{
  "namespace": "malware_classification",
  "description": "Classification based on different categories. Based on https://www.sans.org/reading-room/whitepapers/incident/malware-101-viruses-32848",
  "version": 3,
  "predicates": [
    {
      "value": "malware-category",
      "expanded": "Malware Category",
      "uuid": "89372365-4a3a-5dca-af77-a611027c1688"
    },
    {
      "value": "obfuscation-technique",
      "expanded": "Obfuscation Technique",
      "uuid": "a76d3764-4656-5d12-b551-8a0688da11cc"
    },
    {
      "value": "payload-classification",
      "expanded": "Payload Classification",
      "uuid": "1a237205-97c3-5c6e-b206-82eb6e687059"
    },
    {
      "value": "memory-classification",
      "expanded": "Memory Classification",
      "uuid": "5b6f8f8b-a539-533e-9d99-d65cc36d48d8"
    }
  ],
  "values": [
    {
      "predicate": "malware-category",
      "entry": [
        {
          "value": "Virus",
          "expanded": "Virus",
          "uuid": "077d484d-d888-500d-9734-36d3d0bd27ae"
        },
        {
          "value": "Worm",
          "expanded": "Worm",
          "uuid": "05aa1cf1-bd64-5ad3-b556-9b4d12d10458"
        },
        {
          "value": "Trojan",
          "expanded": "Trojan",
          "uuid": "c4460924-0018-5c09-90e7-1e49a30a8677"
        },
        {
          "value": "Ransomware",
          "expanded": "Ransomware",
          "uuid": "65a2fb92-b704-5c20-98d6-fbed0a3a877d"
        },
        {
          "value": "Rootkit",
          "expanded": "Rootkit",
          "uuid": "7fbc1237-8a81-5a08-95f8-74c629db6117"
        },
        {
          "value": "Downloader",
          "expanded": "Downloader",
          "uuid": "69f60b34-84b3-5250-8b2c-8b9e6fea582f"
        },
        {
          "value": "Adware",
          "expanded": "Adware",
          "uuid": "88e2a276-78d8-580a-8892-3333a20cc162"
        },
        {
          "value": "Stalkerware",
          "expanded": "Stalkerware",
          "uuid": "cda5543d-6d95-5af6-86eb-3126aaeec232"
        },
        {
          "value": "Spyware",
          "expanded": "Spyware",
          "uuid": "2488a2e0-dd96-5048-a47d-077447f08f86"
        },
        {
          "value": "Zombieware",
          "expanded": "Zombieware",
          "uuid": "fe8ccd3e-c1da-5da6-a1fe-46bf902d69f2"
        },
        {
          "value": "Botnet",
          "expanded": "Botnet",
          "uuid": "c1495897-60b6-50d4-a2a7-f41f6ec3faa3"
        }
      ]
    },
    {
      "predicate": "obfuscation-technique",
      "entry": [
        {
          "value": "no-obfuscation",
          "expanded": "No obfuscation is used",
          "uuid": "53aec708-2fab-5d5c-92ab-8a7ba114d010"
        },
        {
          "value": "encryption",
          "expanded": "encryption",
          "uuid": "2bd456da-e0de-5b0a-a468-b8d1f767c3e0"
        },
        {
          "value": "oligomorphism",
          "expanded": "oligomorphism",
          "uuid": "c0c1cff0-e22c-5cbb-b8da-e89e3d65b079"
        },
        {
          "value": "metamorphism",
          "expanded": "metamorphism",
          "uuid": "9aa15ec9-e7ea-5abe-a7a2-ed7ec288c25b"
        },
        {
          "value": "stealth",
          "expanded": "stealth",
          "uuid": "15893cd1-a571-5b08-aae9-e7426924f54b"
        },
        {
          "value": "armouring",
          "expanded": "armouring",
          "uuid": "4123b159-a9a6-5662-9f4e-4de62f37e5a7"
        },
        {
          "value": "tunneling",
          "expanded": "tunneling",
          "uuid": "2d47b877-528b-53b4-8527-dbf7580e22e4"
        },
        {
          "value": "XOR",
          "expanded": "XOR",
          "uuid": "99be5a7e-5b93-52bb-a0d8-751e48277f46"
        },
        {
          "value": "BASE64",
          "expanded": "BASE64",
          "uuid": "8b41b783-d49c-589b-b4cf-36db05d1c536"
        },
        {
          "value": "ROT13",
          "expanded": "ROT13",
          "uuid": "ac17de72-75c5-5d4d-be90-bfdaf115a7b4"
        }
      ]
    },
    {
      "predicate": "payload-classification",
      "entry": [
        {
          "value": "no-payload",
          "expanded": "No payload",
          "uuid": "46ff9317-c92a-5d81-b6c0-989a30d208d7"
        },
        {
          "value": "non-destructive",
          "expanded": "Non-Destructive",
          "uuid": "5b751820-3b4d-5f13-83e5-4f4a92c28e1a"
        },
        {
          "value": "destructive",
          "expanded": "Destructive",
          "uuid": "2be48d44-e937-56cd-8152-e54e637d8617"
        },
        {
          "value": "dropper",
          "expanded": "Dropper",
          "uuid": "7ea7cd5c-ad9f-5f57-8d08-8ab4e90411e0"
        }
      ]
    },
    {
      "predicate": "memory-classification",
      "entry": [
        {
          "value": "resident",
          "expanded": "In memory",
          "uuid": "c00bfe46-3c02-5110-8854-f6afdc93a52d"
        },
        {
          "value": "temporary-resident",
          "expanded": "In memory temporarily",
          "uuid": "e808d2a6-0a61-5e67-a661-a02031220e6d"
        },
        {
          "value": "swapping-mode",
          "expanded": "Only a part loaded in memory temporarily",
          "uuid": "b23b950b-f5a8-5775-9fea-dec159f5267c"
        },
        {
          "value": "non-resident",
          "expanded": "Not in memory",
          "uuid": "87a2afdb-3ab1-58f5-9ba7-7c90bb884deb"
        },
        {
          "value": "user-process",
          "expanded": "As a user level process",
          "uuid": "33b60af7-a009-5a82-9259-b973cae69e9a"
        },
        {
          "value": "kernel-process",
          "expanded": "As a process in the kernel",
          "uuid": "e326d741-0928-5f95-9d57-c1c244227f7e"
        }
      ]
    }
  ],
  "uuid": "443f0cbf-b1cb-5320-a58c-a7140185b022"
}