{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.07571382, "rte": "az", "prob": 0.07571382 }, { "cls": 0, "raw": 0.02856028, "rte": "az/native", "prob": 0.02856028 }, { "cls": 0, "raw": 0.7384518, "rte": "az/pe", "prob": 0.7384518 } ], "prob": 0.07571382, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.07571382075548172, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T04:30:05Z" }, "path": "VirusShare_da9b25506ab644b1594aeb1ba5d452a8", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000/z\u003e", "l": 0, "n": [ { "c": 3, "d": "PE binary has trailing overlay data", "i": "metadata/binary/layout::has-overlay", "o": 0, "z": 25 } ], "x": true }, { "b": "eDt^emCaQe%nSawA!eU][4L{XB.MzP\u003eT/VkBAH#xEDkD/w]@e%FQMDKB.\u003e(pp6\u003ct{I:W]f4FUGv0e6hh2(", "l": 9132, "n": [ { "c": 3, "d": "NSIS self-extracting installer", "i": "file/sfx/nsis", "o": 9148, "z": 17 } ], "x": true }, { "b": "006}ty\u0026:Ysv@lg0r@+5SlU{WZwK{lEwnC/S9%kCMBvG$XwMiwXwDjZ\u003clVl*Xvrb{Gx(4uWx(dz", "l": 30380, "n": [ { "c": 2, "d": "Close handle", "i": "micro-behaviors/process/create/spawn::close-handle-dup", "o": 30396, "z": 11 } ], "x": true }, { "b": "v/Y8hBvG$XwM9q?wDmeWm}D^pz!a0bwKZxIwLMVJwMF\u003cilifO/Bvgg\u003eA+fcgp\u0026ZF:wPI[)mGt!]AcT]!y?i", "l": 30598, "n": [ { "c": 2, "d": "Get module file path", "i": "micro-behaviors/os/module/load::get-module-filename-dup", "o": 30614, "z": 18 } ], "x": true }, { "b": "Cxle^A+e:5z/Qb8007NJm}D^wwO(x.vruf:000Pim}D^fz/6u1zE=BPzE((H\u003eMag+Bxh%[B7]Mg000-oq!p5tA=M8so(BMN007mCy\u0026:Ysy?mG=007dzy\u0026:Ysv@MZhr@=4$m}D^gx(!5VA+e/XAa9l/r@-Nem@i9MvqF}Yy\u0026r*000095m@i9MvqFRQv}#5AzVAdBwNPW(ra{q-vpPurAreNvBwca:Bvyj\u003cz/L*Tp5)U4wNPW(l${WMv@}", "l": 30716, "n": [ { "c": 3, "d": "Query disk free space", "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "o": 30820, "z": 17 }, { "c": 2, "d": "Suppress error dialogs", "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "o": 30780, "z": 12 }, { "c": 2, "d": "CreateThread API name reference", "i": "micro-behaviors/process/threading/create::create-thread-text", "o": 30870, "z": 12 }, { "c": 2, "d": "INI driven file stager with process handoff", "i": "objectives/command-and-control/dropper/execution/loader::ini-driven-file-stager", "o": 30732, "z": 12 } ], "x": true }, { "b": "006[sy\u0026:Ysv@lg0k(:{=lVM:DBy^{Qy?lVF!b-6JBw#**A7jLTwLMVJwMF\u003ciQYTXsx()]Qx(4tX-SH3#BAg(gC%IAgz#@:LC4y", "l": 30956, "n": [ { "c": 2, "d": "CreateFile API string reference", "i": "micro-behaviors/fs/file/open::createfile-api", "o": 30972, "z": 10 }, { "c": 2, "d": "Build temporary file name via GetTempFileName", "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "o": 30986, "z": 16 } ], "x": true }, { "b": "r@/@py\u0026:Ysv{%EX006\u003epm}D^vD2[7sza58UwN/?2A^pZ^PAdL]BwN0@v)KToA+frk004GHm}D^pz!a0bwK{k", "l": 31040, "n": [ { "c": 2, "d": "GetSystemDirectory API string", "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "o": 31056, "z": 19 } ], "x": true }, { "b": "Bvf$SwL^z=v}x.50058.s7b/+mSirCx(mN1wLV=IwN//Zogq-NmnbG)e[w^m0077umq=TjvqfR3006+ll#(ZWraQq@r@?jWmRMWP", "l": 31122, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 31166, "z": 4 }, { "c": 2, "d": "Wait for process/object", "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "o": 31138, "z": 19 } ], "x": true }, { "b": "XDbxxvpRYsBzUD9r@:iulT:!Es7#L.z*b2#z^#\u0026GU(NBqs7#L.z*bk@B7]91wDk3%lU{WZwKyoFAai-]A+2dIn=?}5Bvf\u003eUAai-]A+4NDBytdH.2M]vAccv)y?W\u0026$z^^V%008Y[pJf(.lU{EQvSbW}wb@zbrb#zSyFX}*B-p5^zGL{V2()ngAaJ]$o\u003ewi+r@", "l": 31900, "n": [ { "c": 3, "d": "EmptyClipboard string reference", "i": "micro-behaviors/os/clipboard/access::empty-clipboard-text", "o": 31990, "z": 14 }, { "c": 3, "d": "OpenClipboard string reference", "i": "micro-behaviors/os/clipboard/access::open-clipboard-text", "o": 32008, "z": 13 }, { "c": 3, "d": "Win32 clipboard read and write access", "i": "micro-behaviors/os/clipboard/access::win32-clipboard-read-write", "o": 31970, "z": 16 }, { "c": 3, "d": "Clipboard read/write API context", "i": "objectives/collection/clipboard/capture::clipboard-access-api", "o": 31952, "z": 14 }, { "c": 2, "d": "Call window procedure", "i": "micro-behaviors/ui/window/manage/control::call-window-proc", "o": 31916, "z": 15 } ], "x": true }, { "b": "0rM8ewOU1KB8$=5wMF\u003cirz#s:gCQN[y?%7K4GYNuy?m9#pHX6Iv@}XJjowC)Bw#*@Bvf$.z/L", "l": 32206, "n": [ { "c": 2, "d": "Reference to USER32.dll", "i": "micro-behaviors/os/module/load::user32-dll-reference", "o": 32222, "z": 10 } ], "x": true }, { "b": "A@V{Rq!p5qyEr2Rz/L*Tm)]{8ga)9NyYG}8q+fw(y?lyYwPzj3x(v(\u003c006b3q+fz\u0026BvG$XwD", "l": 32352, "n": [ { "c": 2, "d": "Reference to GDI32.dll", "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "o": 32368, "z": 9 } ], "x": true }, { "b": "mSi9NwPyE.v{%E[z/bKPq+ftJoFXBRwnD5Z\u0026Sh}*xglYXzb$7YB.aRO?#M.!xglYXza!C=r@\u00260", "l": 32494, "n": [ { "c": 2, "d": "Reference to SHELL32.dll", "i": "micro-behaviors/os/module/load::shell32-dll-reference", "o": 32510, "z": 11 } ], "x": true }, { "b": "qE%GdA+eW3wLlPWmr?(lk$1:tp!rC#e[w^m001$UnO})GwLu/VBydBEB98CvC(PV3nO})GwLu/VBydsAwkcGNyH}2RhVMA^vp%dBx(!x6lVM:DBy+BLlR*Azr7]86e[w^m000MglVktjwNPW(nP5P\u003evqYN^000f6pI:PxzFs05Bzkf1x)Ks\u003c)F{40wL3=NBzkf1x)Ks\u003cwDk8oraf\u0026-o\u003ewfhA+e!Zz!