{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998294115066528, "class": 1 } ], "prob": 0.9998294, "class": 1, "models": [ { "m": "az", "prob": 0.9986035, "class": 1 }, { "m": "az/native", "prob": 0.9998294, "class": 0 }, { "m": "az/pe", "prob": 0.999338, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9958679, 0.99937946 ], "analyzed_at": "2026-05-06T01:43:28Z" }, "path": "virussign.com_694c4382af888d60753cde18a687d840.vir", "raw": { "v": "4", "fs": [ { "f": "KO₉(As₁₁I₂AlC₆DyEr₄EuLaS)H₉(Os₂Db₂F₂Po₃UCm₂CrDsMg)Md₅(Bk₃Bi₄Pt₂Si₂He)", "k": { "pe.checksum": "0xa92ce11b", "pe.timestamp": 708992537, "hashes.imphash": "884310b1928934402ea6fec1dbd3cf5e", "signing.issuer": "COMODO RSA Code Signing CA", "signing.serial": "1f093919492053aabdcec3aa5b9ce4d", "signing.catalog": "authenticode", "signing.subject": "Supreme Mode (Alpha Criteria Ltd.)", "build.target_arch": "x86", "pe.linker_version": "2.25", "signing.is_signed": true, "signing.not_after": 1534291199, "signing.not_before": 1502668800, "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_STRING", "pe.resource_types[2]": "RT_RCDATA", "pe.resource_types[3]": "RT_GROUP_ICON", "pe.resource_types[4]": "RT_VERSION", "pe.resource_types[5]": "RT_MANIFEST", "pe.manifest.dpi_aware": true, "pe.manifest.description": "Inno Setup", "signing.thumbprint_sha1": "46cae9a9b56b48611597a60ec43aee2b3e5e08d4", "pe.version_info.comments": "This installation was built with Inno Setup.", "pe.version_info.company_name": "Manadadofo ", "pe.version_info.file_version": "3.0.3.5 ", "pe.version_info.product_name": "Nahine ", "pe.version_info.legal_copyright": " ", "pe.version_info.product_version": "5.5.1 ", "binary.top_complex_unnamed[0].cc": 46, "binary.top_complex_unnamed[1].cc": 28, "binary.top_complex_unnamed[2].cc": 19, "binary.top_complex_unnamed[3].cc": 18, "binary.top_complex_unnamed[4].cc": 17, "binary.top_complex_unnamed[5].cc": 16, "binary.top_complex_unnamed[6].cc": 16, "binary.top_complex_unnamed[7].cc": 15, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.manifest.supported_os[0].guid": "{e2011457-1546-43c5-a5fe-008deee3d3f0}", "pe.manifest.supported_os[0].name": "vista", "pe.manifest.supported_os[1].guid": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.manifest.supported_os[1].name": "win7", "pe.manifest.supported_os[2].guid": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[2].name": "win8", "pe.manifest.supported_os[3].guid": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[3].name": "win8.1", "pe.version_info.file_description": "Nahine Setup ", "binary.top_complex_unnamed[0].bbs": 96, "binary.top_complex_unnamed[1].bbs": 32, "binary.top_complex_unnamed[2].bbs": 32, "binary.top_complex_unnamed[3].bbs": 32, "binary.top_complex_unnamed[4].bbs": 33, "binary.top_complex_unnamed[5].bbs": 28, "binary.top_complex_unnamed[6].bbs": 24, "binary.top_complex_unnamed[7].bbs": 29, "binary.top_complex_unnamed[0].addr": "0x40840c", "binary.top_complex_unnamed[0].size": 1690, "binary.top_complex_unnamed[1].addr": "0x405b10", "binary.top_complex_unnamed[1].size": 127, "binary.top_complex_unnamed[2].addr": "0x404e58", "binary.top_complex_unnamed[2].size": 773, "binary.top_complex_unnamed[3].addr": "0x40215c", "binary.top_complex_unnamed[3].size": 418, "binary.top_complex_unnamed[4].addr": "0x402f78", "binary.top_complex_unnamed[4].size": 160, "binary.top_complex_unnamed[5].addr": "0x4025ac", "binary.top_complex_unnamed[5].size": 6304, "binary.top_complex_unnamed[6].addr": "0x406e10", "binary.top_complex_unnamed[6].size": 312, "binary.top_complex_unnamed[7].addr": "0x402300", "binary.top_complex_unnamed[7].size": 463, "pe.manifest.assembly_identity.name": "JR.Inno.Setup", "pe.manifest.assembly_identity.type": "win32", "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.manifest.dependencies[0].language": "*", "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker", "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.manifest.dependencies[0].processor_architecture": "x86", "pe.manifest.assembly_identity.processor_architecture": "x86" }, "x": 