0.000000	6.141000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.00000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.00000	0.000000	0.000000	0.000000	0.000000	0.0	0.000000	0.0	0.000000	0.000000	0.000	0.00	0.000000	0.000000	0.00000	0.0	0.000000	0.000000	0.000000	0.00	0.0	0.000	0.000000	0.000	0.0	0.0	0.0	0.0	0.0	0.000000	0.00000	0.0000	0.0	0.641000	0.0	0.0	0.0	0.000000	0.0000	0.0	0.000000	0.0	0.000000	0.0	0.0	0.000000	0.0	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.000000	0.0	0.0	0.000000	0.00000	0.000	0.00000	0.0	0.000000	0.000000	0.000000	0.0	0.000	0.00	0.000000	0.0	0.0	0.0	0.0	0.00000	0.000000	0.000000	0.0	0.0	0.000	0.0	0.0	0.00000	7.016000	0.0	0.000000	0.0	0.0	0.0	0.00	0.000000	0	0	0.000000	0.0	0.0	0.000000	0.0	0.0	0.0	0.000000	0.000000	0.0	0.000000	0.0	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	0.000000	0.0	0.000000	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	0.000000	0.000	0.0	0.0	0	0.0	0.000000	0.00000	0.000000	0.00000	0.0	0.000000	0.0	0.0	0.00000	0.000000	0.000000	0.000000	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.000	0.0	0.000000	0.0	0.000000	0.0	0.0	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.000000	0.000000	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.000	bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...
3081	Zeppelin_4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a.exe	Ransomware	1	87.67075	8.968875	379.464750	150.029499	461.498000	8.717875	77.95225	149.092375	149.092375	459.998875	535.024749	534.868749	534.868749	78.607125	517.481499	76.1410	229.779875	8.952875	78.513625	41.01575	80.077250	143.748874	41.01375	78.700625	7.124875	0.047	211.952625	287.313625	0.000	68.892499	514.122249	8.859875	66.012875	7.077875	237.921624	6.702875	306.502500	40.98375	518.730249	297.361750	213.405375	301.112750	293.060375	66.281250	73.64125	286.233875	510.715625	63.968500	310.688751	0.0	237.921624	0.0	6.859875	289.406375	0.312	0.25	7.140875	54.937875	151.33975	0.0	7.124875	70.436125	138.891125	2.25	0.0	0.000	31.937375	3.875	0.0	0.0	0.0	0.0	0.0	42.437375	137.75025	137.4215	0.0	523.235250	0.0	0.0	0.0	0.905875	137.3905	0.0	65.672875	0.0	20.716375	0.0	0.0	255.750376	0.0	20.406125	20.375125	20.375125	54.297125	20.375125	17.813125	17.766125	29.969375	138.188125	17.765125	65.000125	138.391125	30.328375	0.0	0.0	0.124375	221.87450	0.000	68.26675	0.0	0.936875	33.422375	33.422375	0.0	32.203	2.25	69.203125	0.0	0.0	0.0	0.0	27.50025	65.579375	6.781875	0.0	0.0	0.000	0.0	0.0	64.37525	7.139875	0.0	34.469125	0.0	0.0	0.0	2.25	76.794625	0	0	138.141375	0.0	0.0	54.953875	0.0	0.0	0.0	34.469125	140.297375	0.0	35.922500	0.0	6.765875	0.0	0.0	0.0	0.0	0.0	0.0	64.000375	0.0	256.297000	6.764875	0.0	0.0	0.0	0.0	0.0	0.0	66.094750	0.000	0.0	0.0	0	0.0	0.124375	35.35900	64.688125	35.59425	0.0	6.749875	0.0	0.0	1.26650	37.813125	15.187125	35.141125	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.141	0.0	0.015375	0.0	110.813125	0.0	0.0	133.918375	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	110.813125	15.187125	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.156	4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a
3082	Zeppelin_eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5.exe	Ransomware	1	2.89075	0.000000	214.782875	67.938625	339.157374	0.000000	4.40750	66.080000	66.080000	337.016749	352.314874	352.000874	352.000874	46.795500	324.392375	4.4075	202.232999	0.000000	47.187250	0.01500	66.905875	47.250250	0.00000	47.187250	0.000000	0.000	180.549250	133.314499	0.000	67.657625	341.406625	0.000000	15.172125	0.000000	149.858625	0.000000	199.314625	0.00000	325.171375	200.314125	180.374500	199.375875	196.764750	10.452375	0.01500	181.331750	322.078249	64.202625	182.842875	0.0	139.389750	0.0	0.000000	247.188625	0.000	0.00	0.000000	0.000000	9.68600	0.0	0.000000	64.878000	66.593000	0.00	0.0	0.000	0.000000	0.000	0.0	0.0	0.0	0.0	0.0	15.172125	66.59300	66.6250	0.0	336.795125	0.0	0.0	0.0	0.000000	66.5470	0.0	3.094125	0.0	0.000000	0.0	0.0	131.859125	0.0	20.390125	20.390125	20.390125	63.609125	20.390125	17.813125	17.766125	20.344125	130.749625	17.765125	0.594250	128.202625	17.797125	0.0	0.0	0.578250	183.03125	0.000	13.07775	0.0	0.000000	0.000000	0.000000	0.0	0.000	0.00	13.062750	0.0	0.0	0.0	0.0	0.00000	0.172250	0.000000	0.0	0.0	0.000	0.0	0.0	0.00000	0.000000	0.0	36.266125	0.0	0.0	0.0	0.00	0.593250	0	0	0.000000	0.0	0.0	64.202625	0.0	0.0	0.0	36.266125	0.016000	0.0	15.172125	0.0	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	0.484750	0.0	182.327875	0.000000	0.0	0.0	0.0	0.0	0.0	0.0	2.780875	0.000	0.0	0.0	0	0.0	0.594250	0.46925	0.438250	0.10925	0.0	0.000000	0.0	0.0	2.37475	39.594125	15.172125	36.938125	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.000	0.0	0.110250	0.0	113.172125	0.0	0.0	7.828000	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	113.172125	15.172125	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0	0.0	0.0	0.0	0.0	0.0	0.000	eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5