@#vga)9NyYBCn000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FuIDyI4-bOpgVV\u003cxGnrT3ig5atMs:7%nSc0B]V7NASx!Nw=N8Rx-J2Jx8\u003c4Ox-J2JA@ZpZve$9zyYF2DASwc2aoiX/wb)[Qb(^]BnDrSdA@ZpZve$9zyYF2DASviZx-J2JBo2\u003eLx8(@Lx-JkPC(O@!v/QfxwDliuyxbESxAhDvA@Wr.w=Mltx-I@HwDllve=W0]lJz38z2!zMzVBUPaok)Kve$AIA@Y+KA@Wr.x-J2Jv/QrBBPt}LwDi5qx-J2Jv/QAEz2!IPyYF2DBo2\u003eLaok{LzVB$YzuaFMzVBhCwb).L", "l": 32744, "n": [ { "c": 3, "d": "Nullsoft NSIS installer marker", "i": "metadata/binary/installer/script::nsis", "o": 33360, "z": 128 }, { "c": 3, "d": "Reads and writes to INI configuration files", "i": "micro-behaviors/fs/config/system::ini-read-write-cycle", "o": 33120, "z": 24 }, { "c": 3, "d": "Delete files (Windows API)", "i": "micro-behaviors/fs/file/delete::deletefile-w", "o": 33088, "z": 11 }, { "c": 3, "d": "Perform file operation through shell", "i": "micro-behaviors/fs/shell-ops::shell-file-operation", "o": 33164, "z": 16 }, { "c": 3, "d": "Modify file creation/access/write times", "i": "micro-behaviors/fs/sync/fsync::set-file-time", "o": 33040, "z": 11 }, { "c": 3, "d": "Temp directory staging primitives", "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "o": 33000, "z": 11 }, { "c": 3, "d": "Write data to clipboard", "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "o": 33232, "z": 16 }, { "c": 3, "d": "Registry value write API", "i": "micro-behaviors/os/registry/access::registry-set-value-api", "o": 32808, "z": 14 }, { "c": 3, "d": "Registry open create and write APIs", "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "o": 32772, "z": 15 }, { "c": 3, "d": "Executes file or program via Windows ShellExecute API", "i": "micro-behaviors/process/create/shell/invoke::win-shellexecute", "o": 33148, "z": 15 }, { "c": 3, "d": "Create process (Unicode)", "i": "micro-behaviors/process/create/spawn::create-process-w", "o": 32972, "z": 14 }, { "c": 2, "d": "Directory walker using Win32 wide APIs", "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "o": 33100, "z": 9 }, { "c": 2, "d": "Peek message (Unicode)", "i": "micro-behaviors/os/message/queue::peek-message-w", "o": 33288, "z": 12 }, { "c": 2, "d": "Reference to ADVAPI32.dll", "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "o": 32760, "z": 12 }, { "c": 2, "d": "Dynamically resolve own modules and exports", "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "o": 33012, "z": 14 }, { "c": 2, "d": "Get Windows installation directory", "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "o": 32920, "z": 20 }, { "c": 2, "d": "Create thread in current process", "i": "micro-behaviors/process/thread/create::create-thread", "o": 32960, "z": 12 }, { "c": 2, "d": "Add masked image", "i": "micro-behaviors/ui/controls/widget::image-list-add-masked", "o": 32828, "z": 19 }, { "c": 2, "d": "Load cursor resource", "i": "micro-behaviors/ui/controls/widget::load-cursor", "o": 33204, "z": 11 }, { "c": 2, "d": "Close dialog and return result", "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "o": 33328, "z": 9 }, { "c": 2, "d": "Create brush object", "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "o": 32868, "z": 19 }, { "c": 2, "d": "Set background mode (opaque/transparent)", "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "o": 32848, "z": 9 }, { "c": 2, "d": "Enable/disable menu item", "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "o": 33180, "z": 14 }, { "c": 2, "d": "Move to previous character", "i": "micro-behaviors/ui/window/manage/control::char-prev", "o": 33272, "z": 9 }, { "c": 2, "d": "Create window (extended)", "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "o": 33340, "z": 15 }, { "c": 2, "d": "Default window procedure", "i": "micro-behaviors/ui/window/manage/control::def-window-proc", "o": 33308, "z": 14 }, { "c": 2, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "i": "objectives/anti-analysis/sandbox-detect/tool-references::hardware-fingerprint-cluster", "o": 33256, "z": 16 }, { "c": 2, "d": "Self copy append and relaunch", "i": "objectives/command-and-control/dropper/execution/loader::self-copy-relaunch-loader", "o": 32892, "z": 12 } ], "x": true }, { "b": "e=W0]b(?DQb(/j\u003e00000qVHweqVHFhBPuH-wb{JFCk#HXpYLIox-JqRx-I@HwDluywDhYgk(Z(+00000e=Y$", "l": 33824, "n": [ { "c": 3, "d": "Shutdown privilege name string", "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "o": 33840, "z": 19 } ], "x": true }, { "b": "kl9?D00000q#/R)pYHE}q#/t!o-N#\u002600000oAn#hCk}QytMv.6wDlMEz#Y\u003eraoj4{", "l": 33920, "n": [ { "c": 2, "d": "TEMP environment variable", "i": "micro-behaviors/os/env/vars/access::temp-var", "o": 33936, "z": 4 } ], "x": true }, { "b": "00000p5)SYquf5:00000p5[h)nDqV?aoj?gASyaWzVB!T00000mf4udASy1TASviZCk#T-x-F", "l": 33976, "n": [ { "c": 1, "d": "NSIS runtime error title in data", "i": "metadata/binary/installer/script::nsis-error-title-data", "o": 33992, "z": 10 } ], "x": true }, { "b": "y\u0026\u0026VGoKR*KBZX]]00000m}D^gx(!5VA+e/XAa9l/mr?(lq!p5swObv[y\u0026\u00266Yy^.