126, "id": 0, "is": [ "DeleteCriticalSection", "LeaveCriticalSection", "EnterCriticalSection", "InitializeCriticalSection", "VirtualFree", "VirtualAlloc", "LocalFree", "LocalAlloc", "WideCharToMultiByte", "TlsSetValue", "TlsGetValue", "MultiByteToWideChar", "GetModuleHandleA", "GetLastError", "GetCommandLineA", "WriteFile", "SetFilePointer", "SetEndOfFile", "RtlUnwind", "ReadFile", "RaiseException", "GetStdHandle", "GetFileSize", "GetSystemTime", "GetFileType", "ExitProcess", "CreateFileA", "CloseHandle", "MessageBoxA", "VariantChangeTypeEx", "VariantCopyInd", "VariantClear", "SysStringLen", "SysAllocStringLen", "RegQueryValueExA", "RegOpenKeyExA", "RegCloseKey", "OpenProcessToken", "LookupPrivilegeValueA", "WriteFile", "VirtualQuery", "VirtualProtect", "VirtualFree", "VirtualAlloc", "Sleep", "SizeofResource", "SetLastError", "SetFilePointer", "SetErrorMode", "SetEndOfFile", "RemoveDirectoryA", "ReadFile", "LockResource", "LoadResource", "LoadLibraryA", "IsDBCSLeadByte", "GetWindowsDirectoryA", "GetVersionExA", "GetUserDefaultLangID", "GetSystemInfo", "GetSystemDefaultLCID", "GetProcAddress", "GetModuleHandleA", "GetModuleFileNameA", "GetLocaleInfoA", "GetLastError", "GetFullPathNameA", "GetFileSize", "GetFileAttributesA", "GetExitCodeProcess", "GetEnvironmentVariableA", "GetCurrentProcess", "GetCommandLineA", "GetACP", "InterlockedExchange", "FormatMessageA", "FindResourceA", "DeleteFileA", "CreateProcessA", "CreateFileA", "CreateDirectoryA", "CloseHandle", "TranslateMessage", "SetWindowLongA", "PeekMessageA", "MsgWaitForMultipleObjects", "MessageBoxA", "LoadStringA", "ExitWindowsEx", "DispatchMessageA", "DestroyWindow", "CreateWindowExA", "CallWindowProcA", "CharPrevA", "InitCommonControls", "AdjustTokenPrivileges" ], "ms": { "pe": { "signer": "COMODO RSA Code Signing CA, Supreme Mode (Alpha Criteria Ltd.), COMODO RSA Certification Authority", "machine": 332.0, "checksum": 2838290715.0, "rsrc_size": 160256.0, "subsystem": 2.0, "timestamp": 708992537.0, "icon_count": 2.0, "image_base": 4194304.0, "leaf_issuer": "COMODO RSA Code Signing CA", "leaf_serial": "1f093919492053aabdcec3aa5b9ce4d", "leaf_subject": "Supreme Mode (Alpha Criteria Ltd.)", "rsrc_entropy": 5.65, "entry_section": "CODE", "has_signature": true, "size_of_image": 233472.0, "timestamp_day": 19.0, "file_alignment": 512.0, "leaf_not_after": 1534291199.0, "primary_signer": "Supreme Mode (Alpha Criteria Ltd.)", "resource_count": 6.0, "resource_types": [ "RT_ICON", "RT_STRING", "RT_RCDATA", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "signature_type": "developer", "timestamp_year": 1992.0, "characteristics": 33167.0, "entry_point_rva": 42488.0, "leaf_not_before": 1502668800.0, "size_of_headers": 1024.0, "timestamp_month": 6.0, "cert_chain_depth": 2.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 5.0, "manifest_present": true, "certificate_count": 1.0, "checksum_mismatch": true, "computed_checksum": 2080475.0, "dos_stub_modified": true, "section_alignment": 4096.0, "cert_validity_days": 365.0, "number_of_sections": 8.0, "resource_timestamp": 0.0, "timestamp_pre_2000": true, "dll_characteristics": 32768.0, "leaf_thumbprint_sha1": "46cae9a9b56b48611597a60ec43aee2b3e5e08d4", "linker_major_version": 2.0, "linker_minor_version": 25.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 3560.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 2049112.0 }, "binary": { "code_size": 40448.0, "func_count": 135.0, "entry_point": 42488.0, "has_overlay": true, "code_entropy": 6.65, "data_entropy": 2.46, "func_density": 3.42, "import_count": 96.0, "overlay_size": 1839728.0, "string_count": 1129.0, "avg_func_size": 227.63, "has_signature": true, "overlay_ratio": 0.9, "section_count": 8.0, "avg_complexity": 4.38, "import_density": 2.43, "max_complexity": 46.0, "string_density": 28.58, "overall_entropy": 2.46, "overlay_entropy": 8.0, "avg_basic_blocks": 6.97, "avg_section_size": 25600.0, "dependency_count": 5.0, "entropy_variance": 2.62, "avg_string_length": 10.56, "complexity_per_kb": 0.11, "max_string_length": 628.0, "wide_string_count": 65.0, "writable_sections": 4.0, "avg_string_entropy": 2.45, "code_to_data_ratio": 0.25, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.08, "total_basic_blocks": 941.