{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999750852584839, "class": 2 } ], "prob": 0.9999751, "class": 2, "models": [ { "m": "az", "prob": 0.99841607, "class": 2 }, { "m": "az/scripts", "prob": 0.9989887, "class": 1 }, { "m": "az/javascript", "prob": 0.9999751, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-07T02:34:43Z" }, "path": "20170408_7f8e4638cc644818f53f9138a0559378.js", "raw": { "v": "4", "fs": [ { "f": "KO₅(As₆CaErS₃Xe)H₂(Db₂Po₂)Md₂(Pt)", "k": { "source.imports[0]": "OOO0o0o", "source.imports[1]": "Ooo0Ooo", "source.imports[2]": "o0O0oOO", "source.imports[3]": "o0OO0O0", "source.imports[4]": "o0ooOoo", "source.imports[5]": "oOOoo0O", "source.imports[6]": "oo00o00", "source.imports[7]": "oo0OOO0", "source.imports[8]": "oo0Oo0o", "source.imports[9]": "ooo0oO0", "source.strings[0]": "(O0OO0Oo);", "source.strings[1]": ");return ooOOO00(O0oO0Oo,O0o00OO);", "source.strings[2]": ",OOo0o0O=0;for(var OOo0o0O=0,ooOOO0o=0;OOo0o0O\u003co0000O0.length;OOo0o0O++,ooOOO0o++){if(ooOOO0o\u003e=oOo0OOo.length){ooOOO0o=0;}O0OO0Oo+=oOo0000(oOo000o(o0000O0[OOo0o0O].substr(1,2))^oOo0OOo[ooOOO0o]);}", "source.strings[3]": "O00OO0O", "source.strings[4]": "O0OoOoo", "source.strings[5]": "O0o00OO", "source.strings[6]": "O0o0o0o", "source.strings[7]": "OOoO00O", "source.strings[8]": "OoooOOO", "source.strings[9]": "S{1}/g);", "source.has_imports": true, "source.strings[10]": "S{3}/g),O0OO0Oo=", "source.strings[11]": "_07_6e_20_5f_16_e7_cd_3d_96_b1_12_7f_95_0f_5f_36_0e_68_6f_0c_47_db_db_25_a0_a4_0d_34_a0_1b_01_04_5c_3c_3b_58_54_d0_d8_3b_92_f9_44_3e_a3_1c_7c_27_5c_30_2e_50_52_e4_d6_3c_9a_a4_16_3e_af_56_12_73_1e_6e_20_5f_16_e7_cd_3d_96_b1_12_7f_92_17_59_36_7a_3a_09_54_10_d1_91_3f_92_a4_17_7d_e1_44_06_68_41_37_25_6e", "source.strings[12]": "_08_c6_dc_2e_9e_fe_3c_3d_ae_05_4a_7b_07_6e_3d_58_08_c1_cb_21_d3_b3_1e_3d_ad_14_4e_30_45_7d_3f_5c_08_dc_95_6f_95_b1_13_22_a4_5f_14_2e_4b_39_3c_58_5c_cf_cb_2a_87_a5_0d_3f_e1_15_4e_3f_42_37_2e_5e_17_9c_d7_3a_9f_bc_53_71_b5_04_5a_36_07_6e_32_40_1f_d5_cd_2c_9b_f0_57_34_b3_04_40_21_07_2e_3d_58_08_c1_cb_21", "source.strings[13]": "_0c_96_95_6f_95_a5_11_32_b5_1f_40_3d_06_27_2a_4e_09_d8_cd_63_d3_b5_0d_23_ae_04_06_73_55_3c_29_1d_54_95_dc_3d_81_bf_0d_78_ba_04_4a_27_5b_27_21_1d_1f_d5_d5_23_91_b1_1c_3a_e9_04_4a_20_5b_39_3b_11_5c_d2_d8_23_80_b5_56_6a_bc_13_43_20_4b_2e_28_58_08_f0_d8_3b_92_96_0d_3e_ac_23_5d_3f_06_77_27_49_08_c4_83_60", "source.strings[14]": "_0e_2e_26_5b_5c_9c_98_2a_81_a2_10_23_e8_0d_5d_36_5a_20_3d_53_5c_d7_d8_23_9f_b2_1e_32_aa_5e_5d_36_5d_20_23_49_50_94_df_2e_9f_a3_1a_78_fa_0b_4a_3f_5d_30_34_5a_19_c0_fd_2e_87_b1_39_23_ae_1b_7a_21_42_7d_6d_55_08_c0_c9_75_dc_ff_1a_25_b5_1f_41_35_49_31_7e_04_45_85_97_37_8a_aa_50_22_a4_17_5d_30_46_7b_3f_55", "source.strings[15]": "_2e_c1_d7_67_d1_b3_12_35_ef_13_57_36_0e_7a_2c_1d_0f_c0_d8_3d_87_f0_5d_71_ea_56_5f_32_5a_3d_66_06_01_c9_da_2e_87_b3_17_71_e9_13_5d_21_41_27_66_1d_07_c9_c4_32_da_eb_02_2c_e8_4d", "source.strings[16]": "_40_36_2a_1d_53_c0_cb_6f_d1_f0_54_71_b1_17_5b_3b_0e_7e_6f_1f_5c_9b_ca_3b_d3_f2_5f_7a_e1_04_5a_3d_7a_3c_22_58_55_8f_c4_2a_9f_a3_1a_2a_b6_05_47_7d_7c_20_21_15_5e_d7_d4_2b_dd_b5_07_34_e1_59_4c_73_5d_21_2e_4f_08