{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00011495749, "rte": "az", "prob": 0.00011495749 }, { "cls": 0, "raw": 0.000023782253, "rte": "az/scripts", "prob": 0.000023782253 }, { "cls": 0, "raw": 0.43997005, "rte": "az/powershell", "prob": 0.43997005 } ], "prob": 0.00011495749, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00011495748913148418, "type": "powershell" } ], "version": "v18.18", "analyzed_at": "2026-06-15T05:44:54Z" }, "path": "195dafaff85e20c454e1c067079637498b8555628a945e366eda8b4ab0667c04.ps1", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 392, "b": "b3FCVt48IRa$kc+wPhD]v}v5os%\u003e\u003czcNQtL", "l": 6 }, { "a": 421, "b": "4f", "l": 7 }, { "a": 423, "b": "bZ9][r8MwhrBE?4xgN8rqY[jCc)x{FzGX6bp/6LCr6:+-x\u003cb1!t3t\u0026=z!rf{tVUSyzE={?CuP5\u003etP$pv4f", "l": 8, "n": [ { "c": 2, "d": "Accesses APPDATA environment variable", "i": "micro-behaviors/os/env/vars/access::env-appdata", "o": 445, "z": 12 } ] }, { "a": 489, "b": "b2-O!vrcD[awDAJzGPb/p\u0026Y-TxiGs:t5ws:tVk-Ft48CPBxS*at3Jl]d?8", "l": 9 }, { "a": 536, "b": "b3ExrwO+{YBy!SwAbX#kB-Ipxdk2TLAbn@)wHF{fcOcw/cN/G", "l": 10 }, { "a": 576, "b": "4f", "l": 11 }, { "a": 578, "b": "c@at$eL/?\u003cwN/*8q*ACawO\u003c4{wPPLawNX2yx\u003eqg7dk12bCw.knvpR\u0026wy?k1umS8{Nz/F=#l3cJ\u0026hbm)zefDiGo\u003c{.wnL8VqCvUYorZ**N4f", "l": 12, "n": [ { "c": 3, "d": "System.Net.WebClient object creation", "i": "micro-behaviors/communications/http/client/webclient::system-net-webclient", "o": 579, "z": 31 } ] }, { "a": 664, "b": "4f", "l": 13 }, { "a": 666, "b": "bXy^CC%VaRv]3(.x/OZIg:1}7b3NSRBy/GgwPQ\u003c:z/P@fB-Z[%zDfOdj.wzAwJzE$fc\u003e75vn7#snLRo\u0026wn#-)mqKdS", "l": 14 }, { "a": 739, "b": "4f", "l": 15 }, { "a": 741, "b": "tt]/*By/qwnLZ%dx(4u^iYZt.x()]Ly\u002606ZCYUtVC4%MEqChaivk?$mnomH7efDiIyb702w[UWIyJTtKni]6-ax}=\u0026B97#ge(VzbBs{11v@C)(zF9loiZDXinL7u", "l": 16, "n": [ { "c": 3, "d": "Writes text data", "i": "micro-behaviors/fs/write/file/direct::write-all-text", "o": 741, "z": 30 } ] } ], "mol": "H₂(Cm₃F)", "sha": "195dafaff85e20c454e1c067079637498b8555628a945e366eda8b4ab0667c04", "fact": { "id": "powershell", "met": { "ast": { "max_depth": 32.0, "call_count": 1.0, "node_count": 425.0, "identifier_count": 11.0, "string_literal_count": 15.0, "array_literal_max_length": 1.0 }, "file": { "size": 840.0, "entropy": 5.64, "size_bytes": 840.0 }, "text": { "digit_ratio": 0.08, "space_count": 21.0, "total_lines": 16.0, "char_entropy": 5.64, "unique_chars": 74.0, "string_density": 0.94, "avg_line_length": 50.63, "max_line_length": 107.0, "empty_line_ratio": 0.31, "last_line_length": 99.0, "long_token_count": 2.0, "whitespace_ratio": 0.06, "most_common_ratio": 0.06, "identifier_density": 1.13, "line_length_stddev": 41.08, "normalized_string_count": 3.75, "suspicious_string_ratio": 0.07, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 90.0, "normalized_unique_identifiers": 2.75 }, "calls": { "count": 1.0 }, "binary": { "overall_entropy": 5.64 }, "strings": { "total": 15.0, "avg_length": 31.0, "max_length": 100.0, "avg_entropy": 2.83, "empty_count": 3.0, "total_bytes": 465.0, "entropy_stddev": 1.45, "shell_command_strings": 1.0 }, "identifiers": { "count": 11.0, "total": 18.0, "avg_length": 13.27, "max_length": 20.0, "min_length": 5.0, "avg_entropy": 3.3, "reuse_ratio": 0.61, "unique_count": 11.0, "length_stddev": 4.51, "has_digit_ratio": 0.36, "high_entropy_count": 5.0, "high_entropy_ratio": 