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_strings": 1.0, "string_length_stddev": 23.15, "largest_section_ratio": 0.08, "sentence_string_count": 74.0, "sentence_string_ratio": 0.07, "behavioral_import_ratio": 0.06, "nonstandard_section_name_count": 1.0 }, "consistency": { "cert_issued_after_build": true, "manifest_product_version_mismatch": true } }, "ss": [ [ 80, "This program must be run under Win32\r\n$7" ], [ 504, "CODE" ], [ 624, ".idata" ], [ 664, ".tls" ], [ 704, ".rdata" ], [ 743, "P.reloc" ], [ 783, "P.rsrc" ], [ 1026, "string" ], [ 1093, "Free" ], [ 1104, "InitInstance" ], [ 1123, "CleanupInstance" ], [ 1144, "ClassType" ], [ 1160, "ClassName" ], [ 1177, "ClassNameIs" ], [ 1195, "ClassParent" ], [ 1212, "ClassInfo" ], [ 1229, "InstanceSize" ], [ 1248, "InheritsFrom" ], [ 1267, "Dispatch" ], [ 1282, "MethodAddress" ], [ 1302, "MethodName" ], [ 1319, "FieldAddress" ], [ 1338, "DefaultHandler" ], [ 1359, "NewInstance" ], [ 1377, "FreeInstance" ], [ 1390, "TObject" ], [ 1836, "SVWUQ" ], [ 1952, "SVWU" ], [ 5471, "QSVW" ], [ 7664, "SVW1" ], [ 8133, "YYZX" ], [ 8291, "SPRQ" ], [ 8884, "ZTUWVSPRTj" ], [ 9133, "r6t0" ], [ 10164, "SVRP" ], [ 14059, "SVW3" ], [ 14796, "kernel32.dll" ], [ 14812, "SetDllDirectoryW" ], [ 14836, "SetSearchPathMode" ], [ 14856, "SetProcessDEPPolicy" ], [ 14962, "Exception" ], [ 15085, "EOutOfMemory" ], [ 15216, "EIntError" ], [ 15345, "ERangeError" ], [ 15409, "EIntOverflow" ], [ 15926, "j0h0" ], [ 16001, "EAccessViolation" ], [ 16073, "EPrivilege" ], [ 16137, "EStackOverflow" ], [ 16204, "EControlC" ], [ 16269, "EVariantError" ], [ 16337, "EExternalException" ], [ 17215, "9w7k" ], [ 18008, "SVWQ" ], [ 19008, "mmmm d, yyyy" ], [ 19080, "AMPM" ], [ 20287, "r3t7" ], [ 20792, "INFNANU" ], [ 25040, "TEMP" ], [ 25056, "USERPROFILE" ], [ 25916, "GetUserDefaultUILanguage" ], [ 25960, ".DEFAULT\\Control Panel\\International" ], [ 26000, "Locale" ], [ 26008, "Control Panel\\Desktop\\ResourceLocale" ], [ 26224, "[ExceptObject=nil]" ], [ 26405, "TCustomFile" ], [ 26593, "EFileError" ], [ 26744, "File I/O error %d" ], [ 27453, "ECompressError" ], [ 27521, "ECompressDataError" ], [ 27593, "ECompressInternalError" ], [ 27681, "TCustomDecompressor" ], [ 27769, "TCompressedBlockReader" ], [ 28476, "Compressed block is corrupted" ], [ 29029, "TLZMA1SmallDecompressorS" ], [ 29104, "lzmadecompsmall: Compressed data is corrupted (%d)" ], [ 29208, "lzmadecompsmall: %s" ], [ 29792, "LzmaDecode failed (%d)" ], [ 32786, "TSetupLanguageEntryA" ], [ 33336, "The setup files are corrupted. Please obtain a new copy of the program." ], [ 34124, "Wow64DisableWow64FsRedirection" ], [ 34172, "Wow64RevertWow64FsRedirection" ], [ 34212, "shell32.dll" ], [ 34613, "QQQQQQQQSVW" ], [ 34872, ".tmp" ], [ 35012, "SeShutdownPrivilege" ], [ 35988, "/SPAWNWND=" ], [ 36024, "/HELP" ], [ 37104, "The Setup program accepts optional command line parameters." ], [ 37178, "Shows this information." ], [ 37209, "Disables the This will install... Do you wish to continue? prompt at the beginning of Setup." ], [ 37303, "/SILENT, /VERYSILENT" ], [ 37325, "Instructs Setup to be silent or very silent." ], [ 37371, "/SUPPRESSMSGBOXES" ], [ 37390, "Instructs Setup to suppress message boxes." ], [ 37434, "/LOG" ], [ 37440, "Causes Setup to create a log file in the user's TEMP directory." ], [ 37505, "/LOG=\"filename\"" ], [ 37522, "Same as /LOG, except it allows you to specify a fixed path/filename to use for the log file." ], [ 37616, "/NOCANCEL" ], [ 37627, "Prevents the user from cancelling during the installation process." ], [ 37695, "/NORESTART" ], [ 37707, "Prevents Setup from restarting the system following a successful installation, or after a Preparing to Install failure that requ" ], [ 37852, "/RESTARTEXITCODE=exit code" ], [ 37880, "Specifies a custom exit code that Setup is to return when the system needs to be restarted." ], [ 37973, "/CLOSEAPPLICATIONS" ], [ 37994, "nstructs Setup to close applications using files that need to be updated." ], [ 38069, "/NOCLOSEAPPLICATIONS" ], [ 38091, "Prevents Setup from closing appU" ], [ 38778, "older check box.