{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9971691370010376, "class": 2, "threshold": 0.9922832250595093 } ], "prob": 0.99716914, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.99716914, "class": 2 }, { "m": "az/scripts", "prob": 0.99918854, "class": 2 }, { "m": "az/batch", "prob": 0.997449, "class": 0 } ], "version": "v17.17", "threshold": 0.9922832, "analyzed_at": "2026-05-30T15:03:04Z" }, "path": "0654ff358c3fc3d29dce0a06fc87a30523d77fddde7c5b2348d95775ac7630ce.bat", "raw": { "v": "5", "fs": [ { "f": "O(As₃)Md", "x": 40, "ff": { "m": { "file": { "size": 252838.0, "entropy": 5.72, "size_bytes": 252838.0 }, "text": { "digit_ratio": 0.1, "space_count": 69.0, "total_lines": 98.0, "char_entropy": 5.72, "unique_chars": 85.0, "lines_over_200": 70.0, "lines_over_500": 68.0, "avg_line_length": 2578.0, "lines_over_1000": 68.0, "max_line_length": 10280.0, "last_line_length": 10280.0, "long_token_count": 87.0, "whitespace_ratio": 0.0, "most_common_ratio": 0.14, "line_length_stddev": 1821.59, "repeated_char_sequences": 410.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 65.0 } }, "s": [ [ 0, "u8", "/* wppfkiudgoqfljmjaujzgpwe" ], [ 29, "u8", "set wppfkiudgoqfljmjaujzgpwexktjknvgjdmupoaxkmynzcfb=e" ], [ 85, "u8", "set wppfkiudgoqfljmjaujzgpweklklelqdzkaueaaymopvskbt=v" ], [ 141, "u8", "set wppfkiudgoqfljmjaujzgpwefkpbnwcqejstnbnkdiibaold=f" ], [ 197, "u8", "set wppfkiudgoqfljmjaujzgpwettbdczijcmzuqsvpruygmkjj=r" ], [ 253, "u8", "set wppfkiudgoqfljmjaujzgpwesydxeixnsdwfgkglbktmnyie=k" ], [ 309, "u8", "set wppfkiudgoqfljmjaujzgpwevrtnakuhavdkaezxrlsbpfis=b" ], [ 365, "u8", "set wppfkiudgoqfljmjaujzgpwewyotsvdfnxnzecdzgqdrhrzn=o" ], [ 421, "u8", "set wppfkiudgoqfljmjaujzgpwejsofalfwgcrqbmxceoeooejx=l" ], [ 477, "u8", "set wppfkiudgoqfljmjaujzgpwewfglovnclmamueswrkcvzqti=q" ], [ 533, "u8", "set wppfkiudgoqfljmjaujzgpwekxudrxcbdwggubghwlehrfmv=c" ], [ 589, "u8", "set wppfkiudgoqfljmjaujzgpweeubunujkjqinulugljmraimc=t" ], [ 645, "u8", "set wppfkiudgoqfljmjaujzgpwewiqpxmzaxsdfxbvwlaqrwycb=h" ], [ 701, "u8", "set wppfkiudgoqfljmjaujzgpweuzpuxarfhzhhacbtnwyurjmg=g" ], [ 757, "u8", "set wppfkiudgoqfljmjaujzgpwepfgoeoeuoxurplovjsjquobk=u" ], [ 813, "u8", "set wppfkiudgoqfljmjaujzgpwenmmzkkpwzttfkcmifyrrlakq=z" ], [ 869, "u8", "set wppfkiudgoqfljmjaujzgpwescazntzszyktcnlmuujniyid=j" ], [ 925, "u8", "set wppfkiudgoqfljmjaujzgpweavxwbutgimcptnjbgfupavoo=n" ], [ 981, "u8", "set