3083 rows × 284 columns

Created by: VHUHWAVHO
Downloaded 3 times
Comments Enabled: True
Comments: 0

def process(data, filename, sha256, category, malicious):
    try:
        # Implement your data processing here, this function will get called with the data of each 
        # report in the category you have selected along with the filename of the report and hash. 
        # Do your processing and add your data to the features array, and return the features_lables, features, and sha256
        # PLEASE NOTE: THE CODE BELOW SERVES AS AN EXAMPLE ONLY! This example extracts the entropy of the PE Sections. Which can be seen here: https://malfe.cs.up.ac.za/datasets/view/Entropy_of_PE_Sections/5
        ###
        api_types_dict = {"SetErrorMode": 0, "OleInitialize": 0, "LdrGetDllHandle": 0, "LdrLoadDll": 0, "LdrGetProcedureAddress": 0, "NtOpenSection": 0, "NtMapViewOfSection": 0, "RegOpenKeyExW": 0, "RegQueryValueExW": 0, "RegCloseKey": 0, "NtClose": 0, "NtOpenKey": 0, "NtQueryValueKey": 0, "GetSystemWindowsDirectoryW": 0, "NtCreateFile": 0, "NtCreateSection": 0, "RegOpenKeyExA": 0, "CreateActCtxW": 0, "GetSystemDirectoryW": 0, "GetVolumeNameForVolumeMountPointW": 0, "NtDuplicateObject": 0, "LoadStringW": 0, "NtCreateMutant": 0, "GetNativeSystemInfo": 0, "RegEnumKeyW": 0, "NtQuerySystemInformation": 0, "RegQueryValueExA": 0, "NtQueryDirectoryFile": 0, "GlobalMemoryStatusEx": 0, "CoCreateInstance": 0, "NtAllocateVirtualMemory": 0, "CreateDirectoryW": 0, "DeleteFileW": 0, "GetFileSizeEx": 0, "NtReadFile": 0, "GetFileInformationByHandleEx": 0, "GetSystemTimeAsFileTime": 0, "GetVolumePathNamesForVolumeNameW": 0, "LdrUnloadDll": 0, "CoInitializeEx": 0, "NtOpenProcess": 0, "CoUninitialize": 0, "NtFreeVirtualMemory": 0, "NtOpenFile": 0, "NtQueryInformationFile": 0, "GetFileAttributesW": 0, "FindFirstFileExW": 0, "NtQueryAttributesFile": 0, "NtUnmapViewOfSection": 0, "SetFilePointerEx": 0, "SetFilePointer": 0, "GetTempPathW": 0, "GetFileSize": 0, "NtWriteFile": 0, "FindResourceExW": 0, "LoadResource": 0, "SHGetFolderPathW": 0, "NtProtectVirtualMemory": 0, "GetFileType": 0, "ReadProcessMemory": 0, "GetForegroundWindow": 0, "GetSystemMetrics": 0, "SetFileTime": 0, "NtSetInformationFile": 0, "SearchPathW": 0, "NtOpenMutant": 0, "RegEnumKeyExW": 0, "DrawTextExW": 0, "GetAsyncKeyState": 0, "GetDiskFreeSpaceExW": 0, "GetKeyState": 0, "FindWindowW": 0, "FindWindowExA": 0, "CreateThread": 0, "MoveFileWithProgressW": 0, "SetFileAttributesW": 0, "RemoveDirectoryW": 0, "NtTerminateProcess": 0, "CreateToolhelp32Snapshot": 0, "Process32FirstW": 0, "Process32NextW": 0, "FindWindowExW": 0, "SetEndOfFile": 0, "GetCursorPos": 0, "SetUnhandledExceptionFilter": 0, "OutputDebugStringA": 