{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.000049948692321777344 } ], "prob": 0.000049948692, "models": [ { "m": "az", "raw": 0.000049948692, "prob": 0.000049948692, "class": 0 }, { "m": "az/scripts", "raw": 0.0001256764, "prob": 0.0001256764, "class": 0 }, { "m": "az/python", "raw": 0.30131507, "prob": 0.30131507, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T02:32:02Z" }, "path": "encode.py", "raw": { "v": "6", "fs": [ { "f": "O(As)H(Db)", "x": 3, "ff": { "i": [ [ "", "\"=ADR=\".encode" ], [ "", "os.path.dirname" ], [ "", "print" ], [ "", "open" ], [ "", "base64.encodebytes" ], [ "", "file.read" ], [ "", "file.close" ], [ "", "open" ], [ "", "file.write" ], [ "", "file.write" ], [ "", "file.close" ], [ "", "ord" ], [ "", "os.path.dirname" ], [ "", "print" ], [ "", "open" ], [ "", "bytearray" ], [ "", "file.read" ], [ "", "encoded.append" ], [ "", "open" ], [ "", "file.write" ], [ "", "file.close" ], [ "", "''.join" ], [ "", "chr" ], [ "", "ord" ], [ "", "ord" ], [ "", "hex(ord(char))[2:].zfill" ], [ "", "hex" ], [ "", "ord" ], [ "", "print" ], [ "", "len" ], [ "", "os.path.exists" ], [ "", "xor_str" ], [ "", "bin" ], [ "", "sys.exit" ], [ "", "main" ], [ "", "base64" ], [ "", "os" ], [ "", "sys" ] ], "m": { "ast": { "op.add": 2.0, "op.xor": 2.0, "max_depth": 14.0, "bind_count": 9.0, "call_count": 35.0, "node_count": 603.0, "member_count": 10.0, "op_density.add": 0.0, "op_density.xor": 0.0, "identifier_count": 42.0, "member_depth_max": 3.0, "string_literal_count": 16.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 1281.0, "entropy": 4.66, "size_bytes": 1281.0 }, "text": { "digit_ratio": 0.03, "space_count": 300.0, "total_lines": 54.0, "char_entropy": 4.66, "unique_chars": 57.0, "string_density": 0.3, "avg_line_length": 22.74, "max_line_length": 67.0, "empty_line_ratio": 0.22, "last_line_length": 32.0, "whitespace_ratio": 0.28, "most_common_ratio": 0.05, "identifier_density": 2.19, "line_length_stddev": 15.77, "normalized_string_count": 2.18, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 3.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 7.3 }, "binds": { "count": 9.0 }, "calls": { "count": 35.0 }, "binary": { "overall_entropy": 4.66 }, "source": { "function_count": 4.0 }, "imports": { "count": 3.0, "stdlib_count": 3.0, "stdlib_ratio": 1.0, "unique_modules": 3.0 }, "members": { "count": 10.0 }, "strings": { "total": 16.0, "avg_length": 6.44, "max_length": 21.0, "avg_entropy": 1.85, "empty_count": 1.0, "total_bytes": 103.0, "entropy_stddev": 1.2 }, "comments": { "chars": 12.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.02 }, "functions": { "count": 4.0, "avg_params": 1.25, "max_params": 2.0, "length_stddev": 3.46, "avg_name_length": 4.25, "avg_length_lines": 11.0, "max_length_lines": 13.0, "min_length_lines": 5.0, "avg_param_name_length": 4.6, "density_per_100_lines": 7.41, "code_in_functions_ratio": 0.81 }, "identifiers": { "count": 42.0, "total": 118.0, "avg_length": 4.74, "max_length": 11.0, "min_length": 1.0, "avg_entropy": 1.97, "reuse_ratio": 0.36, "unique_count": 42.0, "length_stddev": 2.05, "has_digit_ratio": 0.05, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.02, "all_lowercase_ratio": 0.95, "numeric_suffix_count": 2.0, "double_underscore_count": 1.0, "underscore_prefix_count": 1.0 } }, "s": [ [ 76, "u8", "=ADR=" ], [ 77, "u8", "=ADR=" ], [ 91, "u8", "utf-8" ], [ 92, "u8", "utf-8" ], [ 140, "u8", "\\\\ADR.b64" ], [ 141, "u8", "\\\\ADR.b64" ], [ 162, "u8", "f\"{inpath} =\u003e {outpath}" ], [ 162, "u8", "f" ], [ 172, "u8", " =\u003e " ], [ 214, "u8", "rb" ], [ 215, "u8", "rb" ], [ 321, "u8", "wb" ], [ 322, "u8", "wb" ], [ 451, "u8", "A" ], [ 452, "u8", "A" ], [ 496, "u8", "\\\\ADR.bin" ], [ 497, "u8", "\\\\ADR.bin" ], [ 518, "u8", "f\"{inpath} =\u003e {outpath}" ], [ 518, "u8", "f" ], [ 528, "u8", " =\u003e " ], [ 566, "u8", "rb" ], [ 567, "u8", "rb" ], [ 701, "u8", "wb" ], [ 702, "u8", "wb" ], [ 928, "10", "2" ], [ 