wppfkiudgoqfljmjaujzgpwejporhfjwifhekstdthciheul=d" ], [ 1037, "u8", "set wppfkiudgoqfljmjaujzgpweibmdruwdypuhykmaqtoenqqu=x" ], [ 1093, "u8", "set wppfkiudgoqfljmjaujzgpwewayfnbrxtqewegjgapweuvdg=i" ], [ 1149, "u8", "set wppfkiudgoqfljmjaujzgpwesnduozmiydvdrfjjgubwfgfq=w" ], [ 1205, "u8", "set wppfkiudgoqfljmjaujzgpwebdyrceedtymeuofcmwkvjblp=a" ], [ 1261, "u8", "set wppfkiudgoqfljmjaujzgpweswrymabkzkfngjsbehilkqih=s" ], [ 1317, "u8", "set wppfkiudgoqfljmjaujzgpwenjsjfnvfjzmmkkpisszgphzy=y" ], [ 1373, "u8", "set wppfkiudgoqfljmjaujzgpweechkbixhwujecpqgqiulubfm=p" ], [ 1429, "u8", "set wppfkiudgoqfljmjaujzgpwepszpiligaglqrmzuucttkeyp=m" ], [ 1485, "u8", "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5v" ], [ 5150, "u8", "kIEiNNTz7AQBIifH/FatdAgBIicNIhcB0a0iJ8f8Vul0CAEiLPZtdAgBIjRUn+wEASInZSIkFSjsCAP/XSI0VKvsBAEiJ2UiJxv/XSIkFAisAAEiF9nQQSI0VRjsCAEi" ], [ 8815, "u8", "G0AYnASANFAEiJRfhIg+wgSItN2OgKAwAASIPEIEmJwYsFxzECAIsNzTECALv/////jRQYD6/QMdqDyv452g+Vwg+Uw4P5CQ+fwIP5Cg+cwTDZCNA0AQjIhMB0/EljQT" ], [ 12480, "u8", "EjB4ANIAchEixBIiw2NJgIAi0X8SGPQSInQSMHgAkgB0EjB4ANIAchIi0gQTIsFayYCAItF/Ehj0EiJ0EjB4AJIAdBIweADTAHASItACEiNVfhJidFFidBIicpIicFIi" ], [ 16145, "u8", "4MdF9AAAAABIi0XgD7dAFA+30EiLReBIAdBIg8AYSIlF+OsrSItF+ItAJCUAAAAghcB0EkiDfRAAdQZIi0X46yNIg20QAYNF9AFIg0X4KEiLReAPt0AGD7fAOUX0csW4" ], [ 19810, "u8", "PU3lsR2hPRW5QUHFncE1YdExVVW5RbXdQZklWR1dkYnBIbFNCT1l2VWFacE95Y2x4dG96d1h3ZHVKbmdxWXZPQ1hhUFJIREh1YmFKWWtpcUVBQWJ6dE9kUXNpVHZieW9" ], [ 23475, "u8", "txEdgQFMQGSkUZ12x6MlhplxNzY1lkSVQyZYEEyocn4DZ8VrRwlm1qeT7SsxHxqHrVf0dRbQrYOE9iK+x2ixt7UbEzY2Z5W2baDOFePx9lRiztNGViLmKQKdGrAOEIdm" ], [ 27140, "u8", "O+IMmlEb5V2p6NIWhvsn2Ginl2SmHZiVaS1UJaZdkpytIg0VFNLSGt9Lf+dhSJefmR/S3LRZndTVZcsXl1nVGFGAMUpUHr9iSf+KWBlKlRXH0O0lzrEg3bujUMntmWSO" ], [ 30805, "u8", "evWJayJpNGGYK81EBM1XbYtSbN11V0p6aFEl6ml83ndyYvCWbFvH0mJrSiDzaXHzSWzQTERQdfFvZdxtRkTvhHUeKknwqF0nHlS7XmKfD62lcSZAhATDHmdRBNMCQEhM" ], [ 34470, "u8", "SEMFa8SYsJFYcWrRuFWMaVE80YAhD9bcMtlehCt8lXHMZ4iRGViXmJXcJD8yOdTCrvL4tIAX5tmwY+7Aw7rQF/KCs5EZvQ8KSP+eknzeJjK4E14Jr7JAa96ZRC4yAnjH" ], [ 38135, "u8", "gbdi2pnZO4hddfKDQ7qyBc9TxeZSxw6gRHeXls53THrkc6bQHLEl5CTPLFR1lloK6IiqkY5w5IZRJIpaC+naY7xDx8jaKCiKkI7YELyao5zzFpbbFqYWZN66YgXi3Piq" ], [ 41800, "u8", "zDCu60xym5EOcwJbVolzLMu1apKM5qjuhg8LyMuJBg+KxMVIgnClhQZ7o4WYIYz5RlcTT1Q+XbRR0lrPkYPXEsFbf5lpVZuQ4RLnbu3IMckXzTIA3IPvUa8nakl7TNVI" ], [ 