#TwN/?2A+P9a00000ogq.", "l": 34560, "n": [ { "c": 3, "d": "Query disk free space", "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "o": 34576, "z": 19 } ], "x": true }, { "b": "%nSc0%a%MEm?2!z3ig5a4m%8UqucW$0000100\u0026=e003nASaD2fm$:D4k#-9.)r%nc", "l": 103867, "n": [ { "c": 2, "d": "PNG and manifest in resources", "i": "metadata/binary/resource::png-and-manifest-rsrc", "o": 103883, "z": 4 } ], "x": true }, { "b": "000i600000002*$gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!000xb1ooC", "l": 160158, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 160174, "z": 15 } ], "x": true }, { "b": "fAr{fwDjK!002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg002:]zVB!Twb]Bave$uGA@Wr.q#*Ffve$cA001RLG8+]LmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002:]zVB!Twb]Bave$uGA@Wr.x-JhOaolV!zVB[WASviZw=M\u0026KwDlowwb{JFz2+WUw=M\u0026KzVBROaoluXve$uGA@Zy:zVB!Twb).LA@ZpZASxUJA@ZmYe=W0]m/W92zuakFASxIFBo2\u003eLaok*IzuahEaolD.wDliuBPuBZwDlJDC(O@!A@ZpZzVB!TwDi?MA@ZpZASy1TzuaqH", "l": 160310, "n": [ { "c": 2, "d": "PE with version resource and broad imports", "i": "metadata/binary/layout::import-rich-versioned-pe", "o": 160420, "z": 130 }, { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 160326, "z": 11 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 160386, "z": 15 } ], "x": true }, { "b": "v/QoAe=U\u003eK002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WQaf-S*af-T0fe=WT", "l": 160674, "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 160690, "z": 11 } ], "x": true }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0dg5%3eaokdpzVB!Twb]Bave$uGA@Wr.q#*Ffve$cA00000g5}QX0rt{@ASy1Twb{-Lv/QPJp5[Y5z2!bE00000p5]hjASxRIpYK]7A@ZmY00000gYN^Y0rt{@ASy1Twb{-Lv/QPJrSDXhASydXx-J5Kzu6UpgYPcdf-S{de=WQagxmyP", "l": 160764, "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 160780, "z": 9 }, { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 160850, "z": 11 }, { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 160902, "z": 14 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 160876, "z": 8 } ], "x": true }, { "b": "Bo31PzVBUP000002)xq(ju[7cy-)[jA=U@kzAPf#e?!E(wO#0@wnb{]jT9)9mLcOzaAITkzE^f(z/fbHb6^:vb0OmNvrlH3zdmsbaB4:tzGv@+B-IvXB7n({zddGqze0H2z/Y\u0026eBs?0vz8#9Dz7Y#^a%p-hzFrY]B97C]A=U@kzAPf#e?!FkjyJqLwO\u003e))C$zKTzGGPmC{4owA=U@kzAPf#e?![i", "l": 161000, "n": [ { "c": 1, "d": "NSIS exehead assembly manifest", "i": "metadata/binary/installer/script::nsis-manifest-exehead", "o": 161016, "z": 128 } ], "x": true }, { "b": "wPI%8wkEqXC4\u003e=7xjVcFjAt1MB.bSowN[kOwN/\u003e8x(v(.wP?T3az+RjwO:HNvrk1TC5IecAV#SGx*DlswPI]Qb4+n1B7DKGk0gGswPq\u003c7B97#7p\u0026Zn[x(4u[wPH3$flpYmB-IhrC(", "l": 161612, "n": [ { "c": 2, "d": "asInvoker manifest tag in resources", "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "o": 161628, "z": 61 } ], "x": true } ], "idn": { "trust": "unsigned", "project": { "value": "NordPass", "source": "pe.version.product_name", "verified": false }, "version": { "value": "4.11.13.20509", "source": "pe.version.file_version", "verified": false }, "organization": { "value": "NordPass Team", "source": "pe.version.company", "verified": false } }, "mol": "O(Co)H₄(F₅Os₆Po₃U)Md(Bi₂)", "sha": "ff1a0ae4191ecb8312f95ddf40402e374a3e11ebf99fb196d79547bb62166ecf", "fact": { "id": "pe", "imp": [ [ "kernel32", "SetEnvironmentVariableW" ], [ "kernel32", "SetFileAttributesW" ], [ "kernel32", "Sleep" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "CopyFileW" ], [ "kernel32", "SetCurrentDirectoryW" ], [ "kernel32", "GetFileAttributesW" ], [ "kernel32", "GetWindowsDirectoryW" ], [ "kernel32", "GetTempPathW" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetVersion" ], [ "kernel32", "SetErrorMode" ], [ "kernel32", "lstrlenW" ], [ "kernel32", "lstrcpynW" ], [ "kernel32", "GetDiskFreeSpaceW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetShortPathNameW" ], [ "kernel32", "CreateThread" ], [ "kernel32", "GetLastError" ], [ "kernel32", "CreateDirectoryW" ], [ "kernel32", "CreateProcessW" ], [ "kernel32", "RemoveDirectoryW" ], [ "kernel32", "lstrcmpiA" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "GetTempFileNameW" ], [ "kernel32", "WriteFile" ], [ "kernel32", "lstrcpyA" ], [ "kernel32", "MoveFileExW" ], [ "kernel32", "lstrcatW" ], [ "kernel32", "GetSystemDirectoryW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetExitCodeProcess" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "lstrcmpiW" ], [ "kernel32", "MoveFileW" ], [ "kernel32", "GetFullPathNameW" ], [ "kernel32", "SetFileTime" ], [ "kernel32", "SearchPathW" ], [ "kernel32", "CompareFileTime" ], [ "kernel32", "lstrcmpW" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "ExpandEnvironmentStringsW" ], [ "kernel32", "GlobalFree" ], [ "kernel32", "GlobalLock" ], [ "kernel32", "GlobalUnlock" ], [ "kernel32", "GlobalAlloc" ], [ "kernel32", "FindFirstFileW" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "DeleteFileW" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "ReadFile" ], [ "kernel32", "FindClose" ], [ "kernel32", "lstrlenA" ], [ "kernel32", "MulDiv" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "GetPrivateProfileStringW" ], [ "kernel32", "WritePrivateProfileStringW" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "GetModuleHandleW" ], [ "user32", "GetSystemMenu" ], [ "user32", "SetClassLongW" ], [ "user32", "EnableMenuItem" ], [ "user32", "IsWindowEnabled" ], [ "user32", "SetWindowPos" ], [ "user32", "GetSysColor" ], [ "user32", "GetWindowLongW" ], [ "user32", "SetCursor" ], [ "user32", "LoadCursorW" ], [ "user32", "CheckDlgButton" ], [ "user32", "GetMessagePos" ], [ "user32", "LoadBitmapW" ], [ "user32", "CallWindowProcW" ], [ "user32", "IsWindowVisible" ], [ "user32", "CloseClipboard" ], [ "user32", "SetClipboardData" ], [ "user32", "EmptyClipboard" ], [ "user32", "OpenClipboard" ], [ "user32", "ScreenToClient" ], [ "user32", "GetWindowRect" ], [ "user32", "GetDlgItem" ], [ "user32", "GetSystemMetrics" ], [ "user32", "SetDlgItemTextW" ], [ "user32", "GetDlgItemTextW" ], [ "user32", "MessageBoxIndirectW" ], [ "user32", "CharPrevW" ], [ "user32", "CharNextA" ], [ "user32", "wsprintfA" ], [ "user32", "DispatchMessageW" ], [ "user32", "PeekMessageW" ], [ "user32", "ReleaseDC" ], [ "user32", "EnableWindow" ], [ "user32", "InvalidateRect" ], [ "user32", "SendMessageW" ], [ "user32", "DefWindowProcW" ], [ "user32", "BeginPaint" ], [ "user32", "GetClientRect" ], [ "user32", "FillRect" ], [ "user32", "DrawTextW" ], [ "user32", "EndDialog" ], [ "user32", "RegisterClassW" ], [ "user32", "SystemParametersInfoW" ], [ "user32", "CreateWindowExW" ], [ "user32", "GetClassInfoW" ], [ "user32", "DialogBoxParamW" ], [ "user32", "CharNextW" ], [ "user32", "ExitWindowsEx" ], [ "user32", "DestroyWindow" ], [ "user32", "GetDC" ], [ "user32", "SetTimer" ], [ "user32", "SetWindowTextW" ], [ "user32", "LoadImageW" ], [ "user32", "SetForegroundWindow" ], [ "user32", "ShowWindow" ], [ "user32", "IsWindow" ], [ "user32", "SetWindowLongW" ], [ "user32", "FindWindowExW" ], [ "user32", "TrackPopupMenu" ], [ "user32", "AppendMenuW" ], [ "user32", "CreatePopupMenu" ], [ "user32", "EndPaint" ], [ "user32", "CreateDialogParamW" ], [ "user32", "SendMessageTimeoutW" ], [ "user32", "wsprintfW" ], [ "user32", "PostQuitMessage" ], [ "gdi32", "SelectObject" ], [ "gdi32", "SetBkMode" ], [ "gdi32", "CreateFontIndirectW" ], [ "gdi32", "SetTextColor" ], [ "gdi32", "DeleteObject" ], [ "gdi32", "GetDeviceCaps" ], [ "gdi32", "CreateBrushIndirect" ], [ "gdi32", "SetBkColor" ], [ "shell32", "SHGetSpecialFolderLocation" ], [ "shell32", "ShellExecuteExW" ], [ "shell32", "SHGetPathFromIDListW" ], [ "shell32", "SHBrowseForFolderW" ], [ "shell32", "SHGetFileInfoW" ], [ "shell32", "SHFileOperationW" ], [ "advapi32", "AdjustTokenPrivileges" ], [ "advapi32", "RegCreateKeyExW" ], [ "advapi32", "RegOpenKeyExW" ], [ "advapi32", "SetFileSecurityW" ], [ "advapi32", "OpenProcessToken" ], [ "advapi32", "LookupPrivilegeValueW" ], [ "advapi32", "RegEnumValueW" ], [ "advapi32", "RegDeleteKeyW" ], [ "advapi32", "RegDeleteValueW" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegSetValueExW" ], [ "advapi32", "RegQueryValueExW" ], [ "advapi32", "RegEnumKeyW" ], [ "comctl32", "ImageList_Create" ], [ "comctl32", "ImageList_AddMasked" ], [ "comctl32", "ImageList_Destroy" ], [ "comctl32", "ORDINAL 17" ], [ "ole32", "OleUninitialize" ], [ "ole32", "OleInitialize" ], [ "ole32", "CoTaskMemFree" ], [ "ole32", "CoCreateInstance" ] ], "met": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_overlay": 1.0, "overlay_end": 242137.0, "has_manifest": 1.0, "overlay_size": 79833.0, "checksum_valid": 0.0, "overlay_offset": 162304.0, "resource_count": 5.0, "overlay_padding": 79833.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 264800.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.2, "version.identity_symbol_ratio": 0.01 }, "file": { "size": 242137.0, "entropy": 6.6, "size_bytes": 242137.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 6.45, "data_entropy": 4.04, "overlay_size": 79833.0, "string_count": 353.0, "overlay_ratio": 0.33, "overall_entropy": 6.6, "overlay_entropy": 7.99, "entropy_variance": 0.74, "avg_string_length": 14.9, "max_string_length": 1070.0, "code_to_data_ratio": 0.95, "string_length_stddev": 57.95, "largest_section_ratio": 0.53, "sentence_string_count": 11.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 165.0 }, "sections": { "count": 5.0, "code_size": 26624.0, "entropy_max": 6.45, "entropy_mean": 5.12, "name_entropy": 2.97, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 1.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 7.0 } }, "sec": [ [ ".text", 1024, 26624, 6.45, "r-x" ], [ ".rdata", 27648, 5632, 5.03, "r--" ], [ ".data", 33280, 1536, 4.04, "rw-" ], [ ".ndata", 0, 0, 0.0, "rw-" ], [ ".rsrc", 34816, 127488, 4.98, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 184, "u8", "Rich" ], [ 464, "u8", ".text" ], [ 543, "u8", "@.data" ], [ 584, "u8", ".ndata" ], [ 624, "u8", ".rsrc" ], [ 4558, "u8", "jHjZW" ], [ 5951, "u8", "PSWV" ], [ 6320, "u8", "VQSPW" ], [ 6439, "u8", "QVPW" ], [ 6457, "u8", "SQVPW" ], [ 9166, "u8", "softuW" ], [ 12130, "u8", "WPWj0" ], [ 12416, "u8", "SUVW" ], [ 12681, "u8", "UUUUW" ], [ 15480, "u8", "u Pj" ], [ 18221, "u8", "SVW3" ], [ 18329, "u8", "uDWWh" ], [ 19198, "u8", "PVSW" ], [ 20760, "u8", "QSVW" ], [ 21237, "u8", "WWWS" ], [ 21593, "u8", "PPPU" ], [ 23711, "u8", "HtVHtHH" ], [ 26453, "u8", "M 9D" ], [ 26895, "u8", "M 9M" ], [ 28336, "u8", "UXTHEME" ], [ 28344, "u8", "USERENV" ], [ 28352, "u8", "SETUPAPI" ], [ 28361, "u8", "APPHELP" ], [ 28369, "u8", "PROPSYS" ], [ 28377, "u8", "DWMAPI" ], [ 28384, "u8", "CRYPTBASE" ], [ 28394, "u8", "OLEACC" ], [ 28401, "u8", "CLBCATQ" ], [ 28409, "u8", "NTMARTA" ], [ 28464, "u8", "RichEd32" ], [ 28476, "u8", "RichEd20" ], [ 30050, "u8", "MulDiv" ], [ 30060, "u8", "DeleteFileW" ], [ 30074, "u8", "FindFirstFileW" ], [ 30092, "u8", "FindNextFileW" ], [ 30108, "u8", "FindClose" ], [ 30120, "u8", "SetFilePointer" ], [ 30138, "u8", "ReadFile" ], [ 30150, "u8", "MultiByteToWideChar" ], [ 30172, "u8", "lstrlenA" ], [ 30184, "u8", "WideCharToMultiByte" ], [ 30206, "u8", "GetPrivateProfileStringW" ], [ 30234, "u8", "WritePrivateProfileStringW" ], [ 30264, "u8", "FreeLibrary" ], [ 30278, "u8", "LoadLibraryExW" ], [ 30296, "u8", "GetModuleHandleW" ], [ 30316, "u8", "GlobalAlloc" ], [ 30330, "u8", "GlobalFree" ], [ 30344, "u8", "ExpandEnvironmentStringsW" ], [ 30372, "u8", "lstrcmpW" ], [ 30384, "u8", "lstrcmpiW" ], [ 30396, "u8", "CloseHandle" ], [ 