0, "GetSystemInfo": 0, "FindResourceW": 0, "SizeofResource": 0, "NtDelayExecution": 0, "GetKeyboardState": 0, "WSAStartup": 0, "socket": 0, "setsockopt": 0, "NtDeviceIoControlFile": 0, "closesocket": 0, "GetBestInterfaceEx": 0, "GetAdaptersAddresses": 0, "NtQueryKey": 0, "RegCreateKeyExW": 0, "GetAddrInfoW": 0, "GetUserNameExW": 0, "RegSetValueExW": 0, "RegDeleteValueW": 0, "InternetQueryOptionA": 0, "URLDownloadToFileW": 0, "IsDebuggerPresent": 0, "CreateProcessInternalW": 0, "GetTimeZoneInformation": 0, "LookupAccountSidW": 0, "SendNotifyMessageW": 0, "UuidCreate": 0, "GetFileVersionInfoSizeW": 0, "GetFileVersionInfoW": 0, "NtEnumerateValueKey": 0, "EnumWindows": 0, "OpenSCManagerW": 0, "GetComputerNameW": 0, "GetUserNameW": 0, "NetShareEnum": 0, "GetFileInformationByHandle": 0, "DeviceIoControl": 0, "ShellExecuteExW": 0, "RegQueryInfoKeyW": 0, "RegEnumValueW": 0, "RegDeleteKeyW": 0, "NtReadVirtualMemory": 0, "NtOpenKeyEx": 0, "NtSetValueKey": 0, "NtCreateKey": 0, "GetVolumePathNameW": 0, "GetFileAttributesExW": 0, "GetUserNameExA": 0, "RegCreateKeyExA": 0, "CryptAcquireContextW": 0, "NtEnumerateKey": 0, "NtDeleteKey": 0, "OpenServiceW": 0, "NtOpenDirectoryObject": 0, "CreateJobObjectW": 0, "SetInformationJobObject": 0, "RegEnumKeyExA": 0, "__exception__": 0, "GetShortPathNameW": 0, "LoadStringA": 0, "FindResourceA": 0, "DrawTextExA": 0, "RegQueryInfoKeyA": 0, "RegSetValueExA": 0, "SHGetSpecialFolderLocation": 0, "NtCreateThreadEx": 0, "NtResumeThread": 0, "gethostbyname": 0, "GetSystemDirectoryA": 0, "FindResourceExA": 0, "GetDiskFreeSpaceW": 0, "CertOpenStore": 0, "CryptDecodeObjectEx": 0, "CertControlStore": 0, "CryptHashData": 0, "NtOpenThread": 0, "MessageBoxTimeoutW": 0, "LookupPrivilegeValueW": 0, "CryptAcquireContextA": 0, "SetFileInformationByHandle": 0, "RemoveDirectoryA": 0, "SetWindowsHookExW": 0, "CopyFileW": 0, "GetFileVersionInfoSizeExW": 0, "GetFileVersionInfoExW": 0, "CoInitializeSecurity": 0, "WSASocketW": 0, "WSAConnect": 0, "UnhookWindowsHookEx": 0, "CertOpenSystemStoreW": 0, "getaddrinfo": 0, "InternetCrackUrlW": 0, "CoCreateInstanceEx": 0, "CoGetClassObject": 0, "IWbemServices_ExecQuery": 0, "SetStdHandle": 0, "GlobalMemoryStatus": 0, "NetGetJoinInformation": 0, "CryptCreateHash": 0, "GetComputerNameA": 0, "InternetOpenA": 0, "InternetOpenUrlA": 0, "InternetCloseHandle": 0, "ReadCabinetState": 0, "InternetOpenW": 0, "InternetConnectW": 0, "HttpOpenRequestW": 0, "HttpSendRequestW": 0, "NtDeleteValueKey": 0, "HttpQueryInfoA": 0, "RegEnumValueA": 0, "CryptProtectMemory": 0, "CreateServiceW": 0, "WriteConsoleA": 0, "CopyFileA": 0, "WriteProcessMemory": 0, "SendNotifyMessageA": 0, "RegDeleteKeyA": 0, "WriteConsoleW": 