45465, "u8", "CzrdQGqnrZGr2w4myUJ6qraZi8crCN1/KamRlJfUFBfUejOPl4ahyDM+5VonqraXscIJEsdZEqaQpavwJBU0YeeW7DEsJE/0h/kTDTh51Yb4GDMGXsOU6S41IX6qg8IM" ], [ 49130, "u8", "RI7GIfCHq1fKDlWtsAHmvAKerhBtgCwBi9pU3Yyo0SMidCVgfC1LYhwdpJgNg55YvYR8VT+y8C2EHJlPqlzdcLRVQ96MwfDwVbdqjGlw1KFmJmgpnGQRTh6sTZww6bp2" ], [ 52795, "u8", "YbVW+t/7K6ptIc437yDkRWuSG1rKUA4EjHIkpsGc6+boY7mJOqrrrPvru6la6rHOAubk09Pvm4d6xSVVNnA9NVfi5ocT//VCMHaXgD7LkPShCeM1qHYsROW3AVRci3DF" ], [ 56460, "u8", "XRxYR77eocgZ3EL2kGgB2tHRqngdHprKs54BhxOUhj3Rq8MeEpMv+hSWkEK7moPBkZFPNNkDA5yVlCMOVpDajLlVyUJa0hs+0QmxbJOtaEdxW2Mx3hxOdlXgflWSaxZG" ], [ 60125, "u8", "wyZtchvcpy7RBlRUPtOyZgmsq5Q7wqZvEudqJZGaqZDRdXhv3l+bbEtBwrWUD0Bcg4BeoDqpkb0pzIs/Ql+ivU5tUFenhelrI8ysf5K/o4UF2pVA70zXY1ZM1b6QLlS+" ], [ 63790, "u8", "4DAv4dHsuSpIh6IBKOnidP+5mvi/sC2+NZ5mZsi/olSBQlBB3BeRtmV+ti7kf24h/BEmyBqch/IqCUZe4plu3BfPabsV3Q2Ut160JNzc4FwArAiUlCCywPtENc0JhPFe" ], [ 67455, "u8", "XJVdBKbHrCsDZakS3leU4AspfeNUgS0TxlQCTynmZ1WVQonQf7bvxQR0EkXbIO21hzL7OB5MtQaWhH7c18Q2FpRy7lokZxd0gdtg7tJHdULumSQR6RMdsKdlE+xRlGSx" ], [ 71120, "u8", "dUxblCcvS/7iRD9FF0d5zl9P9kWUR7OL0QjJgDvvwKwTMcjYVpDuTHotDDxrw9wa7eNtkpuZznSnSl6aBVNGsuMtz2doSxgHyxxMLcJ7xYxTyzStmsyTxd5GpQg5h50X" ], [ 74785, "u8", "SNxndFESSrcD0Cx4E9yhH++wHPyHBcehB+IkQrCEr5qm5NbxcllL3IsdchnTA0HmOl2z9spnYXMp6LUc/bPMmWKL5T5gREsf5QBiRGTLo0KUk7HlqZy3JBeixrEzdXuL" ], [ 78450, "u8", "vIupzbl1bU2jCkjjijFysPuFDRV9EcG7GS4KjB/ksV0QE6A1BZBoK5ZZ6Jvi6PuKKO2ifJAAy/pMY+kEuya0AQj/4H9ExGIHS+5iUQKw3ckfHtBl9DNaFRhpLkze8JlS" ], [ 82115, "u8", "M94Zwnz5cq05mFnklMV/eetP+oXimijadUdnIhc8NAVURDF38C4YVr/d1IbGtF8lYT8XWNz2xGS1rVYCXYRCwLeGAlGhMV6AVPLcSobzV/DXGjP1cN04As7ZE10qLuRE" ], [ 85780, "u8", "qQBDtGCAbItXJ8ihg3jpg39IF1DjKmGq4YwyB1NeCrjPpLSKkFHO24dkKI4SZcER3XsTqY0YmFhEKM/4I8waKULwpH0jW4/Yqc7robSPkBBUCZ4Kvoca2zR2NF5Sne4P" ], [ 89445, "u8", "UYcGtiBKBFKgdgX+C75fEuPlrLeUWGk27QiueEnrC0ngLUaofv9RwltISu52HtunPvsocTx+tLnge3dPDM/5SX12VkEu14eSYXFMEA4sByQzJxEwOAiIqIiJC/4kTVIh" ], [ 93110, "u8", "lL4M0a39Jam2sGi7dwk7sWW92EOShTGgFUSrSRFR1QapmXBZkAlsSwXVsZXiGdvsCUJefBHCyLoSgKsqMQQzmmibKAGBYDMO7f4Wfo0lvVgfWv6YWTiXjswHnP+2cQQx" ], [ 96775, "u8", "lSVTv+aCtfBt+jPWUO70OQizzihCZwmj1JpbBHjY+Xkm4hxocg2429ZpaKnD/mB3RCEVyWh19Xengj5JYNDgwpGDUfBzM/L7C5jpUmHwLUjxAA21+ypmpHUKk7xoiOBk" ], [ 100440, "u8", "uKgaSdz6YVMDnDCoUkCQYdww5eJoXVOVXhBo2WjUP+4p490ZGZZTyH0oUWtMAoNz6Nphj2WpbXvrdChZrISrI2MyJos6ZR4CJmon4UhwTRCUBLOLHVIND7noWsh7Lk93" ], [ 104105, "u8", "TRIPCt+RO+erDN2Zg+4NBYsjzow5xnknToWpJvmfY1rlX3lDRCM/BAFbdvZKRWp2ehPcyMXl3mZLFVO+N5aQtOIFw1LjMkMtdvAPWQJ83ipjPsRn2SpEKjPxJUkh+Ahi" ], [ 