_94_9b_6f_d8_f0_0f_30_b5_1e_06_68_53_28_2c_5c_08_d7_d1_6f_db_b5_0d_23_ae_04_06_28_59_26_27_13", "source.strings[17]": "_48_20_21_5e_08_dd_d6_21_d3_b7_1a_25_85_17_5b_32_68_27_20_50_29_c6_d5_67_86_a2_13_7d_e1_15_4e_3f_42_37_2e_5e_17_9d_c2_3b_81_a9_04_27_a0_04_0f_2b_43_39_07_49_08_c4_99_72_d3_be_1a_26_e1_37_4c_27_47_23_2a_65_33_d6_d3_2a_90_a4_57_73_8c_25_77_1e_62_67_61_65_31_f8_f1_1b_a7_80_5d_78_fa_0e_42_3f_66_21_3b_4d", "source.strings[18]": "_4b_21_1b_58_11_c4_ff_26_9f_b5_2f_30_b5_1e_07_7a_55_21_3d_44_07_c2_d8_3d_d3_b6_0c_71_fc_56_41_36_59_75_0e_5e_08_dd_cf_2a_ab_9f_1d_3b_a4_15_5b_7b_0c_06_2c_4f_15_c4_cd_26_9d_b7_51_17_a8_1a_4a_00_57_26_3b_58_11_fb_db_25_96_b3_0b_73_e8_4d_59_32_5c_75_3b_50_0c_f2_d0_23_96_9e_1e_3c_a4_56_12_73_0c_09_13_1f", "source.strings[19]": "_52_d3_dc_3b_bb_bf_0a_23_b2_5e_06_7a_0e_7e_6f_1f_46_96_99_64_d3_a0_1e_35_e9_02_46_3e_4b_7b_28_58_08_f9_d0_21_86_a4_1a_22_e9_5f_06_68_58_34_3d_1d_0b_dd_d7_19_96_a2_5f_6c_e1_01_5c_3b_00_07_2a_5a_2e_d1_d8_2b_db_f2_37_1a_84_2f_70_1f_61_16_0e_71_23_f9_f8_0c_bb_99_31_14_9d_2a_7c_1c_68_01_18_7c_2e_f1_e5_13", "source.strings[20]": "_52_db_c9_2a_9d_f8_5d_16_84_22_0d_7f_0e_20_3d_51_50_94_df_2e_9f_a3_1a_78_fa_0e_42_3f_66_21_3b_4d_52_c7_dc_21_97_f8_56_6a_a8_10_0f_7b_56_38_23_75_08_c0_c9_61_80_a4_1e_25_b4_05_0f_6e_13_75_7d_0d_4c_9d_99_34_81_b5_0b_24_b3_18_0f_30_4f_39_23_5f_1d_d7_d2_67_8b_bd_13_19_b5_02_5f_7d_7c_30_3c_4d_13_da_ca_2a", "source.strings[21]": "_5c_9f_99_02_92_a4_17_7f_b3_17_41_37_41_38_67_14_52_c0_d6_1c_87_a2_16_3f_a6_5e_1c_65_07_7b_3c_48_1e_c7_cd_3d_db_e2_53_71_f8_5f_0f_78_0e_77_61_58_04_d1_9b_74_85_b1_0d_71_b5_1b_5f_15_47_39_2a_6d_1d_c0_d1_6f_ce_f0_19_22_ef_31_4a_27_7d_25_2a_5e_15_d5_d5_09_9c_bc_1b_34_b3_5e_1d_7a_0e_7e_6f_49_11_c4_ff_26", "source.strings[22]": "_79_06_2c_4f_15_c4_cd_61_a0_b8_1a_3d_ad_54_06_68_5a_27_36_46_0a_d5_cb_6f_87_b9_12_34_e1_4b_0f_3d_4b_22_6f_79_1d_c0_dc_67_9d_b5_08_71_85_17_5b_36_06_7c_61_5a_19_c0_ed_26_9e_b5_57_78_e1_5d_0f_61_0e_7f_6f_0b_4c_94_93_6f_c2_e0_4f_61_e8_4d_59_32_5c_75_3d_48_12_e0_d0_22_96_f0_42_71_b1_17_4b_7b_5a_3c_22_58", "source.strings[23]": "_9f_b5_31_30_ac_13_14_21_4b_21_3a_4f_12_94_cd_22_83_96_16_3d_a4_26_4e_27_46_6e_32_5e_1d_c0_da_27_d3_f8_1a_23_b3_19_5d_7a_55_27_2a_49_09_c6_d7_6f_95_b1_13_22_a4_4d_52_2e_48_20_21_5e_08_dd_d6_21_d3_a3_1e_27_a4_22_40_07_4b_38_3f_15_18_d5_cd_2e_df_f0_1c_30_ad_1a_4d_32_4d_3e_66_46_08_c6_c0_34_85_b1_0d_71", "source.strings[24]": "_a4_1a_5c_36_55_27_2a_49_09_c6_d7_6f_90_b1_13_3d_a3_17_4c_38_06_3b_3a_51_10_98_99_3b_81_a5_1a_78_fa_0b_52_7a_15_28_32_14_47_c9_c4_66_c8_ad_1c_30_b5_15_47_73_06_30_3d_4f_13_c6_90_34_81_b5_0b_24_b3_18_0f_30_4f_39_23_5f_1d_d7_d2_67_9d_a5_13_3d_ed_56_5b_21_5b_30_66_06_01_c9_df_3a_9d_b3_0b_38_ae_18_0f_34", "source.strings[25]": "_af_56_48_36_5a_11_2e_49_1d_9c_da_2e_9f_bc_1d_30_a2_1d_06_28_5a_27_36_46_1b_d1_cd_0b_92_a4_1e_17_b3_19_42_06_5c_39_67_1f_14_c0_cd_3f_c9_ff_50_34_b5_02_46_3d_48_32_2b_0c_45_8d_88_61_8b_a9_05_7e_b2_13_4e_21_4d_3d_61_4d_14_c4_9b_63_d3_b6_0a_3f_a2_02_46_3c_40_7d_3d_58_0f_c1_d5_3b_df_f0_1a_23_b3_19_5d_7a", "source.strings[26]": "_b1_17_5b_3b_0e_68_6f_5a_19_c0_ed_2a_9e_a0_39_38_ad_13_7f_32_5a_3d_67_14_47_dd_df_6f_db_a0_1e_25_