30410, "u8", "SetFileTime" ], [ 30424, "u8", "CompareFileTime" ], [ 30442, "u8", "SearchPathW" ], [ 30456, "u8", "GetShortPathNameW" ], [ 30476, "u8", "GetFullPathNameW" ], [ 30496, "u8", "MoveFileW" ], [ 30508, "u8", "SetCurrentDirectoryW" ], [ 30532, "u8", "GetFileAttributesW" ], [ 30554, "u8", "SetFileAttributesW" ], [ 30576, "u8", "Sleep" ], [ 30584, "u8", "GetTickCount" ], [ 30600, "u8", "GetFileSize" ], [ 30614, "u8", "GetModuleFileNameW" ], [ 30636, "u8", "GetCurrentProcess" ], [ 30656, "u8", "CopyFileW" ], [ 30668, "u8", "ExitProcess" ], [ 30682, "u8", "SetEnvironmentVariableW" ], [ 30708, "u8", "GetWindowsDirectoryW" ], [ 30732, "u8", "GetTempPathW" ], [ 30748, "u8", "GetCommandLineW" ], [ 30766, "u8", "GetVersion" ], [ 30780, "u8", "SetErrorMode" ], [ 30796, "u8", "lstrlenW" ], [ 30808, "u8", "lstrcpynW" ], [ 30820, "u8", "GetDiskFreeSpaceW" ], [ 30840, "u8", "GlobalUnlock" ], [ 30856, "u8", "GlobalLock" ], [ 30870, "u8", "CreateThread" ], [ 30886, "u8", "GetLastError" ], [ 30902, "u8", "CreateDirectoryW" ], [ 30922, "u8", "CreateProcessW" ], [ 30940, "u8", "RemoveDirectoryW" ], [ 30960, "u8", "lstrcmpiA" ], [ 30972, "u8", "CreateFileW" ], [ 30986, "u8", "GetTempFileNameW" ], [ 31006, "u8", "WriteFile" ], [ 31018, "u8", "lstrcpyA" ], [ 31030, "u8", "MoveFileExW" ], [ 31044, "u8", "lstrcatW" ], [ 31056, "u8", "GetSystemDirectoryW" ], [ 31078, "u8", "GetProcAddress" ], [ 31096, "u8", "GetModuleHandleA" ], [ 31116, "u8", "GetExitCodeProcess" ], [ 31138, "u8", "WaitForSingleObject" ], [ 31158, "u8", "KERNEL32.dll" ], [ 31174, "u8", "EndPaint" ], [ 31186, "u8", "DrawTextW" ], [ 31198, "u8", "FillRect" ], [ 31210, "u8", "GetClientRect" ], [ 31226, "u8", "BeginPaint" ], [ 31240, "u8", "DefWindowProcW" ], [ 31258, "u8", "SendMessageW" ], [ 31274, "u8", "InvalidateRect" ], [ 31292, "u8", "EnableWindow" ], [ 31308, "u8", "ReleaseDC" ], [ 31320, "u8", "GetDC" ], [ 31328, "u8", "LoadImageW" ], [ 31342, "u8", "SetWindowLongW" ], [ 31360, "u8", "GetDlgItem" ], [ 31374, "u8", "IsWindow" ], [ 31386, "u8", "FindWindowExW" ], [ 31402, "u8", "SendMessageTimeoutW" ], [ 31424, "u8", "wsprintfW" ], [ 31436, "u8", "ShowWindow" ], [ 31450, "u8", "SetForegroundWindow" ], [ 31472, "u8", "PostQuitMessage" ], [ 31490, "u8", "SetWindowTextW" ], [ 31508, "u8", "SetTimer" ], [ 31520, "u8", "CreateDialogParamW" ], [ 31542, "u8", "DestroyWindow" ], [ 31558, "u8", "ExitWindowsEx" ], [ 31574, "u8", "CharNextW" ], [ 31586, "u8", "DialogBoxParamW" ], [ 31604, "u8", "GetClassInfoW" ], [ 31620, "u8", "CreateWindowExW" ], [ 31638, "u8", "SystemParametersInfoW" ], [ 31662, "u8", "RegisterClassW" ], [ 31680, "u8", "EndDialog" ], [ 31692, "u8", "ScreenToClient" ], [ 31710, "u8", "GetWindowRect" ], [ 31726, "u8", "EnableMenuItem" ], [ 31744, "u8", "GetSystemMenu" ], [ 31760, "u8", "SetClassLongW" ], [ 31776, "u8", "IsWindowEnabled" ], [ 31794, "u8", "SetWindowPos" ], [ 31810, "u8", "GetSysColor" ], [ 31824, "u8", "GetWindowLongW" ], [ 31842, "u8", "SetCursor" ], [ 31854, "u8", "LoadCursorW" ], [ 31868, "u8", "CheckDlgButton" ], [ 31886, "u8", "GetMessagePos" ], [ 31902, "u8", "LoadBitmapW" ], [ 31916, "u8", "CallWindowProcW" ], [ 31934, "u8", "IsWindowVisible" ], [ 31952, "u8", "CloseClipboard" ], [ 31970, "u8", "SetClipboardData" ], [ 31990, "u8", "EmptyClipboard" ], [ 32008, "u8", "OpenClipboard" ], [ 32024, "u8", "TrackPopupMenu" ], [ 32042, "u8", "AppendMenuW" ], [ 32056, "u8", "CreatePopupMenu" ], [ 32074, "u8", "GetSystemMetrics" ], [ 32094, "u8", "SetDlgItemTextW" ], [ 32112, "u8", "GetDlgItemTextW" ], [ 32130, "u8", "MessageBoxIndirectW" ], [ 32152, "u8", "CharPrevW" ], [ 32164, "u8", "CharNextA" ], [ 32176, "u8", "wsprintfA" ], [ 32188, "u8", "DispatchMessageW" ], [ 32208, "u8", "PeekMessageW" ], [ 32222, "u8", "USER32.dll" ], [ 32236, "u8", "SelectObject" ], [ 32252, "u8", "SetTextColor" ], [ 32268, "u8", "SetBkMode" ], [ 32280, "u8", "CreateFontIndirectW" ], [ 32302, "u8", "CreateBrushIndirect" ], [ 32324, "u8", "DeleteObject" ], [ 32340, "u8", "GetDeviceCaps" ], [ 32356, "u8", "SetBkColor" ], [ 32368, "u8", "GDI32.dll" ], [ 32380, "u8", "SHFileOperationW" ], [ 32400, "u8", "SHGetFileInfoW" ], [ 32418, "u8", "SHBrowseForFolderW" ], [ 32440, "u8", "SHGetPathFromIDListW" ], [ 32464, "u8", "ShellExecuteExW" ], [ 32482, "u8", "SHGetSpecialFolderLocation" ], [ 32510, "u8", "SHELL32.dll" ], [ 32524, "u8", "RegEnumValueW" ], [ 32540, "u8", "RegEnumKeyW" ], [ 32554, "u8", "RegQueryValueExW" ], [ 32574, "u8", "RegSetValueExW" ], [ 32592, "u8", "RegCloseKey" ], [ 32606, "u8", "RegDeleteValueW" ], [ 32624, "u8", "RegDeleteKeyW" ], [ 32640, "u8", "AdjustTokenPrivileges" ], [ 32664, "u8", "LookupPrivilegeValueW" ], [ 32688, "u8", "OpenProcessToken" ], [ 32708, "u8", "SetFileSecurityW" ], [ 32728, "u8", "RegOpenKeyExW" ], [ 32744, "u8", "RegCreateKeyExW" ], [ 32760, "u8", "ADVAPI32.dll" ], [ 32776, "u8", "ImageList_Destroy" ], [ 32796, "u8", "ImageList_AddMasked" ], [ 32818, "u8", "ImageList_Create" ], [ 32836, "u8", "COMCTL32.dll" ], [ 32852, "u8", "CoCreateInstance" ], [ 32872, "u8", "OleUninitialize" ], [ 32890, "u8", "OleInitialize" ], [ 32906, "u8", "CoTaskMemFree" ], [ 32920, "u8", "ole32.dll" ], [ 34368, "u8", "VerQueryValueW" ], [ 34384, "u8", "GetFileVersionInfoW" ], [ 34404, "u8", "GetFileVersionInfoSizeW" ], [ 34428, "u8", "VERSION" ], [ 34436, "u8", "SHGetFolderPathW" ], [ 34456, "u8", "SHFOLDER" ], [ 34468, "u8", "SHAutoComplete" ], [ 34484, "u8", "SHLWAPI" ], [ 