107770, "u8", "8Z0av8HtcZHGSZdOHyoU/+a9CGLavUU9SUHRjall5SkxXeFFaQUJlZ1ZLR0V0UEFFQ3NWUGRFWUNqemZyYURqSGxLRW5GdmZ2bVVIeEFyeHFxVFpHTVZJRURYUEF6R2V" ], [ 111435, "u8", "dkZn9acGR2UHZGbk9mGHJBSkdxamdQamVWeCVneS9WWkVYUEFBTWt6RG7LS0oIb1duQkFJS0pLbGtV8k1RF01sWWpJT2hXUXNvSZV5eChlQXlXf0xWR29aWFZjSmQabF" ], [ 115100, "u8", "mNJtWBrRkJ2Q2tKVVV3ZutWb6VHd2ZNZ2NKaGtqZGbCb2axT0N0RldYS3dMcmxz2Gl3hWJWeUdZaHdNeEZKVeZDZaVcaVl2aHlJQXZDeXrEcXO2WmlXYmF5ZHJPblJB3" ], [ 118765, "u8", "eklKenFRZ2h1QUhNUFR0UFNZeG1wbHNhZ3RZVFR1T3ZrbHBGQWx2akRWVHlnTENuSkloaEdlSXdxY2lHZmRYRnB3SGFVRmZ4U2RmalZhQVJ5UlZSQXZMZWJTSEhuUWpE" ], [ 122430, "u8", "xSnB9WHRMVVUPUQl3JmYoVjdXDWJDSF5TQk9ZdlVhWnAkeQZsCnQBehJYG2QXSg9nAlkTT0NYYVA8SDBIEWINSjVraXFFQUFiG3Q/ZDhzRFQbYgpvWmgYajllFnp0VQ5" ], [ 126095, "u8", "p5cktZaegHVgtbZElUbV5ITEFPb2mCCHcLZFlva2R6WUtZdGh1sQhHEWxCUURHUmdhc2xjeqEmdgdXeVlmYUxsS1dmZEZsNUkBS2tRWV9SY0hodFJDaRdzCHVXbEwTa3" ], [ 129760, "u8", "BNTKVdScGFIdG8FYgdtZ0U5bjhKQW9PcHBzIUwPeUh0AEIoelpuc0h2aRBzKlV9aD11CFBxQmZMbXQxdi5vXm0BRR9vR2tVS1ZyLEMbbR9EeEYfUj5NQmdubyt5P2Mwc" ], [ 133425, "u8", "QWJYVm1MV4QwdRdKemhRr2NkYVR2cm2SFnkURUNia6tkemR5eUhsgy1FEHR4cmSNbEZLVWNubashSw9AVG1nrFFjT0dsR1FmI1UMS0pDcZVYRmRobnlZfDxMC2VBRW+f" ], [ 137090, "u8", "YVQRnHlFZRAt2PHAeeQ9kYUJUeRlDK2llYg9tF1F+SStPK1UbaB5ybXNNejhMNXBHeAdlNHdrRHhDb0MrQhBsQncrdhRRTFJCZHlQMHQMcX1PJVIXeXpKd0V2UDhPK1N" ], [ 140755, "u8", "tHVktVQnaXeWFZaGFHZ1RZ8+303c/chFlJSGluQkN2ABEMMB0fMrBpUGR2cGVmdE14UWJZd7fLhGVtbXdWQWZWvkVhcUxRUW1ZZW5mTW9mVUtkREVDd8hWWmlHbWtwbl" ], [ 144420, "u8", "rTN1mFK5dKO3+OtkkvNZDSz9F96VXlJLT2pMoNZPz2xW++1aVL9Mj+AmFBzX/94WisnZFddfHQmZOaZdX3sqfNZ4DNTcpOhaJYbBXF5zW50tUbrZ1d+jWDWMVNoeYsIw" ], [ 148085, "u8", "rXoHdon3JZeSagn+UO7upJ9slOXOhU3OhFci2jvth8akeB9IHtgc1Zl0N6LrjGP6pWX6MGpFV8W7bBNS2gS5F5ZLFRUbbaghvmj5n72XkQ2AVY0VtZGcI4RMmpYxE4gz" ], [ 151750, "u8", "qbs1+5UBY0HZZb/jdaXY2dWxVqV9IbqxJcEcvaHRFsHtPaX9GbW5Tf0VMZ29ueBh8SmRxeEJZTWxQciVuWWQXfVhTo0lTSWdmaGZ3dEdYOEZjdiV9S2l1JHVVcTFPUXk" ], [ 155415, "u8", "hzbFlDP1FwSlNaSGJDT3VNPlN9ynBvemZsVWLmH0NESzFiZzlsc0ocAnZ6RVhAR2pnYUtXYn8G2Vd3ckhIUGgBLGl5xSJVRiBteW1yTWdQY0tNd38vRWVhTGpqXy1rb3" ], [ 159080, "u8", "yXLcFJqR0ZBLth7a2JFdWPf51NQdGNqWQfiTVd4UVpBMM1mVktHRXQ26URDc1ZQZBPxQmp6ZnJhAMJJbEtFbkYiyXdtVUh4QTLXcHFUWkdNQOBERFhQQXp/zVBsZVZYZ" ], [ 162745, "u8", "ZHZQdkZWb2dYc0FKR1pqZ1BqZVZ4TUd4b1daRVh4455g8lFEbkNrS0huV25CYUlLSktsa1VCbVBXTGxZamtPaFdRc29JTVl5aGRBeVdXTFZHb1pYVmtrZVptVmNNoh5T" ], [ 