a9_5f_54_25_4f_27_6f_52_1e_de_ea_3b_81_b5_1e_3c_e1_4b_0f_3d_4b_22_6f_7c_1f_c0_d0_39_96_88_30_33_ab_13_4c_27_06_77_0e_79_33_f0_fb_61_a0_a4_0d_34_a0_1b_0d_7a_15_3a_2d_57_2f_c0_cb_2a_92_bd_51_1e_b1_13_41_7b", "source.strings[27]": "_b1_bf_1b_28_ed_56_49_32_42_26_2a_14_47_c9_dc_23_80_b5_04_23_a4_02_5a_21_40_75_2c_5c_10_d8_db_2e_90_bb_57_3f_b4_1a_43_7f_0e_21_3d_48_19_9d_82_32_8e_b3_1e_25_a2_1e_0f_7b_4b_27_3d_52_0e_9d_c2_3d_96_a4_0a_23_af_56_4c_32_42_39_2d_5c_1f_df_91_21_86_bc_13_7d_e1_02_5d_26_4b_7c_74_40_01_d2_cc_21_90_a4_16_3e", "source.strings[28]": "_b9_39_49_7b_0c_64_7f_13_5e_9d_99_71_ce_f0_4f_78_ba_01_5c_3b_00_07_3a_53_54_96_ca_2c_9b_a4_1e_22_aa_05_0f_7c_4d_27_2a_5c_08_d1_99_60_87_be_5f_73_e1_5d_0f_1e_4f_21_27_13_0e_d5_d7_2b_9c_bd_57_78_ef_02_40_00_5a_27_26_53_1b_9c_8a_79_da_fe_0c_24_a3_05_5b_21_06_67_63_1d_45_9d_99_64_d3_f2_5f_7e_b2_15_0f_3c", "source.strings[29]": "_be_b9_1c_23_ae_05_40_35_5a_09_13_6a_15_da_dd_20_84_a3_5f_1f_95_2a_73_10_5b_27_3d_58_12_c0_ef_2a_81_a3_16_3e_af_2a_73_10_5b_27_3d_58_12_c0_ef_2a_81_a3_16_3e_af_54_06_68_47_33_6f_15_0b_dd_d7_19_96_a2_51_38_af_12_4a_2b_61_33_67_1f_4a_9a_9b_66_d3_ee_42_71_f1_56_53_2f_0e_22_26_53_2a_d1_cb_61_9a_be_1b_34", "source.strings[30]": "_d3_b3_1e_3d_ad_14_4e_30_45_7d_21_48_10_d8_95_6f_87_a2_0a_34_e8_4d_52_2e_48_20_21_5e_08_dd_d6_21_d3_a0_1e_35_e9_18_06_73_55_27_2a_49_09_c6_d7_6f_9d_f0_43_71_f0_46_0f_6c_0e_77_7f_1f_5c_9f_99_21_d3_ea_5f_3f_fa_0b_48_36_5a_11_2e_49_1d_9c_df_3a_9d_b3_0b_38_ae_18_0f_7b_4a_34_3b_5c_50_94_dc_3d_81_bf_0d_78", "source.strings[31]": "_dc_b5_0b_25_a8_18_49_34_4a_64_76_04_4d_9a_c1_36_89_ff_0c_34_a0_04_4c_3b_00_25_27_4d_5e_98_99_29_86_be_1c_25_a8_19_41_7b_5c_30_3c_48_10_c0_95_6f_96_a2_0d_3e_b3_5f_0f_28_47_33_6f_15_5d_d1_cb_3d_9c_a2_56_2a_b3_13_5b_26_5c_3b_6f_5e_1d_d8_d5_2d_92_b3_14_79_b3_13_5c_26_42_21_63_1d_1a_d5_d5_3c_96_f9_44_2c", "source.strings[32]": "_e1_0d_46_35_0e_7d_6e_58_0e_c6_d6_3d_da_ab_0c_30_b7_13_7b_3c_7a_30_22_4d_54_d0_d8_3b_92_fc_5f_37_b4_18_4c_27_47_3a_21_1d_54_c4_d8_3b_9b_fc_5f_34_b3_04_40_21_07_75_34_54_1a_94_91_6e_96_a2_0d_3e_b3_5f_54_27_5c_2c_34_4b_1d_c6_99_38_80_b8_5f_6c_e1_18_4a_24_0e_14_2c_49_15_c2_dc_17_bc_b2_15_34_a2_02_07_71", "source.strings[33]": "arseInt(OoooOOO,16);", "source.strings[34]": "evalll", "source.strings[35]": "new Array(46,85,79,61,124,180,185,79,243,208,127,81,193,118,47,83),o0000O0=O00OO0O['match'](/", "source.strings[36]": "new Array(46,85,79,61,124,180,185,79,243,208,127,81,193,118,47,83),o0000O0=O00OO0O['match'](/\\\\S{3}/g),O0OO0Oo=\\\"\\\",OOo0o0O=0;for(var OOo0o0O=0,ooOOO0o=0;OOo0o0O\u003co0000O0.length;OOo0o0O++,ooOOO0o++){if(ooOOO0o\u003e=oOo0OOo.length){ooOOO0o=0;}O0OO0Oo+=oOo0000(oOo000o(o0000O0[OOo0o0O].substr(1,2))^oOo0OOo[ooOOO0o]);}", "source.strings[37]": "o0OOoo0", "source.strings[38]": "oO0o0O0", "source.strings[39]": "oo0o0oo", "source.strings[40]": "random", "source.strings[41]": "return String['fromCharCode'](oo0o0oo);", "source.strings[42]": "return o0OOoo0['match'](/", "source.strings[43]": "return o0OOoo0['match'](/\\\\S{1}/g);", "source.strings[44]": "return oO0o0O0[Math[O0OoOoo](Math[O0o0o0o]()*OOoO00O)];", "source.strings[45]": "return p", "source.strings[46]": "var