34492, "u8", "SHELL32" ], [ 34500, "u8", "InitiateShutdownW" ], [ 34520, "u8", "RegDeleteKeyExW" ], [ 34536, "u8", "ADVAPI32" ], [ 34548, "u8", "GetUserDefaultUILanguage" ], [ 34576, "u8", "GetDiskFreeSpaceExW" ], [ 34596, "u8", "SetDefaultDllDirectories" ], [ 34624, "u8", "KERNEL32" ], [ 34660, "u8", "[Rename]" ], [ 43800, "u8", "775T" ], [ 44320, "u8", "WWT_" ], [ 46143, "u8", "8PPMY" ], [ 46396, "u8", "PPMY" ], [ 52592, "u8", "110E" ], [ 55680, "u8", "WWUL" ], [ 62872, "u8", "8876" ], [ 103883, "u8", "IHDR" ], [ 103909, "u8", "IDATx" ], [ 104625, "u8", "Kkkk" ], [ 105772, "u8", "ysEUU" ], [ 106185, "u8", "gPEKo" ], [ 106347, "u8", "eeeo" ], [ 107482, "u8", "RPP0" ], [ 110295, "u8", "IBHP" ], [ 111538, "u8", "EEGNw" ], [ 112368, "u8", "o[N)" ], [ 112521, "u8", "7GTF" ], [ 112752, "u8", "HI6E" ], [ 113129, "u8", "nhm3M" ], [ 113955, "u8", "Chty" ], [ 115474, "u8", "FfV-X \u003e" ], [ 115620, "u8", "ieQSVjz" ], [ 116101, "u8", "WTNF" ], [ 116284, "u8", "look" ], [ 117847, "u8", "HIOOO" ], [ 118330, "u8", "OPzam" ], [ 118387, "u8", "HINNN" ], [ 118749, "u8", "Dnnne" ], [ 119542, "u8", "_xaeRrr" ], [ 120505, "u8", "azOn" ] ], "val": { "file.stem": "VirusShare_da9b25506ab644b1594aeb1ba5d452a8", "pe.imphash": "6686769daa42a7400234c4e5d945790e", "pe.machine": "i386", "pe.rich.key": 3529920745, "pe.rich.hash": "f05a488cd83d3aa2b72c1ddefe58cfce", "pe.subsystem": "windows_gui", "pe.timestamp": 1544912774, "file.basename": "VirusShare_da9b25506ab644b1594aeb1ba5d452a8", "pe.image_base": 4194304, "pe.image_size": 1634304, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 13199, "pe.headers_size": 1024, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "cd61e1798c917bfacb4ba929fcb92dbdabe0e86f", "pe.version.company": "NordPass Team", "pe.image_hash.sha256": "015117fd8fc66381947137ab96a60d825d237309e7149c6a0ef1659bb28641f5", "pe.image_hash.sha384": "6f88f1eb4439fa291d60a4691d0b12bec896fe52c37d92570ec02af05b66a58add4dc623db951adb81eb4984494a39dd", "pe.image_hash.sha512": "c17b9c1ff914874595d1a155da7e3e6294a4ddc2007292f12a55714910d62def2aa5fe30b6799afb4c9285210388f1cdd724848164fce3b3b82a7676a8c5fb5b", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 2021 NordPass Team", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 271, "pe.version.description": "NordPass is your freedom from password stress. Generate and securely store strong passwords and autofill them with a single click.", "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 6, "pe.manifest.description": "Nullsoft Install System v27-Nov-2019.cvs", "pe.version.file_version": "4.11.13.20509", "pe.version.product_name": "NordPass", "build.toolchain.compiler": "msvc", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.version.company_offset": 160352, "pe.data_directories[0].rva": 34320, "pe.data_directories[1].rva": 1503232, "pe.data_directories[2].rva": 32768, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "4.11.13", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 160, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 127272, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 688, "pe.manifest.dependencies[0]": "Microsoft.Windows.Common-Controls@6.0.0.0", "pe.manifest.supported_os[0]": "{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}", "pe.manifest.supported_os[1]": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[2]": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[3]": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.rich.entries[0].build_id": 95, "pe.rich.entries[1].build_id": 1, "pe.rich.entries[2].build_id": 93, "pe.rich.entries[3].build_id": 48, "pe.rich.entries[4].build_id": 6, "pe.version.copyright_offset": 160780, "pe.rich.entries[0].use_count": 2, "pe.rich.entries[1].use_count": 165, "pe.rich.entries[2].use_count": 15, "pe.rich.entries[3].use_count": 10, "pe.rich.entries[4].use_count": 1, "pe.coff.dos_header_pe_pointer": 216, "pe.rich.entries[0].product_id": 4035, "pe.rich.entries[2].product_id": 4035, "pe.rich.entries[3].product_id": 9044, "pe.rich.entries[4].product_id": 1735, "pe.version.description_offset": 160420, "pe.version.file_version_offset": 160716, "pe.version.product_name_offset": 160876, "pe.version.product_version_offset": 160932, "pe.manifest.assembly_identity.name": "Nullsoft.NSIS.exehead", "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker" } }, "find": [ { "id": "file/sfx/nsis", "atk": "T1059", "conf": 0.8999999761581421, "crit": 3, "desc": "NSIS self-extracting installer" }, { "id": "micro-behaviors/os/clipboard/access::open-clipboard", "conf": 0.75, "crit": 3, "desc": "Open clipboard access" }, { "id": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "conf": 0.6000000238418579, "crit": 1, "desc": "Clipboard keyword" }, { "id": "metadata/binary/resource::asinvoker-resource-manifest-flex", "conf": 0.8600000143051147, "crit": 2, "desc": "asInvoker manifest tag in resources" }, { "id": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Query registry value via import symbol" }, { "id": "micro-behaviors/data/text/keywords/lexicon::password", "crit": 1, "desc": "password keyword" }, { "id": "micro-behaviors/os/clipboard/access::empty-clipboard", "conf": 0.75, "crit": 3, "desc": "Clear clipboard contents" }, { "id": "micro-behaviors/os/clipboard/access::set-clipboard-data", "conf": 0.800000011920929, "crit": 3, "desc": "Write data to clipboard" }, { "id": "micro-behaviors/fs/temp/directory::get-temp-file-name", "conf": 