0, "JsGlobalObjectDefaultEvalHelper": 0, "ObtainUserAgentString": 0, "StartServiceW": 0, "NtQueueApcThread": 0, "RtlAddVectoredContinueHandler": 0, "CryptExportKey": 0, "CryptGenKey": 0, "CryptEncrypt": 0, "NetUserGetInfo": 0, "GetUserNameA": 0, "InternetOpenUrlW": 0, "system": 0, "GetAdaptersInfo": 0, "Module32FirstW": 0, "NtGetContextThread": 0, "Module32NextW": 0, "RtlAddVectoredExceptionHandler": 0, "NtSuspendThread": 0, "OpenSCManagerA": 0, "OpenServiceA": 0, "NtQueryMultipleValueKey": 0, "MessageBoxTimeoutA": 0, "ControlService": 0, "NtTerminateThread": 0, "EncryptMessage": 0, "DecryptMessage": 0, "DeleteService": 0, "FindWindowA": 0, "RtlRemoveVectoredExceptionHandler": 0, "ioctlsocket": 0, "connect": 0, "select": 0, "SetWindowsHookExA": 0, "CreateServiceA": 0, "bind": 0, "listen": 0, "getsockname": 0, "accept": 0, "InternetCrackUrlA": 0, "InternetConnectA": 0, "HttpOpenRequestA": 0, "HttpSendRequestA": 0, "sendto": 0, "shutdown": 0, "RtlDecompressBuffer": 0, "NtSetContextThread": 0, "Thread32First": 0, "Thread32Next": 0, "CreateRemoteThread": 0, 
"InternetReadFile": 0, "CreateRemoteThreadEx": 0, "timeGetTime": 0, "DnsQuery_A": 0, "InternetGetConnectedState": 0, "RegisterHotKey": 0, "CryptDecrypt": 0, "CopyFileExW": 0, "NtDeleteFile": 0, "send": 0, "DeleteUrlCacheEntryA": 0, "EnumServicesStatusW": 0, "recv": 0, "NtWriteVirtualMemory": 0, "InternetSetOptionA": 0, "NtLoadDriver": 0, "__anomaly__": 0, "EnumServicesStatusA": 0, "RegDeleteValueA": 0, "CertCreateCertificateContext": 0, "InternetSetStatusCallback": 0, "IWbemServices_ExecMethod": 0, "AssignProcessToJobObject": 0, "StartServiceA": 0, "CryptProtectData": 0, "CryptUnprotectData": 0, "CryptUnprotectMemory": 0}
        api_types_state = {"SetErrorMode": 0, "OleInitialize": 0, "LdrGetDllHandle": 0, "LdrLoadDll": 0, "LdrGetProcedureAddress": 0, "NtOpenSection": 0, "NtMapViewOfSection": 0, "RegOpenKeyExW": 0, "RegQueryValueExW": 0, "RegCloseKey": 0, "NtClose": 0, "NtOpenKey": 0, "NtQueryValueKey": 0, "GetSystemWindowsDirectoryW": 0, "NtCreateFile": 0, "NtCreateSection": 0, "RegOpenKeyExA": 0, "CreateActCtxW": 0, "GetSystemDirectoryW": 0, "GetVolumeNameForVolumeMountPointW": 0, "NtDuplicateObject": 0, "LoadStringW": 0, "NtCreateMutant": 0, "GetNativeSystemInfo": 0, "RegEnumKeyW": 0, "NtQuerySystemInformation": 0, "RegQueryValueExA": 0, "NtQueryDirectoryFile": 0, "GlobalMemoryStatusEx": 0, "CoCreateInstance": 0, "NtAllocateVirtualMemory": 0, "CreateDirectoryW": 0, "DeleteFileW": 0, "GetFileSizeEx": 0, "NtReadFile": 0, "GetFileInformationByHandleEx": 0, "GetSystemTimeAsFileTime": 0, "GetVolumePathNamesForVolumeNameW": 0, "LdrUnloadDll": 0, "CoInitializeEx": 0, "NtOpenProcess": 0, "CoUninitialize": 