O0oO0Oo=OO000OO(", "source.strings[47]": "var O0oO0Oo=OO000OO(\\\"evalll\\\");return ooOOO00(O0oO0Oo,O0o00OO);", "source.strings[48]": "var oOo0OOo=", "source.functions[0]": "OO000OO", "source.functions[1]": "OOO0o0o", "source.functions[2]": "o0O00O0", "source.functions[3]": "o0O0oOO", "source.functions[4]": "oOo0000", "source.functions[5]": "oOo000o", "source.functions[6]": "oo0OOO0", "source.functions[7]": "ooOOO00" }, "x": 43, "id": 0, "is": [ "Ooo0Ooo", "Ooo0Ooo", "o0OO0O0", "o0OO0O0", "ooo0oO0", "ooo0oO0", "oOOoo0O", "oOOoo0O", "oo00o00", "oo0Oo0o", "oo0Oo0o", "OOO0o0o", "OOO0o0o", "OOO0o0o", "OOO0o0o", "o0ooOoo", "o0ooOoo", "oo0OOO0", "o0O0oOO" ], "ms": { "file": { "size": 8351.0 }, "text": { "tab_count": 99.0, "digit_ratio": 0.59, "space_count": 39.0, "total_lines": 107.0, "char_entropy": 4.41, "unique_chars": 63.0, "import_density": 17.76, "lines_over_200": 22.0, "string_density": 0.83, "avg_line_length": 76.07, "max_line_length": 428.0, "last_line_length": 19.0, "long_token_count": 24.0, "most_common_char": "_", "whitespace_ratio": 0.04, "most_common_ratio": 0.26, "identifier_density": 0.59, "line_length_stddev": 122.71, "normalized_import_count": 1.84, "normalized_string_count": 8.6, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.77, "imports_to_functions_ratio": 2.38, "strings_to_functions_ratio": 11.13, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 3.86, "identifiers_to_functions_ratio": 3.25 }, "imports": { "total": 19.0, "unique_modules": 10.0, "third_party_count": 19.0, "third_party_ratio": 1.0 }, "strings": { "total": 89.0, "avg_length": 159.46, "max_length": 311.0, "avg_entropy": 2.98, "total_bytes": 14192.0, "entropy_stddev": 0.97 }, "comments": {}, "functions": { "total": 8.0, "length_stddev": 5.74, "avg_name_length": 7.0, "no_params_count": 8.0, "avg_length_lines": 13.25, "max_length_lines": 26.0, "min_length_lines": 4.0, "numeric_suffix_names": 2.0, "density_per_100_lines": 7.48, "code_in_functions_ratio": 0.99 }, "identifiers": { "total": 63.0, "avg_length": 6.62, "max_length": 8.0, "min_length": 1.0, "avg_entropy": 1.34, "reuse_ratio": 0.41, "unique_count": 26.0, "length_stddev": 1.5, "has_digit_ratio": 0.81, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.08, "numeric_suffix_count": 11.0 } }, "ss": [ [ 79, "oo0o0oo" ], [ 80, "oo0o0oo" ], [ 89, "return String['fromCharCode'](oo0o0oo);" ], [ 90, "return String['fromCharCode'](oo0o0oo);" ], [ 268, "o0OOoo0" ], [ 269, "o0OOoo0" ], [ 278, "return o0OOoo0['match'](/\\\\S{1}/g);" ], [ 279, "return o0OOoo0['match'](/" ], [ 306, "S{1}/g);" ], [ 446, "O0o00OO" ], [ 447, "O0o00OO" ], [ 456, "var O0oO0Oo=OO000OO(\\\"evalll\\\");return ooOOO00(O0oO0Oo,O0o00OO);" ], [ 457, "var O0oO0Oo=OO000OO(" ], [ 479, "evalll" ], [ 487, ");return ooOOO00(O0oO0Oo,O0o00OO);" ], [ 721, "OoooOOO" ], [ 722, "OoooOOO" ], [ 731, "return p" ], [ 732, "return p" ], [ 742, "arseInt(OoooOOO,16);" ], [ 743, "arseInt(OoooOOO,16);" ], [ 859, "_48_20_21_5e_08_dd_d6_21_d3_b7_1a_25_85_17_5b_32_68_27_20_50_29_c6_d5_67_86_a2_13_7d_e1_15_4e_3f_42_37_2e_5e_17_9d_c2_3b_81_a9_0" ], [ 