0.75, "crit": 2, "desc": "Build temporary file name via GetTempFileName" }, { "id": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "atk": "T1112", "conf": 0.8500000238418579, "crit": 2, "desc": "Create registry key via WinAPI" }, { "id": "metadata/binary/installer/script::nullsoft-install-system-rsrc", "conf": 0.949999988079071, "crit": 1, "desc": "Nullsoft Install System in resources" }, { "id": "micro-behaviors/fs/file/open::file-create-win", "conf": 0.8999999761581421, "crit": 2, "desc": "Windows file creation/open API" }, { "id": "micro-behaviors/process/create/exec::shell-execute-ex", "atk": "T1059.001", "conf": 0.75, "crit": 3, "desc": "Execute shell command (ShellExecuteExW)" }, { "id": "micro-behaviors/os/clipboard/access::open-clipboard-text", "conf": 0.7400000095367432, "crit": 3, "desc": "OpenClipboard string reference" }, { "id": "micro-behaviors/os/clipboard/access::close-clipboard", "conf": 0.6499999761581421, "crit": 3, "desc": "Close clipboard" }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports" }, { "id": "micro-behaviors/fs/enumerate/directory::find-next-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Directory enumeration" }, { "id": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "conf": 0.6600000262260437, "crit": 2, "desc": "Look up temp directory via GetTempPath" }, { "id": "micro-behaviors/process/create/spawn::create-process-w", "atk": "T1106", "conf": 0.949999988079071, "crit": 3, "desc": "Create process (Unicode)" }, { "id": "metadata/binary/resource::png-resource-marker", "conf": 0.8399999737739563, "crit": 2, "desc": "PNG image data in PE resources" }, { "id": "micro-behaviors/fs/shell-ops::browse-for-folder", "conf": 0.699999988079071, "crit": 3, "desc": "Display folder browse dialog" }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Begin directory enumeration" }, { "id": "micro-behaviors/process/info/current::get-module-filename", "conf": 0.699999988079071, "crit": 2, "desc": "GetModuleFileName API call" }, { "id": "micro-behaviors/ui/controls/widget::get-system-metrics", "conf": 0.699999988079071, "crit": 2, "desc": "Query system metrics" }, { "id": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Open registry key via import symbol" }, { "id": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "atk": "T1112", "conf": 0.8500000238418579, "crit": 2, "desc": "Set registry value via WinAPI" }, { "id": "micro-behaviors/fs/file/move::move-file-ex", "conf": 0.8999999761581421, "crit": 2, "desc": "Move or rename file with options" }, { "id": "metadata/binary/layout::large-overlay-64k", "conf": 0.949999988079071, "crit": 3, "desc": "Overlay size at least 64 KiB" }, { "id": "micro-behaviors/fs/enumerate/directory::find-close", "conf": 0.8999999761581421, "crit": 2, "desc": "Close directory enumeration handle" }, { "id": "micro-behaviors/fs/file/handle::set-file-pointer", "conf": 0.8999999761581421, "crit": 2, "desc": "Set file position" }, { "id": "metadata/binary/installer/script::nsis-manifest-exehead", "conf": 0.9800000190734863, "crit": 1, "desc": "NSIS exehead assembly manifest" }, { "id": "micro-behaviors/fs/path/check::get-module-filename", "conf": 0.8500000238418579, "crit": 2, "desc": "Query current module path" }, { "id": "micro-behaviors/fs/file/write/direct::write-file", "conf": 0.8999999761581421, "crit": 2, "desc": "Write data to file handle" }, { "id": "micro-behaviors/fs/config/system::write-private-profile", "conf": 0.75, "crit": 2, "desc": "Write to INI config file" }, { "id": "micro-behaviors/os/module/load::get-module-handle-ansi", "conf": 0.699999988079071, "crit": 2, "desc": "Get module handle ANSI" }, { "id": "metadata/package/versioning::pe-product-name-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE ProductName field is populated" }, { "id": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "conf": 0.8999999761581421, "crit": 2, "desc": "Get Windows installation directory" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "micro-behaviors/os/clipboard/access::close-clipboard-text", "conf": 0.699999988079071, "crit": 3, "desc": "CloseClipboard string reference" }, { "id": "metadata/package/versioning::pe-file-description-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE FileDescription field is populated" }, { "id": "metadata/binary/installer/script::nsis-error-url-data", "conf": 1.0, "crit": 1, "desc": "NSIS runtime error URL in data" }, { "id": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "atk": "T1082", "conf": 0.8999999761581421, "crit": 3, "desc": "Query disk free space" }, { "id": "micro-behaviors/fs/config/system::read-private-profile", "conf": 0.6499999761581421, "crit": 2, "desc": "Read from INI config file" }, { "id": "micro-behaviors/fs/file/delete::deletefile-w", "conf": 0.6600000262260437, "crit": 3, "desc": "Delete files (Windows API)" }, { "id": "micro-behaviors/time/query::get-tick-count", "conf": 0.8999999761581421, "crit": 2, "desc": "Get tick count" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" }, { "id": "micro-behaviors/os/module/load::get-module-handle-wide", "conf": 0.7799999713897705, "crit": 2, "desc": "Get module handle Unicode" }, { "id": "metadata/package/versioning::pe-legal-copyright-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE LegalCopyright field is populated" }, { "id": "micro-behaviors/fs/shell-ops::shell-file-operation", "conf": 0.75, "crit": 3, "desc": "Perform file