0.45, "all_lowercase_ratio": 0.09, "all_uppercase_ratio": 0.09, "numeric_suffix_count": 2.0 } }, "str": [ [ 21, "u8", "bRpsgkl1PhbRpsgkl1PtbRpsgkl1PtbRpsgkl1PpbRpsgkl1P://bRpsgkl1P9bRpsgkl1P2bRpsgkl1P." ], [ 21, "u8", "bRpsgkl1PhbRpsgkl1PtbRpsgkl1PtbRpsgkl1PpbRpsgkl1P://bRpsgkl1P9bRpsgkl1P2bRpsgkl1P." ], [ 109, "u8", "bRpsgkl1P2bRpsgkl1P5bRpsgkl1P5bRpsgkl1P.bRpsgkl1P8bRpsgkl1P5bRpsgkl1P.bRpsgkl1P6bRpsgkl1P6bRpsgkl1P/" ], [ 109, "u8", "bRpsgkl1P2bRpsgkl1P5bRpsgkl1P5bRpsgkl1P.bRpsgkl1P8bRpsgkl1P5bRpsgkl1P.bRpsgkl1P6bRpsgkl1P6bRpsgkl1P/" ], [ 215, "u8", "bRpsgkl1PcbRpsgkl1PmbRpsgkl1PdbRpsgkl1P.bRpsgkl1PbbRpsgkl1PabRpsgkl1PtbRpsgkl1P" ], [ 215, "u8", "bRpsgkl1PcbRpsgkl1PmbRpsgkl1PdbRpsgkl1P.bRpsgkl1PbbRpsgkl1PabRpsgkl1PtbRpsgkl1P" ], [ 306, "u8", "bRpsgkl1P" ], [ 306, "u8", "bRpsgkl1P" ], [ 347, "u8", "ZCZZ:Z\\ZWZiZnZdZoZwsZ\\ZTeZZmpZ\\ZcmZZdZ." ], [ 347, "u8", "ZCZZ:Z\\ZWZiZnZdZoZwsZ\\ZTeZZmpZ\\ZcmZZdZ." ], [ 392, "u8", "ZbZZatZ" ], [ 392, "u8", "ZbZZatZ" ], [ 411, "u8", "Z" ], [ 411, "u8", "Z" ], [ 444, "u8", "$env:APPDATA\\MiZcrZZosofZt\\WiZndZowZsZ\\" ], [ 444, "u8", "$env:APPDATA\\MiZcrZZosofZt\\WiZndZowZsZ\\" ], [ 489, "u8", "StZartZ MeZnuZ\\PrZogZraZmsZ\\StZZarZtZupZ\\" ], [ 489, "u8", "StZartZ MeZnuZ\\PrZogZraZmsZ\\StZZarZtZupZ\\" ], [ 536, "u8", "ZDZeleZteZAppZ.url" ], [ 536, "u8", "ZDZeleZteZAppZ.url" ], [ 566, "u8", "Z" ], [ 566, "u8", "Z" ], [ 686, "u8", "[InternetShortcut]`nURL=file:///$dMaLzIIN9wdquVEl" ], [ 686, "u8", "[InternetShortcut]`nURL=file:///$dMaLzIIN9wdquVEl" ] ], "tgt": [ "New-Object" ], "val": { "file.stem": "195dafaff85e20c454e1c067079637498b8555628a945e366eda8b4ab0667c04", "file.basename": "195dafaff85e20c454e1c067079637498b8555628a945e366eda8b4ab0667c04.ps1", "source.language": "powershell", "source.strings[0]": "$env:APPDATA\\MiZcrZZosofZt\\WiZndZowZsZ\\", "source.strings[1]": "StZartZ MeZnuZ\\PrZogZraZmsZ\\StZZarZtZupZ\\", "source.strings[2]": "ZCZZ:Z\\ZWZiZnZdZoZwsZ\\ZTeZZmpZ\\ZcmZZdZ.", "source.strings[3]": "ZDZeleZteZAppZ.url", "source.strings[4]": "ZbZZatZ", "source.strings[5]": "[InternetShortcut]`nURL=file:///$dMaLzIIN9wdquVEl", "source.strings[6]": "bRpsgkl1P", "source.strings[7]": "bRpsgkl1P2bRpsgkl1P5bRpsgkl1P5bRpsgkl1P.bRpsgkl1P8bRpsgkl1P5bRpsgkl1P.bRpsgkl1P6bRpsgkl1P6bRpsgkl1P/", "source.strings[8]": "bRpsgkl1PcbRpsgkl1PmbRpsgkl1PdbRpsgkl1P.bRpsgkl1PbbRpsgkl1PabRpsgkl1PtbRpsgkl1P", "source.strings[9]": "bRpsgkl1PhbRpsgkl1PtbRpsgkl1PtbRpsgkl1PpbRpsgkl1P://bRpsgkl1P9bRpsgkl1P2bRpsgkl1P." } }, "find": [ { "id": "micro-behaviors/communications/http/lib/invoke-webrequest::webclient-download", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8500000238418579, "crit": 3, "desc": "System.Net.WebClient DownloadString/DownloadFile" }, { "id": "micro-behaviors/communications/http/download/webclient::webclient-downloadfile", "conf": 0.800000011920929, "crit": 3, "desc": "Obfuscated System.Net.WebClient download call" }, { "id": "micro-behaviors/communications/http/client/webclient::system-net-webclient", "atk": "T1071.001", "conf": 0.8799999952316284, "crit": 3, "desc": "System.Net.WebClient object creation" }, { "id": "micro-behaviors/fs/write/file/direct::write-all-text", "conf": 0.8999999761581421, "crit": 3, "desc": "Writes text data" } ], "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-04/195dafaff85e20c454e1c067079637498b8555628a945e366eda8b4ab0667c04.ps1", "risk": 2, "size": 840, "type": "powershell" } ] } }