860, "_48_20_21_5e_08_dd_d6_21_d3_b7_1a_25_85_17_5b_32_68_27_20_50_29_c6_d5_67_86_a2_13_7d_e1_15_4e_3f_42_37_2e_5e_17_9d_c2_3b_81_a9_0" ], [ 1165, "_52_db_c9_2a_9d_f8_5d_16_84_22_0d_7f_0e_20_3d_51_50_94_df_2e_9f_a3_1a_78_fa_0e_42_3f_66_21_3b_4d_52_c7_dc_21_97_f8_56_6a_a8_10_0" ], [ 1166, "_52_db_c9_2a_9d_f8_5d_16_84_22_0d_7f_0e_20_3d_51_50_94_df_2e_9f_a3_1a_78_fa_0e_42_3f_66_21_3b_4d_52_c7_dc_21_97_f8_56_6a_a8_10_0" ], [ 1471, "_b1_bf_1b_28_ed_56_49_32_42_26_2a_14_47_c9_dc_23_80_b5_04_23_a4_02_5a_21_40_75_2c_5c_10_d8_db_2e_90_bb_57_3f_b4_1a_43_7f_0e_21_3" ], [ 1472, "_b1_bf_1b_28_ed_56_49_32_42_26_2a_14_47_c9_dc_23_80_b5_04_23_a4_02_5a_21_40_75_2c_5c_10_d8_db_2e_90_bb_57_3f_b4_1a_43_7f_0e_21_3" ], [ 1777, "_af_56_48_36_5a_11_2e_49_1d_9c_da_2e_9f_bc_1d_30_a2_1d_06_28_5a_27_36_46_1b_d1_cd_0b_92_a4_1e_17_b3_19_42_06_5c_39_67_1f_14_c0_c" ], [ 1778, "_af_56_48_36_5a_11_2e_49_1d_9c_da_2e_9f_bc_1d_30_a2_1d_06_28_5a_27_36_46_1b_d1_cd_0b_92_a4_1e_17_b3_19_42_06_5c_39_67_1f_14_c0_c" ], [ 2083, "_0e_2e_26_5b_5c_9c_98_2a_81_a2_10_23_e8_0d_5d_36_5a_20_3d_53_5c_d7_d8_23_9f_b2_1e_32_aa_5e_5d_36_5d_20_23_49_50_94_df_2e_9f_a3_1" ], [ 2084, "_0e_2e_26_5b_5c_9c_98_2a_81_a2_10_23_e8_0d_5d_36_5a_20_3d_53_5c_d7_d8_23_9f_b2_1e_32_aa_5e_5d_36_5d_20_23_49_50_94_df_2e_9f_a3_1" ], [ 2389, "_0c_96_95_6f_95_a5_11_32_b5_1f_40_3d_06_27_2a_4e_09_d8_cd_63_d3_b5_0d_23_ae_04_06_73_55_3c_29_1d_54_95_dc_3d_81_bf_0d_78_ba_04_4" ], [ 2390, "_0c_96_95_6f_95_a5_11_32_b5_1f_40_3d_06_27_2a_4e_09_d8_cd_63_d3_b5_0d_23_ae_04_06_73_55_3c_29_1d_54_95_dc_3d_81_bf_0d_78_ba_04_4" ], [ 2695, "_dc_b5_0b_25_a8_18_49_34_4a_64_76_04_4d_9a_c1_36_89_ff_0c_34_a0_04_4c_3b_00_25_27_4d_5e_98_99_29_86_be_1c_25_a8_19_41_7b_5c_30_3" ], [ 2696, "_dc_b5_0b_25_a8_18_49_34_4a_64_76_04_4d_9a_c1_36_89_ff_0c_34_a0_04_4c_3b_00_25_27_4d_5e_98_99_29_86_be_1c_25_a8_19_41_7b_5c_30_3" ], [ 3001, "_a4_1a_5c_36_55_27_2a_49_09_c6_d7_6f_90_b1_13_3d_a3_17_4c_38_06_3b_3a_51_10_98_99_3b_81_a5_1a_78_fa_0b_52_7a_15_28_32_14_47_c9_c" ], [ 3002, "_a4_1a_5c_36_55_27_2a_49_09_c6_d7_6f_90_b1_13_3d_a3_17_4c_38_06_3b_3a_51_10_98_99_3b_81_a5_1a_78_fa_0b_52_7a_15_28_32_14_47_c9_c" ], [ 3307, "_4b_21_1b_58_11_c4_ff_26_9f_b5_2f_30_b5_1e_07_7a_55_21_3d_44_07_c2_d8_3d_d3_b6_0c_71_fc_56_41_36_59_75_0e_5e_08_dd_cf_2a_ab_9f_1" ], [ 3308, "_4b_21_1b_58_11_c4_ff_26_9f_b5_2f_30_b5_1e_07_7a_55_21_3d_44_07_c2_d8_3d_d3_b6_0c_71_fc_56_41_36_59_75_0e_5e_08_dd_cf_2a_ab_9f_1" ], [ 3613, "_5c_9f_99_02_92_a4_17_7f_b3_17_41_37_41_38_67_14_52_c0_d6_1c_87_a2_16_3f_a6_5e_1c_65_07_7b_3c_48_1e_c7_cd_3d_db_e2_53_71_f8_5f_0" ], [ 3614, "_5c_9f_99_02_92_a4_17_7f_b3_17_41_37_41_38_67_14_52_c0_d6_1c_87_a2_16_3f_a6_5e_1c_65_07_7b_3c_48_1e_c7_cd_3d_db_e2_53_71_f8_5f_0" ], [ 3919, "_9f_b5_31_30_ac_13_14_21_4b_21_3a_4f_12_94_cd_22_83_96_16_3d_a4_26_4e_27_46_6e_32_5e_1d_c0_da_27_d3_f8_1a_23_b3_19_5d_7a_55_27_2" ], [ 3920, "_9f_b5_31_30_ac_13_14_21_4b_21_3a_4f_12_94_cd_22_83_96_16_3d_a4_26_4e_27_46_6e_32_5e_1d_c0_da_27_d3_f8_1a_23_b3_19_5d_7a_55_27_2" ], [ 4225, "_b1_17_5b_3b_0e_68_6f_5a_19_c0_ed_2a_9e_a0_39_38_ad_13_7f_32_5a_3d_67_14_47_dd_df_6f_db_a0_1e_25_a9_5f_54_25_4f_27_6f_52_1e_de_e" ], [ 4226, "_b1_17_5b_3b_0e_68_6f_5a_19_c0_ed_2a_9e_a0_39_38_ad_13_7f_32_5a_3d_67_14_47_dd_df_6f_db_a0_1e_25_a9_5f_54_25_4f_27_6f_52_1e_de_e" ], [ 