\r\n/TYPE=type name\r\nOverrides the default setup type.\r\n/COMPONENTS=\"comma separated list of component names\"\r\nOve" ], [ 38796, "/TYPE=type name" ], [ 38813, "Overrides the default setup type." ], [ 38848, "/COMPONENTS=\"comma separated list of component names\"" ], [ 38903, "Overrides the default component settings." ], [ 38946, "/TASKS=\"comma separated list of task names\"" ], [ 38991, "Specifies a list of tasks that should be initially selected." ], [ 39053, "/MERGETASKS=\"comma separated list of task names\"" ], [ 39103, "Like the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been select" ], [ 39247, "/PASSWORD=password" ], [ 39267, "Specifies the password to use." ], [ 39301, "For more detailed information, please visit http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" ], [ 39408, "Setup" ], [ 41196, "InnoSetupLdrWindow" ], [ 41216, "STATIC" ], [ 41232, "/SL5=\"$%x,%d,%d," ], [ 41492, "Runtime error at 00000000" ], [ 41522, "Error" ], [ 41864, "Inno Setup Setup Data (5.5.0)" ], [ 41928, "Inno Setup Messages (5.5.3)" ], [ 42004, "0123456789ABCDEFGHIJKLMNOPQRSTUV" ], [ 43108, "DeleteCriticalSection" ], [ 43132, "LeaveCriticalSection" ], [ 43156, "EnterCriticalSection" ], [ 43180, "InitializeCriticalSection" ], [ 43208, "VirtualFree" ], [ 43222, "VirtualAlloc" ], [ 43238, "LocalFree" ], [ 43250, "LocalAlloc" ], [ 43264, "WideCharToMultiByte" ], [ 43286, "TlsSetValue" ], [ 43300, "TlsGetValue" ], [ 43314, "MultiByteToWideChar" ], [ 43336, "GetModuleHandleA" ], [ 43356, "GetLastError" ], [ 43372, "GetCommandLineA" ], [ 43390, "WriteFile" ], [ 43402, "SetFilePointer" ], [ 43420, "SetEndOfFile" ], [ 43436, "RtlUnwind" ], [ 43448, "ReadFile" ], [ 43460, "RaiseException" ], [ 43478, "GetStdHandle" ], [ 43494, "GetFileSize" ], [ 43508, "GetSystemTime" ], [ 43524, "GetFileType" ], [ 43538, "ExitProcess" ], [ 43552, "CreateFileA" ], [ 43566, "CloseHandle" ], [ 43578, "user32.dll" ], [ 43592, "MessageBoxA" ], [ 43604, "oleaut32.dll" ], [ 43620, "VariantChangeTypeEx" ], [ 43642, "VariantCopyInd" ], [ 43660, "VariantClear" ], [ 43676, "SysStringLen" ], [ 43692, "SysAllocStringLen" ], [ 43710, "advapi32.dll" ], [ 43726, "RegQueryValueExA" ], [ 43746, "RegOpenKeyExA" ], [ 43762, "RegCloseKey" ], [ 43776, "OpenProcessToken" ], [ 43796, "LookupPrivilegeValueA" ], [ 43846, "VirtualQuery" ], [ 43862, "VirtualProtect" ], [ 43910, "Sleep" ], [ 43918, "SizeofResource" ], [ 43936, "SetLastError" ], [ 43970, "SetErrorMode" ], [ 44002, "RemoveDirectoryA" ], [ 44034, "LockResource" ], [ 44050, "LoadResource" ], [ 44066, "LoadLibraryA" ], [ 44082, "IsDBCSLeadByte" ], [ 44100, "GetWindowsDirectoryA" ], [ 44124, "GetVersionExA" ], [ 44140, "GetUserDefaultLangID" ], [ 44164, "GetSystemInfo" ], [ 44180, "GetSystemDefaultLCID" ], [ 44204, "GetProcAddress" ], [ 44242, "GetModuleFileNameA" ], [ 44264, "GetLocaleInfoA" ], [ 44298, "GetFullPathNameA" ], [ 44332, "GetFileAttributesA" ], [ 44354, "GetExitCodeProcess" ], [ 44376, "GetEnvironmentVariableA" ], [ 44402, "GetCurrentProcess" ], [ 44450, "InterlockedExchange" ], [ 44472, "FormatMessageA" ], [ 44490, "FindResourceA" ], [ 44506, "DeleteFileA" ], [ 44520, "CreateProcessA" ], [ 44552, "CreateDirectoryA" ], [ 44598, "TranslateMessage" ], [ 44618, "SetWindowLongA" ], [ 44636, "PeekMessageA" ], [ 44652, "MsgWaitForMultipleObjects" ], [ 44694, "LoadStringA" ], [ 44708, "ExitWindowsEx" ], [ 44724, "DispatchMessageA" ], [ 44744, "DestroyWindow" ], [ 44760, "CreateWindowExA" ], [ 44778, "CallWindowProcA" ], [ 44806, "comctl32.dll" ], [ 44822, "InitCommonControls" ], [ 44858, "AdjustTokenPrivileges" ], [ 46594, "wide", "MAINICON" ], [ 46688, "\u0026#\"}335Ddbb" ], [ 47992, "543l" ], [ 