operation through shell" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "micro-behaviors/fs/sync/fsync::set-file-time", "conf": 0.8500000238418579, "crit": 3, "desc": "Modify file creation/access/write times" }, { "id": "micro-behaviors/os/clipboard/access::empty-clipboard-text", "conf": 0.7400000095367432, "crit": 3, "desc": "EmptyClipboard string reference" }, { "id": "metadata/binary/installer/script::nsis-error-title-data", "conf": 1.0, "crit": 1, "desc": "NSIS runtime error title in data" }, { "id": "micro-behaviors/os/clipboard/access::set-clipboard-data-text", "conf": 0.7799999713897705, "crit": 3, "desc": "SetClipboardData string reference" }, { "id": "micro-behaviors/ui/window/manage/control::exit-windows-ex", "conf": 0.8500000238418579, "crit": 3, "desc": "Shutdown/restart system" }, { "id": "micro-behaviors/os/registry/manipulate::reg-delete-value-w-symbol", "atk": "T1112", "conf": 0.8799999952316284, "crit": 3, "desc": "RegDeleteValueW registry value deletion" }, { "id": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "atk": "T1134.001", "conf": 0.7799999713897705, "crit": 3, "desc": "Shutdown privilege name string" }, { "id": "micro-behaviors/os/module/load::get-proc-address-import", "conf": 0.8999999761581421, "crit": 2, "desc": "Resolve exports with GetProcAddress" }, { "id": "micro-behaviors/os/security/descriptor::set-file-security", "conf": 0.8799999952316284, "crit": 3, "desc": "Apply file security descriptor" }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges", "conf": 0.800000011920929, "crit": 3, "desc": "Enable/disable privileges in access token" }, { "id": "micro-behaviors/fs/file/open::createfile-api", "conf": 0.8999999761581421, "crit": 2, "desc": "CreateFile API string reference" }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value", "conf": 0.75, "crit": 3, "desc": "Lookup privilege name to LUID" }, { "id": "metadata/binary/installer/script::nullsoft-install-system", "conf": 0.949999988079071, "crit": 1, "desc": "Nullsoft Install System marker" }, { "id": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "conf": 0.800000011920929, "crit": 3, "desc": "Temp directory staging primitives" }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value-any", "conf": 0.800000011920929, "crit": 3, "desc": "Lookup privilege name to LUID" }, { "id": "micro-behaviors/os/clipboard/access::win32-clipboard-read-write", "conf": 0.8199999928474426, "crit": 3, "desc": "Win32 clipboard read and write access" }, { "id": "metadata/binary/installer/script::nsis-error-title", "conf": 1.0, "crit": 1, "desc": "NSIS runtime error title marker" }, { "id": "micro-behaviors/os/registry/access::registry-create-key-api", "atk": "T1112", "conf": 0.8999999761581421, "crit": 3, "desc": "Registry key creation API" }, { "id": "objectives/collection/clipboard/capture::clipboard-context", "conf": 0.699999988079071, "crit": 2, "desc": "Clipboard handling context" }, { "id": "micro-behaviors/fs/config/system::ini-read-write-cycle", "conf": 0.800000011920929, "crit": 3, "desc": "Reads and writes to INI configuration files" }, { "id": "micro-behaviors/os/registry/access::registry-set-value-api", "atk": "T1112", "conf": 0.8999999761581421, "crit": 3, "desc": "Registry value write API" }, { "id": "micro-behaviors/os/registry/access::registry-open-key-api", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Registry key open API" }, { "id": "micro-behaviors/process/create/shell/invoke::win-shellexecute", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.8999999761581421, "crit": 3, "desc": "Executes file or program via Windows ShellExecute API" }, { "id": "micro-behaviors/os/registry/access::registry-query-value-api", "atk": "T1112", "conf": 0.8799999952316284, "crit": 2, "desc": "Registry value query API" }, { "id": "micro-behaviors/process/create/shell/invoke::win-createprocess", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.8999999761581421, "crit": 3, "desc": "Creates new process via Windows API" }, { "id": "metadata/binary/installer/script::nsis-error-url", "conf": 1.0, "crit": 1, "desc": "NSIS runtime error help URL" }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges-any", "conf": 0.8199999928474426, "crit": 3, "desc": "Enable or disable token privileges" }, { "id": "metadata/binary/installer/script::nsis", "conf": 0.949999988079071, "crit": 3, "desc": "Nullsoft NSIS installer marker" }, { "id": "micro-behaviors/os/registry/access::registry-write-api-chain", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Registry key and value write chain" }, { "id": "micro-behaviors/os/registry/access::registry-read-api-chain", "atk": "T1112", "conf": 0.8999999761581421, "crit": 2, "desc": "Registry key open and query chain" }, { "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability detected" }, { "id": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "atk": "T1112", "conf": 0.9200000166893005, "crit": 3, "desc": "Registry open create and write APIs" }, { "id": "objectives/collection/file-targeting/enumeration::file-enumeration-targeting", "atk": "T1083", "mbc": "C0000", "conf": 0.8500000238418579, "crit": 1, "desc": "File system enumeration pattern" }, { "id": "objectives/collection/clipboard/capture::clipboard-access-api", "conf": 0.800000011920929, "crit": 3, "desc": "Clipboard read/write API context" } ], "path": "VirusShare_da9b25506ab644b1594aeb1ba5d452a8", "risk": 16, "size": 242137, "type": "pe" } ] } }