0, "NtFreeVirtualMemory": 0, "NtOpenFile": 0, "NtQueryInformationFile": 0, "GetFileAttributesW": 0, "FindFirstFileExW": 0, "NtQueryAttributesFile": 0, "NtUnmapViewOfSection": 0, "SetFilePointerEx": 0, "SetFilePointer": 0, "GetTempPathW": 0, "GetFileSize": 0, "NtWriteFile": 0, "FindResourceExW": 0, "LoadResource": 0, "SHGetFolderPathW": 0, "NtProtectVirtualMemory": 0, "GetFileType": 0, "ReadProcessMemory": 0, "GetForegroundWindow": 0, "GetSystemMetrics": 0, "SetFileTime": 0, "NtSetInformationFile": 0, "SearchPathW": 0, "NtOpenMutant": 0, "RegEnumKeyExW": 0, "DrawTextExW": 0, "GetAsyncKeyState": 0, "GetDiskFreeSpaceExW": 0, "GetKeyState": 0, "FindWindowW": 0, "FindWindowExA": 0, "CreateThread": 0, "MoveFileWithProgressW": 0, "SetFileAttributesW": 0, "RemoveDirectoryW": 0, "NtTerminateProcess": 0, "CreateToolhelp32Snapshot": 0, "Process32FirstW": 0, "Process32NextW": 0, "FindWindowExW": 0, "SetEndOfFile": 0, "GetCursorPos": 0, "SetUnhandledExceptionFilter": 0, "OutputDebugStringA": 0, "GetSystemInfo": 0, "FindResourceW": 0, "SizeofResource": 0, "NtDelayExecution": 0, "GetKeyboardState": 0, "WSAStartup": 0, "socket": 0, "setsockopt": 0, "NtDeviceIoControlFile": 0, "closesocket": 0, "GetBestInterfaceEx": 0, "GetAdaptersAddresses": 0, "NtQueryKey": 0, "RegCreateKeyExW": 0, "GetAddrInfoW": 0, "GetUserNameExW": 0, "RegSetValueExW": 0, "RegDeleteValueW": 0, "InternetQueryOptionA": 0, "URLDownloadToFileW": 0, "IsDebuggerPresent": 0, "CreateProcessInternalW": 0, "GetTimeZoneInformation": 0, "LookupAccountSidW": 0, "SendNotifyMessageW": 0, "UuidCreate": 0, "GetFileVersionInfoSizeW": 0, "GetFileVersionInfoW": 0, "NtEnumerateValueKey": 0, "EnumWindows": 0, "OpenSCManagerW": 0, "GetComputerNameW": 0, "GetUserNameW": 0, "NetShareEnum": 0, "GetFileInformationByHandle": 0, "DeviceIoControl": 0, "ShellExecuteExW": 0, "RegQueryInfoKeyW": 0, "RegEnumValueW": 0, "RegDeleteKeyW": 0, "NtReadVirtualMemory": 0, "NtOpenKeyEx": 0, "NtSetValueKey": 0, "NtCreateKey": 0, "GetVolumePathNameW": 0, "GetFileAttributesExW": 0, "GetUserNameExA": 0, "RegCreateKeyExA": 0, "CryptAcquireContextW": 0, "NtEnumerateKey": 0, "NtDeleteKey": 0, "OpenServiceW": 0, "NtOpenDirectoryObject": 0, "CreateJobObjectW": 0, "SetInformationJobObject": 0, "RegEnumKeyExA": 0, "__exception__": 0, "GetShortPathNameW": 0, "LoadStringA": 0, "FindResourceA": 0, "DrawTextExA": 0, "RegQueryInfoKeyA": 0, "RegSetValueExA": 0, "SHGetSpecialFolderLocation": 0, "NtCreateThreadEx": 0, "NtResumeThread": 0, "gethostbyname": 0, "GetSystemDirectoryA": 0, "FindResourceExA": 0, "GetDiskFreeSpaceW": 0, "CertOpenStore": 0, "CryptDecodeObjectEx": 0, "CertControlStore": 0, "CryptHashData": 0, "NtOpenThread": 