48044, "544o" ], [ 48360, "JJO1" ], [ 48444, "MSQ7" ], [ 48736, "DEC_732" ], [ 49500, "887M" ], [ 50276, "qpn6gaf\u003cbde=loi4vsv!" ], [ 50836, "VTV8" ], [ 51507, "B143" ], [ 52008, "vxyXHIIn" ], [ 52650, "ykeed2" ], [ 52912, "872z" ], [ 53432, "EJHQ" ], [ 53828, "KJJS" ], [ 53904, "INNX" ], [ 54751, ";kkmRJLLy@\u003e?" ], [ 55112, "gdePCCF" ], [ 57755, "BLIL" ], [ 61380, "XVYL" ], [ 64647, "!kjkHLLL{CFI" ], [ 69268, "MCJY" ], [ 69723, "Otvv" ], [ 75603, "/JDI" ], [ 75835, "BCCA" ], [ 76300, "edi3AD@LNKMkNIM" ], [ 76352, "PNMrDCAKced2" ], [ 78255, "Ipgj" ], [ 78503, "6hei" ], [ 92067, "OJHJ" ], [ 93135, "aupu" ], [ 95016, "nno%ppq2{xx=~|}Ozy}Wxzy^uss^stwgrsrhprqhqrtfszxdxxvYzyzVx{zLvwyAloo/khl" ], [ 96128, "wuw\u0026tyw@qqqqbfe" ], [ 96268, "utqtwwwDtut)" ], [ 98775, "KJLO" ], [ 103720, "hkmXDFF" ], [ 107163, "Tahb" ], [ 110608, "mnnYQRO" ], [ 111760, "B@\u003e_.-0" ], [ 113680, "LGKZ434" ] ], "sz": 2049112, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: COMODO RSA Code Signing CA", "e": [ "COMODO RSA Code Signing CA" ], "i": "metadata/signed/developer::comodo-rsa-code-signing-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Supreme Mode (Alpha Criteria Ltd.)", "e": [ "Supreme Mode (Alpha Criteria Ltd.)" ], "i": "metadata/signed/developer::supreme-mode-alpha-criteria-ltd.", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: COMODO RSA Certification Authority", "e": [ "COMODO RSA Certification Authority" ], "i": "metadata/signed/developer::comodo-rsa-certification-authority", "l": 2 }, { "c": 1.0, "d": "Signed by Supreme Mode (Alpha Criteria Ltd.)", "e": [ "Supreme Mode (Alpha Criteria Ltd.)" ], "i": "metadata/signed/leaf::supreme-mode-alpha-criteria-ltd.", "l": 3 }, { "a": "T1059", "c": 0.8999999761581421, "d": "Inno Setup self-extracting installer", "e": [ "Inno Setup marker found" ], "i": "file/sfx/inno-setup", "l": 3 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "virussign.com_694c4382af888d60753cde18a687d840.vir" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.46" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp" ], "i": "objectives/impact/infect/binary/rewrite::tmp-extension-staging", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "35138b9a-5d96-4fbd-8e2d-a2440225f93a", "4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38", "e2011457-1546-43c5-a5fe-008deee3d3f0", "1f676c76-80e1-4239-95bb-83d0f6d0da78" ], "i": "objectives/command-and-control/channel/http::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1195", "c": 0.949999988079071, "d": "Inno Setup manifest assembly name", "e": [ "JR.Inno.Setup" ], "i": "well-known/malware/dropper/dragonbreath::inno-manifest-assembly", "l": 1 }, { "c": 0.800000011920929, "d": "Revert WoW64 filesystem redirection", "e": [ "Wow64RevertWow64FsRedirection" ], "i": "micro-behaviors/os/compat/wow64::wow64-revert-redirect", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 160256.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 1.0, "d": "JR.Inno.Setup side-by-side manifest decoy", "e": [ "name=\"JR.Inno.Setup\"" ], "i": "well-known/malware/trojan/elex/worm::elex-jr-inno-setup-manifest-decoy", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle", "nstructs Setup to close applications using files that need to be updated.", "/CLOSEAPPLICATIONS", "/NOCLOSEAPPLICATIONS", "RegCloseKey" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 160256.00" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-large-rsrc-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Read beyond end of file\tDisk full" ], "i": "micro-behaviors/mem/read::comsvcs-dump--rx-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "virussign.com_694c4382af888d60753cde18a687d840.vir" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage/control::exit-windows-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Initialize common controls library", "e": [ "InitCommonControls" ], "i": "micro-behaviors/ui/controls/widget::init-common-controls", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "virussign.com_694c4382af888d60753cde18a687d840.vir" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 3 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "SysAllocStringLen", "StringFileInfo", "string", "SysStringLen", "Format string too long", "LoadStringA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.9599999785423279, "d": "Overlay size at least 1 MiB", "e": [ "binary.overlay_size = 1839728.00" ], "i": "metadata/binary/layout::large-overlay-1mb", "l": 3 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://www.jrsoftware.org/ishelp/index.