Behavioural malware intelligence

MalTrace

Classify malware by what it does, then show why.

sample sha-256 ed01ebfb…080e41aa

Analysed sample

API calls, WannaCry sampleVERIFIED

Behavioral + PE featuresVERIFIED

Malicious confidence on this sampleVERIFIED

A sample is hashed, detonated, traced, reduced to behavioural features, scored, and explained feature by feature, then mapped to ATT&CK techniques.

wannacry.exe, 3,514,368 bytes

SHA-256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

PE32 executable (GUI) Intel 80386, for MS Windows

4 PE sections

In section-table order: .text, .rdata, .data, .rsrc.

PE sections as recorded by the sandbox. A column appears only when the data has it.
ID	Section	Raw size, bytes	Virtual size, bytes	Entropy	Note
1	.text	28,672	27,056	6.40
2	.rdata	24,576	24,432	6.66
3	.data	8,192	6,488	4.46
4	.rsrc	3,448,832	3,448,736	8.00	HIGH ENTROPY

94,958 API calls across 17 processes

54 features

46 dynamic behavioral + 8 static PE.

Static PE features: pe_entropy pe_num_sections pe_has_upx pe_wx_section pe_is_64bit pe_is_signed pe_has_tls pe_num_imports

Random forest

The 54 features feed one model.

95% malicious confidence on this sample

A single-sample prediction, not model accuracy.

SHAP base value 0.501

Per-feature SHAP contributions: positive pushes toward malicious, negative away from it.
Feature	Value	SHAP	Direction
malscore	10	+0.0885	malware
sig_severity_sum	54	+0.0589	malware
has_rat	1	+0.0502	malware
pe_num_sections	4	+0.0473	malware
pe_is_64bit	0	+0.0399	malware
file_size	3514368	-0.0158	benign
num_strings	15894	-0.0148	benign
num_mutexes	40	-0.0086	benign
num_dropped_files	59	-0.0051	benign
suspicious_api_ratio	0.0105	-0.0026	benign

15 sandbox signatures
Signature	Severity
antivm_checks_available_memory	1
queries_computer_name	1
queries_keyboard_layout	1
queries_locale_api	1
accesses_public_folder	1
antidebug_setunhandledexceptionfilter	1
dll_load_uncommon_file_types	1
exec_crash	1
stealth_timeout	1
language_check_registry	1
privilege_elevation_check	2
mountpoints_volume_discovery	2
creates_suspended_process	2
resumethread_remote_process	2
reads_self	2