0, "MessageBoxTimeoutW": 0, "LookupPrivilegeValueW": 0, "CryptAcquireContextA": 0, "SetFileInformationByHandle": 0, "RemoveDirectoryA": 0, "SetWindowsHookExW": 0, "CopyFileW": 0, "GetFileVersionInfoSizeExW": 0, "GetFileVersionInfoExW": 0, "CoInitializeSecurity": 0, "WSASocketW": 0, "WSAConnect": 0, "UnhookWindowsHookEx": 0, "CertOpenSystemStoreW": 0, "getaddrinfo": 0, "InternetCrackUrlW": 0, "CoCreateInstanceEx": 0, "CoGetClassObject": 0, "IWbemServices_ExecQuery": 0, "SetStdHandle": 0, "GlobalMemoryStatus": 0, "NetGetJoinInformation": 0, "CryptCreateHash": 0, "GetComputerNameA": 0, "InternetOpenA": 0, "InternetOpenUrlA": 0, "InternetCloseHandle": 0, "ReadCabinetState": 0, "InternetOpenW": 0, "InternetConnectW": 0, "HttpOpenRequestW": 0, "HttpSendRequestW": 0, "NtDeleteValueKey": 0, "HttpQueryInfoA": 0, "RegEnumValueA": 0, "CryptProtectMemory": 0, "CreateServiceW": 0, "WriteConsoleA": 0, "CopyFileA": 0, "WriteProcessMemory": 0, "SendNotifyMessageA": 0, "RegDeleteKeyA": 0, "WriteConsoleW": 0, "JsGlobalObjectDefaultEvalHelper": 0, "ObtainUserAgentString": 0, "StartServiceW": 0, "NtQueueApcThread": 0, "RtlAddVectoredContinueHandler": 0, "CryptExportKey": 0, "CryptGenKey": 0, "CryptEncrypt": 0, "NetUserGetInfo": 0, "GetUserNameA": 0, "InternetOpenUrlW": 0, "system": 0, "GetAdaptersInfo": 0, "Module32FirstW": 0, "NtGetContextThread": 0, "Module32NextW": 0, "RtlAddVectoredExceptionHandler": 0, "NtSuspendThread": 0, "OpenSCManagerA": 0, "OpenServiceA": 0, "NtQueryMultipleValueKey": 0, "MessageBoxTimeoutA": 0, "ControlService": 0, "NtTerminateThread": 0, "EncryptMessage": 0, "DecryptMessage": 0, "DeleteService": 0, "FindWindowA": 0, "RtlRemoveVectoredExceptionHandler": 0, "ioctlsocket": 0, "connect": 0, "select": 0, "SetWindowsHookExA": 0, "CreateServiceA": 0, "bind": 0, "listen": 0, "getsockname": 0, "accept": 0, "InternetCrackUrlA": 0, "InternetConnectA": 0, "HttpOpenRequestA": 0, "HttpSendRequestA": 0, "sendto": 0, "shutdown": 0, "RtlDecompressBuffer": 0, "NtSetContextThread": 0, "Thread32First": 0, "Thread32Next": 0, "CreateRemoteThread": 0, 
"InternetReadFile": 0, "CreateRemoteThreadEx": 0, "timeGetTime": 0, "DnsQuery_A": 0, "InternetGetConnectedState": 0, "RegisterHotKey": 0, "CryptDecrypt": 0, "CopyFileExW": 0, "NtDeleteFile": 0, "send": 0, "DeleteUrlCacheEntryA": 0, "EnumServicesStatusW": 0, "recv": 0, "NtWriteVirtualMemory": 0, "InternetSetOptionA": 0, "NtLoadDriver": 0, "__anomaly__": 0, "EnumServicesStatusA": 0, "RegDeleteValueA": 0, "CertCreateCertificateContext": 0, "InternetSetStatusCallback": 0, "IWbemServices_ExecMethod": 0, "AssignProcessToJobObject": 0, "StartServiceA": 0, "CryptProtectData": 0, "CryptUnprotectData": 0, "CryptUnprotectMemory": 0}