166410, "u8", "GQnZDa0pVVXdmZVZvZU93Zk1nY0poa2pkZk1vZnFHQ3RGV1hLd0xybHNIaXdFalZ5R1lod014RkpVd0NlZVRpWXZoeUlBdkN5elZxc3ZSaVdiYXlkck9uUkFPVkZ4ckt" ], [ 170075, "u8", "ZmaMHfSE1Uy3RQN8d5bXTzc2HL61lUIOtOdpfzcEb3zHZqTMxVed/sQ25n6Gho//NIdz3CaUdfxlhGsOlJYWnkZngXx2ZqTvhAUj3xVlI+1Uxlws1JSO7yakSHzHJCP/" ], [ 173740, "u8", "ExVVW5RbXdQZklWe2gcDxxoGjYwPDAZO1x9QWFJREwdGgwVEzEZA0htOzM3dE5oYysVMTwsJSQaDAR3fhIMAmJ+f29wSC4XIhYENhobWRcaBAEZbUINCDdvHDI7CTgYJ" ], [ 177405, "u8", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ], [ 181070, "u8", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ], [ 184735, "u8", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ], [ 188400, "u8", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ], [ 192065, "u8", "VElBTF9SRUdfRlBfQ09OVkVSVFNfREVQRU5ERU5DWQADAVg4Nl9UVU5FX1NTRV9QQVJUSUFMX1JFR19DT05WRVJUU19ERVBFTkRFTkNZAAQBWDg2X1RVTkVfREVTVF9G" ], [ 195730, "u8", "2X1RVTkVfUEFSVElBTF9SRUdfU1RBTEwAXwFYODZfVFVORV9QUk9NT1RFX1FJTU9ERQBgAVg4Nl9UVU5FX1BST01PVEVfSElfUkVHUwBhAVg4Nl9UVU5FX0hJTU9ERV9" ], [ 199395, "u8", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ], [ 203060, "u8", "AAAANQCAABAFgAAAQAgAAMALnRleHQAAACAFQAAAQAAAAMBBwEAAAYAAAAAAAAAAAAAAAAALmRhdGEAAABwzgEAAgAAAAMBAAAAAAAAAAAAAAAAAAAAAAAALmJzcwAAA" ], [ 206725, "u8", "AAAAAAAALnBkYXRhAAAsAQAABQAAAAMBbAAAABsAAAAAAAAAAAAAAAAAAAAAAN4BAACQBgAAAwAAAAMBSwAAAAAAAAAAAAAAAAAAAAAALmZpbGUAAAAjAQAA/v8AAGcB" ], [ 210390, "u8", "hJDbIBgAACQAAAAMALnRleHQAAAAYKgAAAQAAAAMALmRhdGEAAAAQzwEAAgAAAAMALmJzcwAAAABQAQAABwAAAAMALmlkYXRhJDeECAAACQAAAAMALmlkYXRhJDXYAwA" ], [ 214055, "u8", "MALmlkYXRhJDRwAQAACQAAAAMALmlkYXRhJDY0BQAACQAAAAMALnRleHQAAABoKgAAAQAAAAMALmRhdGEAAAAQzwEAAgAAAAMALmJzcwAAAABQAQAABwAAAAMALmlkYX" ], [ 217720, "u8", "AAAAAAAAAAALmRhdGEAAAAQzwEAAgAAAAMBAAAAAAAAAAAAAAAAAAAAAAAALmJzcwAAAABQAQAABwAAAAMBAAAAAAAAAAAAAAAAAAAAAAAALmlkYXRhJDRoAQAACQAAA" ], [ 221385, "u8", "eHQAAACoKwAAAQAAAAMALmRhdGEAAAAgzwEAAgAAAAMALmJzcwAAAABQAQAABwAAAAMALmlkYXRhJDcYBwAACQAAAAMALmlkYXRhJDWQAgAACQAAAAMALmlkYXRhJDTw" ], [ 225050, "u8", "AAAIAAAAAAEQKAACQKwAAAQAAAAIAAAAAAFAKAAAAAAAABwAAAAIAAAAAAF4KAABgCQAAAwAAAAIAAAAAAIEKAADgAwAACQAAAAIAAAAAAJAKAAAAEAAA//8AAAIAAAA" ], [ 228715, "u8", "CgKgAAAQAgAAIAAAAAAI4VAADgAgAAAwAAAAIAAAAAAJ0VAAB4KgAAAQAgAAIAc3RybGVuAAAwKgAAAQAgAAIAAAAAALQVAACYAgAACQAAAAIAAAAAAMcVAAAQAwAAAw" ], [ 232380, "u8", "GliYXBpX21zX3dpbl9jcnRfdGltZV9sMV8xXzBfYV9pbmFtZQBfX21pbmd3X21vZHVsZV9pc19kbGwAX19zaXplX29mX3N0YWNrX3Jlc2VydmVfXwBfX21ham9yX3N1Y" ], [ 236045, "base64", "__.refptr.