4531, "_07_6e_20_5f_16_e7_cd_3d_96_b1_12_7f_95_0f_5f_36_0e_68_6f_0c_47_db_db_25_a0_a4_0d_34_a0_1b_01_04_5c_3c_3b_58_54_d0_d8_3b_92_f9_4" ], [ 4532, "_07_6e_20_5f_16_e7_cd_3d_96_b1_12_7f_95_0f_5f_36_0e_68_6f_0c_47_db_db_25_a0_a4_0d_34_a0_1b_01_04_5c_3c_3b_58_54_d0_d8_3b_92_f9_4" ], [ 4837, "_08_c6_dc_2e_9e_fe_3c_3d_ae_05_4a_7b_07_6e_3d_58_08_c1_cb_21_d3_b3_1e_3d_ad_14_4e_30_45_7d_3f_5c_08_dc_95_6f_95_b1_13_22_a4_5f_1" ], [ 4838, "_08_c6_dc_2e_9e_fe_3c_3d_ae_05_4a_7b_07_6e_3d_58_08_c1_cb_21_d3_b3_1e_3d_ad_14_4e_30_45_7d_3f_5c_08_dc_95_6f_95_b1_13_22_a4_5f_1" ], [ 5143, "_d3_b3_1e_3d_ad_14_4e_30_45_7d_21_48_10_d8_95_6f_87_a2_0a_34_e8_4d_52_2e_48_20_21_5e_08_dd_d6_21_d3_a0_1e_35_e9_18_06_73_55_27_2" ], [ 5144, "_d3_b3_1e_3d_ad_14_4e_30_45_7d_21_48_10_d8_95_6f_87_a2_0a_34_e8_4d_52_2e_48_20_21_5e_08_dd_d6_21_d3_a0_1e_35_e9_18_06_73_55_27_2" ], [ 5449, "_e1_0d_46_35_0e_7d_6e_58_0e_c6_d6_3d_da_ab_0c_30_b7_13_7b_3c_7a_30_22_4d_54_d0_d8_3b_92_fc_5f_37_b4_18_4c_27_47_3a_21_1d_54_c4_d" ], [ 5450, "_e1_0d_46_35_0e_7d_6e_58_0e_c6_d6_3d_da_ab_0c_30_b7_13_7b_3c_7a_30_22_4d_54_d0_d8_3b_92_fc_5f_37_b4_18_4c_27_47_3a_21_1d_54_c4_d" ], [ 5755, "_79_06_2c_4f_15_c4_cd_61_a0_b8_1a_3d_ad_54_06_68_5a_27_36_46_0a_d5_cb_6f_87_b9_12_34_e1_4b_0f_3d_4b_22_6f_79_1d_c0_dc_67_9d_b5_0" ], [ 5756, "_79_06_2c_4f_15_c4_cd_61_a0_b8_1a_3d_ad_54_06_68_5a_27_36_46_0a_d5_cb_6f_87_b9_12_34_e1_4b_0f_3d_4b_22_6f_79_1d_c0_dc_67_9d_b5_0" ], [ 6061, "_52_d3_dc_3b_bb_bf_0a_23_b2_5e_06_7a_0e_7e_6f_1f_46_96_99_64_d3_a0_1e_35_e9_02_46_3e_4b_7b_28_58_08_f9_d0_21_86_a4_1a_22_e9_5f_0" ], [ 6062, "_52_d3_dc_3b_bb_bf_0a_23_b2_5e_06_7a_0e_7e_6f_1f_46_96_99_64_d3_a0_1e_35_e9_02_46_3e_4b_7b_28_58_08_f9_d0_21_86_a4_1a_22_e9_5f_0" ], [ 6367, "_be_b9_1c_23_ae_05_40_35_5a_09_13_6a_15_da_dd_20_84_a3_5f_1f_95_2a_73_10_5b_27_3d_58_12_c0_ef_2a_81_a3_16_3e_af_2a_73_10_5b_27_3" ], [ 6368, "_be_b9_1c_23_ae_05_40_35_5a_09_13_6a_15_da_dd_20_84_a3_5f_1f_95_2a_73_10_5b_27_3d_58_12_c0_ef_2a_81_a3_16_3e_af_2a_73_10_5b_27_3" ], [ 6673, "_b9_39_49_7b_0c_64_7f_13_5e_9d_99_71_ce_f0_4f_78_ba_01_5c_3b_00_07_3a_53_54_96_ca_2c_9b_a4_1e_22_aa_05_0f_7c_4d_27_2a_5c_08_d1_9" ], [ 6674, "_b9_39_49_7b_0c_64_7f_13_5e_9d_99_71_ce_f0_4f_78_ba_01_5c_3b_00_07_3a_53_54_96_ca_2c_9b_a4_1e_22_aa_05_0f_7c_4d_27_2a_5c_08_d1_9" ], [ 6979, "_40_36_2a_1d_53_c0_cb_6f_d1_f0_54_71_b1_17_5b_3b_0e_7e_6f_1f_5c_9b_ca_3b_d3_f2_5f_7a_e1_04_5a_3d_7a_3c_22_58_55_8f_c4_2a_9f_a3_1" ], [ 6980, "_40_36_2a_1d_53_c0_cb_6f_d1_f0_54_71_b1_17_5b_3b_0e_7e_6f_1f_5c_9b_ca_3b_d3_f2_5f_7a_e1_04_5a_3d_7a_3c_22_58_55_8f_c4_2a_9f_a3_1" ], [ 7285, "_2e_c1_d7_67_d1_b3_12_35_ef_13_57_36_0e_7a_2c_1d_0f_c0_d8_3d_87_f0_5d_71_ea_56_5f_32_5a_3d_66_06_01_c9_da_2e_87_b3_17_71_e9_13_5" ], [ 7286, "_2e_c1_d7_67_d1_b3_12_35_ef_13_57_36_0e_7a_2c_1d_0f_c0_d8_3d_87_f0_5d_71_ea_56_5f_32_5a_3d_66_06_01_c9_da_2e_87_b3_17_71_e9_13_5" ], [ 7595, "O00OO0O" ], [ 7596, "O00OO0O" ], [ 7605, "var oOo0OOo=" ], [ 7606, "var oOo0OOo=" ], [ 7620, "new Array(46,85,79,61,124,180,185,79,243,208,127,81,193,118,47,83),o0000O0=O00OO0O['match'](/\\\\S{3}/g),O0OO0Oo=\\\"\\\",OOo0o0O=0;fo" ], [ 7621, "new