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "d": "overflow keyword", "e": [ "Floating point overflow", "Stack overflow\rControl-C hit", "Integer overflow Invalid floating point operation" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.8999999761581421, "d": "LzmaDec SDK function", "e": [ "LzmaDecode failed (%d)" ], "i": "micro-behaviors/data/compress/library::lzmadec", "l": 3 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage/control::destroy-window", "l": 2 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "iWr" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.46" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "a": "T1082,T1041", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "Causes Setup to create a log file in the user's TEMP directory.", "TEMP" ], "i": "objectives/exfiltration/stealer/system-info::windows-recon-output-file--rx-5", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "d": "TEMP environment variable", "e": [ "TEMP" ], "i": "micro-behaviors/os/env/vars/access::temp-var", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 941.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "a": "T1552.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "USERPROFILE" ], "i": "objectives/supply-chain/credential-theft/registry::js-env-home-cred--rx-5", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1195", "c": 0.949999988079071, "d": "Inno Setup manifest description", "e": [ "Inno Setup" ], "i": "well-known/malware/dropper/dragonbreath::inno-manifest-description", "l": 1 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 1.0, "d": "Makefile all target", "e": [ "lzmadecompsmall: Compressed data is corrupted (%d)", "lzmadecompsmall: %s" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "virussign.com_694c4382af888d60753cde18a687d840.vir" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "Like the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been select", "older check box.\r\n/TYPE=type name\r\nOverrides the default setup type.\r\n/COMPONENTS=\"comma separated list of component names\"\r\nOve" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-16", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 135.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 3 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1574", "c": 0.8999999761581421, "d": "Disable WoW64 filesystem redirection", "e": [ "Wow64DisableWow64FsRedirection" ], "i": "micro-behaviors/os/compat/wow64::wow64-disable-redirect", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 135.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Cert chain has only 2 entries", "e": [ "pe.cert_chain_depth = 2.00" ], "i": "metadata/signed/certificate::pe-cert-shallow-chain", "l": 3 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "d": "USERPROFILE environment variable", "e": [ "USERPROFILE" ], "i": "micro-behaviors/os/env/vars/user-info::userprofile-var", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1129.