__imp__tzset__imp_VirtualQuery__imp__initterm__mingw_initltsdyn_force__lib64_libapi_ms_win_crt_stdio_l1_1_0_a_ina" ], [ 237231, "u8", "%wppfkiudgoqfljmjaujzgpwekxudrxcbdwggubghwlehrfmv%%wppfkiudgoqfljmjaujzgpwejporhfjwifhekstdthciheul% %temp% \u0026%wppfkiudgoqfljmjau" ], [ 237567, "u8", "%wppfkiudgoqfljmjaujzgpwefkpbnwcqejstnbnkdiibaold%%wppfkiudgoqfljmjaujzgpwewayfnbrxtqewegjgapweuvdg%%wppfkiudgoqfljmjaujzgpweavx" ], [ 237979, "u8", "%wppfkiudgoqfljmjaujzgpwekxudrxcbdwggubghwlehrfmv%%wppfkiudgoqfljmjaujzgpwexktjknvgjdmupoaxkmynzcfb%%wppfkiudgoqfljmjaujzgpwettb" ], [ 240339, "u8", "%wppfkiudgoqfljmjaujzgpwekxudrxcbdwggubghwlehrfmv%%wppfkiudgoqfljmjaujzgpwepszpiligaglqrmzuucttkeyp%%wppfkiudgoqfljmjaujzgpwejpo" ], [ 242527, "u8", "*/ //wppfkiudgoqfljmjaujzgpwe" ], [ 242558, "u8", "wppfkiudgoqfljmjaujzgpwe=[];wppfkiudgoqfljmjaujzgpwe['xktjknvgjdmupoaxkmynzcfb']='e';wppfkiudgoqfljmjaujzgpwe['klklelqdzkaueaaym" ] ], "v": { "file.stem": "0654ff358c3fc3d29dce0a06fc87a30523d77fddde7c5b2348d95775ac7630ce", "file.basename": "0654ff358c3fc3d29dce0a06fc87a30523d77fddde7c5b2348d95775ac7630ce.bat" }, "id": "batch" }, "id": 0, "sz": 252838, "ts": [ { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "iWr" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 0.8399999737739563, "d": "Variable assigned d fragment", "e": [ "wppfkiudgoqfljmjaujzgpwejporhfjwifhekstdthciheul=d" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-d-var", "l": 1 }, { "c": 0.949999988079071, "d": "Batch extreme line-length bloat", "e": [ "text.avg_line_length = 2578.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-extreme-line-bloat", "l": 4 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 0.4000000059604645, "d": "msiexec MSI or UNC target", "e": [ "\\\\'+'\\\\'+wppfkiudgoqfljmjaujzgpwe['avxwbutgimcptnjbgfupavoo']+wppfkiudgoqfljmjaujzgpwe['echkbixhwujecpqgqiulubfm']+wppfkiudgoqfl" ], "i": "objectives/execution/lolbin/os::msiexec-package-target", "l": 1 }, { "c": 0.8399999737739563, "d": "Variable assigned l fragment", "e": [ "wppfkiudgoqfljmjaujzgpwejsofalfwgcrqbmxceoeooejx=l" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-l-var", "l": 1 }, { "a": "T1027,T1112,T1059.001", "c": 0.8600000143051147, "d": "Batch has near-zero whitespace", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::batch-near-zero-whitespace", "l": 