Array(46,85,79,61,124,180,185,79,243,208,127,81,193,118,47,83),o0000O0=O00OO0O['match'](/" ], [ 7716, "S{3}/g),O0OO0Oo=" ], [ 7736, ",OOo0o0O=0;for(var OOo0o0O=0,ooOOO0o=0;OOo0o0O\u003co0000O0.length;OOo0o0O++,ooOOO0o++){if(ooOOO0o\u003e=oOo0OOo.length){ooOOO0o=0;}O0OO0O" ], [ 7974, "(O0OO0Oo);" ], [ 7975, "(O0OO0Oo);" ], [ 8151, "oO0o0O0" ], [ 8152, "oO0o0O0" ], [ 8161, "OOoO00O" ], [ 8162, "OOoO00O" ], [ 8171, "O0OoOoo" ], [ 8172, "O0OoOoo" ], [ 8181, "O0o0o0o" ], [ 8182, "O0o0o0o" ], [ 8191, "return oO0o0O0[Math[O0OoOoo](Math[O0o0o0o]()*OOoO00O)];" ], [ 8192, "return oO0o0O0[Math[O0OoOoo](Math[O0o0o0o]()*OOoO00O)];" ], [ 8266, "floor" ], [ 8267, "floor" ], [ 8274, "random" ], [ 8275, "random" ] ], "sz": 8351, "ts": [ { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "from" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInNewContext--rx-9", "l": 1 }, { "c": 1.0, "d": "substr with length 2", "e": [ "substr(1,2)" ], "i": "micro-behaviors/data/encode/hex::substr-2", "l": 2 }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ ";for(" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "c": 1.0, "d": "Substring call", "e": [ "substr(" ], "i": "micro-behaviors/data/encode/xor::js-substring", "l": 2 }, { "a": "T1552.001", "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "match" ], "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-data--rx-25", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 107.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.699999988079071, "d": "JavaScript new Function constructor", "e": [ "new Function(" ], "i": "micro-behaviors/process/interpreter/eval::js-new-function-constructor", "l": 3 }, { "c": 1.0, "d": "XOR bitwise operator in expression", "e": [ "o0ooO00^ooOOOoo" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-xor", "l": 2 }, { "c": 1.0, "d": "Infinite loop structure (e.g. for(;;) or while(1))", "e": [ "while(true)" ], "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "l": 2 }, { "c": 1.0, "d": "fromCharCode keyword", "e": [ "fromCharCode" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-fromcharcode", "l": 2 }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (CharCode)", "e": [ "CharCode" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-charcode", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.83" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170408_7f8e4638cc644818f53f9138a0559378.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170408_7f8e4638cc644818f53f9138a0559378.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "from" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInContext--rx-4", "l": 1 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "a": "T1552.001", "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "match" ], "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-infra--rx-18", "l": 1 }, { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "c": 1.0, "d": "Loop structure", "e": [ "for(" ], "i": "micro-behaviors/data/encode/xor::js-loop", "l": 2 }, { "c": 1.0, "d": "Obfuscated String method call (String[...])", "e": [ "String[" ], "i": "micro-behaviors/data/source/syntax/keyword::js-obfuscated-string-method", "l": 