features_labels = ["Sample Name","category", "label"]
        features = []
        label =   1 if malicious else 0
        if "behavior" in data:
            if "processes" in data["behavior"]:
                for proc in data["behavior"]["processes"]:
                    api_calls_list = proc["calls"]
                    for api_entry in api_calls_list:
                        api_type = api_entry["api"]
                        timevalue = api_entry["time"]
                        if api_type in api_types_dict:
                            if(api_types_state[api_type]==0):
                                api_types_state[api_type] = timevalue
                            else:
                                interval = timevalue-api_types_state[api_type]
                                api_types_dict[api_type]= api_types_dict[api_type] + abs(interval)
                                api_types_state[api_type] = timevalue
                
        
        row = []
        for apikey in api_types_dict.keys():
            features_labels.append(apikey+"TemporalInterval")
            row.append(api_types_dict[apikey])
        entry = [filename, category, label] + row
        features.append(entry)

###
        return features_labels, features, sha256
        
    except Exception as e:
        log("|process error| " + filename + " -> " + sha256 + " (" + str(e) + ")")
        pass

June 25, 2024, 4:24 p.m. Public Create New Vesion Download Dataset (4.9 MB)

Please wait ...

Public Datasets

API Temporal Interval Rows: 3083 | Cols: 284 | Reports Used: 3084

Reports Used

Dataset Code

Comments

No comments to display