938, "10", "2" ], [ 955, "u8", "f\"0x{hex_value}" ], [ 955, "u8", "f" ], [ 957, "u8", "0x" ], [ 977, "u8", ", " ], [ 978, "u8", ", " ], [ 1037, "10", "1" ], [ 1055, "10", "1" ], [ 1084, "10", "1" ], [ 1146, "u8", "A" ], [ 1147, "u8", "A" ], [ 1166, "10", "1" ], [ 1219, "10", "0" ], [ 1237, "u8", "__main__" ], [ 1238, "u8", "__main__" ], [ 1276, "10", "1" ], [ 153, "xor", "KEYPOILIi\"pFK@" ], [ 509, "xor", "KEYPOILIi\"pFK@" ], [ 586, "xor", "KEYESCMY$ r" ], [ 650, "xor", "KEYESCMY$ |\\R^" ], [ 801, "xor", "KEYESCMY$ r" ], [ 898, "xor", "KEYHXX}K ('X" ], [ 946, "xor", "KEYPOILIi\"p" ], [ 1045, "xor", "KEYRXTWO/dc7" ], [ 1063, "xor", "KEYISPCI)do" ], [ 1127, "xor", "KEYXRR}N56zTL^" ], [ 1156, "xor", "KEYRXTWO/dc7" ], [ 1192, "xor", "KEYBTN\nT/43IJ" ], [ 1209, "xor", "KEYRXTWO/db7(G" ] ], "v": { "file.stem": "encode", "file.basename": "encode.py", "source.language": "python", "source.imports[0]": "\"=ADR=\".encode", "source.imports[1]": "''.join", "source.imports[2]": "base64", "source.imports[3]": "base64.encodebytes", "source.imports[4]": "bin", "source.imports[5]": "bytearray", "source.imports[6]": "chr", "source.imports[7]": "encoded.append", "source.imports[8]": "file.close", "source.imports[9]": "file.read", "source.strings[0]": "KEYBTN\nT/43IJ", "source.strings[1]": "KEYESCMY$ r", "source.strings[2]": "KEYESCMY$ |\\R^", "source.strings[3]": "KEYHXX}K ('X", "source.strings[4]": "KEYISPCI)do", "source.strings[5]": "KEYPOILIi\"p", "source.strings[6]": "KEYPOILIi\"pFK@", "source.strings[7]": "KEYRXTWO/db7(G", "source.strings[8]": "KEYRXTWO/dc7", "source.strings[9]": "KEYXRR}N56zTL^", "source.has_imports": true, "source.imports[10]": "file.write", "source.imports[11]": "hex", "source.imports[12]": "hex(ord(char))[2:].zfill", "source.imports[13]": "len", "source.imports[14]": "main", "source.imports[15]": "open", "source.imports[16]": "ord", "source.imports[17]": "os", "source.imports[18]": "os.path.dirname", "source.imports[19]": "os.path.exists", "source.imports[20]": "print", "source.imports[21]": "sys", "source.imports[22]": "sys.exit", "source.imports[23]": "xor_str", "source.strings[10]": "\\\\ADR.b64", "source.strings[11]": "\\\\ADR.bin", "source.strings[12]": "__main__", "source.strings[13]": "f\"0x{hex_value}", "source.strings[14]": "f\"{inpath} =\u003e {outpath}", "source.functions[0]": "b64", "source.functions[1]": "bin", "source.functions[2]": "main", "source.functions[3]": "xor_str" }, "ct": [ "base64.encodebytes", "bin", "bytearray", "chr", "encoded.append", "file.close", "file.read", "file.write", "hex", "len", "main", "open", "ord", "os.path.dirname", "os.path.exists", "print", "sys.exit", "xor_str" ], "id": "python", "mc": [ "base64.encodebytes", "encoded.append", "file.close", "file.read", "file.write", "os.path", "os.path.dirname", "os.path.exists", "sys.argv", "sys.exit" ] }, "id": 0, "sz": 1281, "ts": [ { "c": 0.75, "d": "Write file to persistent storage", "e": [ "open(outpath, \"w" ], "i": "micro-behaviors/communications/http/server/request::file-write-storage", "l": 2 }, { "c": 0.6000000238418579, "d": "Bitwise XOR operation", "e": [ "ast.op.xor = 2.00" ], "i": "micro-behaviors/data/encode/xor::xor-bitwise-op", "l": 2 }, { "c": 0.7799999713897705, "d": "Python write() call", "e": [ "file.write" ], "i": "micro-behaviors/fs/file/write/direct::py-write-call", "l": 2, "el": [ "158" ] }, { "a": "T1082", "c": 0.800000011920929, "d": "Python first positional argv access", "e": [ "sys.argv[1]" ], "i": "micro-behaviors/os/sysinfo/platform/runtime::sys-argv-1", "l": 2 }, { "c": 0.8500000238418579, "d": "Checks file existence (os.path.exists)", "e": [ "os.path.exists" ], "i": "micro-behaviors/fs/file/stat::path-exists", "l": 2, "el": [ "44a" ] }, { "c": 0.4000000059604645, "d": ".write() call (file handle)", "e": [ "file.write(" ], "i": "micro-behaviors/fs/file/write/direct::dot-write-1", "l": 1 }, { "c": 1.0, "d": "Python artifact file extension (py/pyi/pyc)", "e": [ "encode.py" ], "i": "metadata/file/extension::python-artifact-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "Opens a file", "e": [ "open(" ], "i": "micro-behaviors/fs/file/open::generic-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "File opened for binary read", "e": [ "open(inpath,\"rb\"" ], "i": "micro-behaviors/fs/file/open::binary-read-mode", "l": 2 }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ " for c in " ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 2 }, { "c": 1.0, "d": "Python file extension", "e": [ "encode.py" ], "i": "metadata/file/extension::py", "l": 2 }, { "a": "T1059.006", "c": 0.800000011920929, "d": "Function with an args parameter", "e": [ "def main(args:" ], "i": "objectives/command-and-control/remote-command/control::python-args-argument", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 54.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Imports Python base64 module", "e": [ "base64" ], "i": "micro-behaviors/data/encode/base64::import-base64", "l": 3, "el": [ "7" ] }, { "c": 0.8399999737739563, "d": "Python sys.exit symbol", "e": [ "sys.exit" ], "i": "micro-behaviors/process/exit/terminate::python-sys-exit-symbol", "l": 1, "el": [ "4e5" ] }, { "a": "T1005", "c": 0.6000000238418579, "d": "Reads file content (Python)", "e": [ ".read(" ], "i": "micro-behaviors/fs/read/file::file-read-content", "l": 2, "m": "E1005" }, { "a": "T1082", "c": 0.699999988079071, "d": "Python sys.argv command-line access", "e": [ "sys.argv" ], "i": "micro-behaviors/os/sysinfo/platform/runtime::sys-argv-access", "l": 2 }, { "c": 0.800000011920929, "d": "File opened for binary write", "e": [ "open(outpath, \"wb\"" ], "i": "micro-behaviors/fs/file/open::binary-write-mode", "l": 2 }, { "c": 0.4000000059604645, "d": "msiexec MSI or UNC target", "e": [ "\\\\ADR.b64\"" ], "i": "objectives/execution/lolbin/os::msiexec-package-target", "l": 1 }, { "d": "Five or fewer comment lines in file", "e": [ "comments.lines = 1.00" ], "i": "metadata/file/text/metrics::few-comment-lines", "l": 1 }, { "c": 1.0, "d": "Python source file extension (.py only)", "e": [ "encode.py" ], "i": "metadata/file/extension::python-source-extension", "l": 1 }, { "c": 0.699999988079071, "d": "Python bytearray recovery buffer", "e": [ "encoded = bytearray()" ], "i": "objectives/anti-static/obfuscation/string/recovery::python-bytearray-string-buffer", "l": 1 }, { "c": 0.6499999761581421, "d": "Python file under 120 lines", "e": [ "text.total_lines = 54.00" ], "i": "metadata/file/text/metrics::python-under-120-lines", "l": 1 }, { "a": "T1497", "c": 0.8999999761581421, "d": "Python os.path.exists artifact check", "e": [ "os.path.exists" ], "i": "objectives/anti-analysis/sandbox-detect/script::vm-artifact-vbox-file-check--rx-30", "l": 1, "m": "B0007" }, { "a": "T1005", "c": 0.6000000238418579, "d": "Opens a file (Python)", "e": [ "with open(" ], "i": "micro-behaviors/fs/read/file::file-open-content", "l": 2, "m": "E1005" }, { "a": "T1027", "c": 0.800000011920929, "d": "String built via chr(ord()) arithmetic", "e": [ ".join([chr(ord(" ], "i": "objectives/anti-static/obfuscation/eval/scripting::python-chr-ord-shift", "l": 3, "m": "E1027" }, { "a": "T1027", "c": 0.6499999761581421, "d": "Small Python file with almost no comments", "e": [ "comments.to_code_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::py-tiny-comment-ratio-small-file", "l": 1, "m": "B0032" }, { "a": "T1572", "c": 0.8999999761581421, "d": "Base64 keyword marker", "e": [ "base64" ], "i": "objectives/command-and-control/channel/tunnel/proxy::python-websocket-json-base64--rx-4", "l": 1 }, { "c": 1.0, "d": "File read in binary mode", "e": [ "open(inpath,\"rb\"", "open(" ], "i": "objectives/command-and-control/dropper/builder::file-read-rb", "l": 1 } ], "sha": "0aa5a794c3ace798923aafa9e5ae2d7c92be68e4d4ec9382cbfccfa7767f3648", "path": "encode.py", "type": "python" } ], "tv": "8e9ac" } }