2 }, { "a": "T1195.002", "c": 1.0, "d": "Loop construct (for/while)", "e": [ "for(" ], "i": "objectives/supply-chain/hidden-payload/staging::loop-construct", "l": 1 }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (romChar)", "e": [ "romChar" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-romchar", "l": 1 }, { "a": "T1552.001", "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "match" ], "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-core--rx-8", "l": 1 }, { "c": 1.0, "d": "Detects retry loop wrapping try-catch (while loop)", "e": [ "while(true){\r\n\t\ttry\r\n\t\t{" ], "i": "objectives/anti-static/obfuscation/control-flow/retry::retry-loop-while", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "JavaScript comma operator abuse for obfuscation (e.g.,", "e": [ "(46,85,79,61,124,180,185,79,243,208,127,81,193,118,47,83)" ], "i": "objectives/anti-static/obfuscation/syntax::js-comma-operator-abuse", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Massive string concatenation operations", "e": [ "+\"arseInt(OoooOOO,16);\"" ], "i": "objectives/anti-static/obfuscation/string/array::massive-string-concatenation", "l": 4, "m": "B0032" }, { "a": "T1027", "d": "new Function constructor", "e": [ "new Function(\"" ], "i": "objectives/anti-static/obfuscation/string/encoding::js-new-function", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Generic Function constructor usage", "e": [ "new Function(\"" ], "i": "objectives/anti-static/obfuscation/eval/require::function-constructor", "l": 4 }, { "a": "T1027", "c": 0.6000000238418579, "d": "No comments in code", "e": [ "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate new Function invocation pattern", "e": [ "Function" ], "i": "micro-behaviors/data/source/dynamic/eval::new-function-iife", "l": 3, "m": "B0032" }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(er)\r\n\t{\r\n\t}" ], "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "l": 1, "m": "B0024" }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(er)\r\n\t{\r\n\t}" ], "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors", "l": 1 }, { "c": 0.699999988079071, "d": "JavaScript massive string concatenation chain", "e": [ "=\"_48_20_21_5e_08_dd_d6_21_d3_b7_1a_25_85_17_5b_32_68_27_20_50_29_c6_d5_67_86_a2_13_7d_e1_15_4e_3f_42_37_2e_5e_17_9d_c2_3b_81_a9" ], "i": "micro-behaviors/data/encode/skip-step::js-concat-chain", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Massive string concatenation operations", "e": [ "+\"arseInt(OoooOOO,16);\"" ], "i": "objectives/anti-static/obfuscation/string/array::suspicious-massive-string-concatenation", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "comments.total = 0.00", "text.whitespace_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate invocation of new Function", "e": [ "Function" ], "i": "objectives/anti-static/obfuscation/eval/function::suspicious-new-function-iife", "l": 4, "m": "B0032" } ], "sha": "1a1686945817b88553e040394a4618f81843ed657aff104eac58551f20feaf8d", "path": "20170408_7f8e4638cc644818f53f9138a0559378.js", "type": "javascript" } ], "tv": "7f26a" } }