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.20)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "PE has an Authenticode signature", "e": [ "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-is-authenticode-signed", "l": 2, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "USERPROFILE" ], "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-media-folder--rx-2", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 3 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "GUI binary declares DPI awareness", "e": [ "true" ], "i": "metadata/build/manifest::pe-dpi-aware", "l": 2 }, { "c": 0.9599999785423279, "d": "PE overlay exceeds 1 MiB", "e": [ "binary.overlay_size = 1839728.00" ], "i": "metadata/binary/layout::overlay-over-1mb", "l": 3 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 160256)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "publicKeyToken=\"6595b64144ccf1df\"" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1129.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password" ], "i": "objectives/command-and-control/channel/tunnel/dmw::dmw-tunnel-pwd", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 28.58" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 1.0, "d": "Issued by Comodo Code Signing CA", "e": [ "COMODO RSA Code Signing CA" ], "i": "metadata/signed/certificate::pe-cert-issuer-comodo", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 708992537.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.90" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "USERPROFILE", "QQQQQQQQSVW", "MAINICON" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariableA" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.38" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.45" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-a", "l": 2 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "DispatchMessageA", "Dispatch" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-4", "l": 1, "m": "F0004" }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"name\":\"JR.Inno.Setup\",\"processor_architecture\":\"x86\",\"version\":\"1.0.0.0\",\"type\":\"win32\"},\"description\":\"I" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 96.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 135.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "Entry point in non-standard section", "e": [ "CODE (size: 40448, entropy: 6.65, perms: r-x)" ], "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "l": 1, "m": "F0001" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "d": "password keyword", "e": [ "/PASSWORD=password", "…password\r\nSpecifies the password to use.\r\n\r\nFor more det…", "Specifies the password to use.", "… by default.\r\n/PASSWORD=password\r\nSpecifies the password…", "… selected by default.\r\n/PASSWORD=password\r\nSpecifies the…" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "The Setup program accepts optional command line parameters." ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 1839728.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 3 }, { "c": 0.800000011920929, "d": "Borland CODE section name", "e": [ "CODE (perms: r-x)" ], "i": "metadata/lang/compiler/managed::borland-section-code", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 233472.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.07" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"processor_architecture\":\"x86\",\"public_key_token" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "USERPROFILE" ], "i": "objectives/evasion/process::exe-in-media-folder--rx-2", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 1839728.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 32768.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 1839728.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 4 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.90" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetUserDefaultUILanguage", "WideCharToMultiByte", "GetModuleFileNameA", "MsgWaitForMultipleObjects", "InnoSetupLdrWindow", "SetProcessDEPPolicy", "MultiByteToWideChar", "GetSystemDefaultLCID", "GetWindowsDirectoryA", "InitializeCriticalSection", "GetEnvironmentVariableA", "AdjustTokenPrivileges" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Artificially low entropy from padding", "e": [ "binary.overall_entropy = 2.46" ], "i": "metadata/binary/anomaly::artificially-low-entropy", "l": 3 }, { "a": "T1105", "c": 0.9599999785423279, "d": "Large overlay bundle component", "e": [ "binary.overlay_size = 1839728.00" ], "i": "objectives/command-and-control/dropper/execution/installer::large-overlay-bundle", "l": 1, "m": "B0022" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "PASSWORD=password" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.06" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 96.