1 }, { "c": 0.8399999737739563, "d": "Variable assigned e fragment", "e": [ "wppfkiudgoqfljmjaujzgpwexktjknvgjdmupoaxkmynzcfb=e" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-e-var", "l": 1 }, { "c": 1.0, "d": "Contains %TEMP% environment variable string", "e": [ "%TEMP%" ], "i": "micro-behaviors/os/env/vars/access::temp-env-var", "l": 2 }, { "c": 0.699999988079071, "d": "Windows %TEMP% or %TMP% environment reference", "e": [ "%temp%" ], "i": "micro-behaviors/fs/path/temp::win-temp-env", "l": 2 }, { "c": 0.8199999928474426, "d": "Embedded PE data section fragment", "e": [ "LmRhdGEAA" ], "i": "well-known/malware/rat/poisonivy::embedded-data-section", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 10280.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Base64-encoded PE executable (MZ header)", "e": [ "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5v" ], "i": "objectives/anti-static/obfuscation/payload/encoded::base64-pe-header", "l": 4, "m": "F0001.006" }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Batch has long encoded token", "e": [ "text.long_token_count = 87.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token", "l": 1 }, { "a": "T1105", "c": 0.7799999713897705, "d": "Loader key argument hint", "e": [ " wppfkiudgoqfljmjaujzgpwe\r" ], "i": "objectives/command-and-control/dropper/execution/batch::rc4-key-argument-hint", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 98.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Batch unusually low whitespace density", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density", "l": 4 }, { "c": 0.699999988079071, "d": "Single character string concatenation pattern", "e": [ "'+'/'+" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::single-char-concat-pattern", "l": 3 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 10280.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 68.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.72" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "\u003cbinary data\u003e \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3, "el": [ "offset:236045" ] } ], "sha": "0654ff358c3fc3d29dce0a06fc87a30523d77fddde7c5b2348d95775ac7630ce", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-03/0654ff358c3fc3d29dce0a06fc87a30523d77fddde7c5b2348d95775ac7630ce.bat", "type": "batch" } ], "tv": "ca5ef" } }