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 1.0, "d": "PE manifest version != VERSIONINFO product version", "e": [ "consistency.manifest_product_version_mismatch = 1.00" ], "i": "metadata/build/artifact::manifest-version-mismatch", "l": 4 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp predates 2000", "e": [ "pe.timestamp_pre_2000 = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027.009", "c": 0.699999988079071, "d": "Large overlay relative to file", "e": [ "binary.overlay_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1129.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 1.0, "d": "Manifest declares only Vista support", "e": [ "[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"name\":\"vista\"}, {\"guid\":\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\",\"name\":\"win7" ], "i": "metadata/build/manifest::pe-vista-only-manifest", "l": 3 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "virussign.com_694c4382af888d60753cde18a687d840.vir" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links comctl32.dll (InitCommonControls)", "e": [ "comctl32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (MessageBoxA, TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, ... +8 more)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links oleaut32.dll (VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen)", "e": [ "oleaut32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32.dll (RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, ... +1 more)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links kernel32.dll (DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, ... +66 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetModuleFileNameA", "ReadFile", "GetFileSize", "CreateFileA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "LockResource", "FindResourceA", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "FindResourceA", "SizeofResource", "LockResource", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-full-extraction", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 2, "m": "F0007" }, { "a": "T1529", "c": 0.9399999976158142, "d": "Privilege-enabled reboot API use", "e": [ "SeShutdownPrivilege", "AdjustTokenPrivileges", "ExitWindowsEx", "LookupPrivilegeValueA" ], "i": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "l": 3, "m": "B0029" }, { "c": 0.8999999761581421, "d": "High-entropy overlay with large resource section", "e": [ "binary.overlay_entropy = 8.00", "binary.has_overlay = 1.00", "binary.overall_entropy = 2.46", ".rsrc (size: 160256)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::highly-entropic-overlay-large-rsrc-low-entropy", "l": 4 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "CreateFileA", "binary.has_overlay = 1.00", "GetModuleFileNameA", "ReadFile", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_size = 1839728.00", "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Binary with encrypted overlay payload", "e": [ "binary.overlay_entropy = 8.00", "binary.overlay_size = 1839728.00", "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::binary-encrypted-overlay", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.9200000166893005, "d": "PE high-entropy overlay with loader APIs", "e": [ "binary.overlay_size = 1839728.00", "binary.has_overlay = 1.00", "GetFileSize", "binary.overlay_entropy = 8.00", "ReadFile", "CreateFileA", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::pe-encrypted-overlay-dropper", "l": 4, "m": "B0032" } ], "sha": "f34fdf9c02d396daee7156aedca425eded8976a4c9c73ede6ed2a19b1b4be0fa", "path": "virussign.com_694c4382af888d60753cde18a687d840.vir", "type": "pe" } ], "tv": "497e4" } }