{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997380375862122, "class": 2 } ], "prob": 0.99973804, "class": 2, "models": [ { "m": "az", "prob": 0.90976083, "class": 0 }, { "m": "az/scripts", "prob": 0.99056935, "class": 1 }, { "m": "az/javascript", "prob": 0.99973804, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T15:05:29Z" }, "path": "20170124_0ec4b612cc379bb036cc05d4ca24fc3b.js", "raw": { "v": "4", "fs": [ { "f": "KO₆(As₅Xe₂CCoErS₃)H₃(CrDbPo)Md(Pa₂)", "k": { "source.imports[0]": "bhirojxy1", "source.imports[1]": "elhylnewe1", "source.imports[2]": "fjedbukw4", "source.imports[3]": "imoncuw4", "source.imports[4]": "iqussicja1", "source.imports[5]": "iqwisuztu6", "source.imports[6]": "muctim7", "source.imports[7]": "qyfunuvri0", "source.imports[8]": "ukelowra3", "source.imports[9]": "wemygqi0", "source.strings[0]": "abaqmi", "source.strings[1]": "abridabp", "source.strings[2]": "abxegxa", "source.strings[3]": "adqovom", "source.strings[4]": "adubnybs", "source.strings[5]": "afkypytq", "source.strings[6]": "afralegq", "source.strings[7]": "afzovfibq", "source.strings[8]": "ahxuvent", "source.strings[9]": "akajlibj", "source.has_imports": true, "source.imports[10]": "ypovlozy6", "source.strings[10]": "alekevr", "source.strings[11]": "alexle", "source.strings[12]": "apgikmiz", "source.strings[13]": "aptumi", "source.strings[14]": "apyfwuw", "source.strings[15]": "aqzudov", "source.strings[16]": "asadci", "source.strings[17]": "avexoq", "source.strings[18]": "avubsisz", "source.strings[19]": "axjykwaj", "source.strings[20]": "azefnudq", "source.strings[21]": "baqitvy", "source.strings[22]": "bgenpamsu", "source.strings[23]": "bhisuzh", "source.strings[24]": "bisidi", "source.strings[25]": "bjofuxk", "source.strings[26]": "bmojma", "source.strings[27]": "bojziq", "source.strings[28]": "bowsax", "source.strings[29]": "boxqug", "source.strings[30]": "bubveld", "source.strings[31]": "bumzutra", "source.strings[32]": "buztyxo", "source.strings[33]": "cemoly", "source.strings[34]": "cumymnu", "source.strings[35]": "dcipvodi", "source.strings[36]": "dexgyw", "source.strings[37]": "dnyfqahu", "source.strings[38]": "dqikxe", "source.strings[39]": "dwecvywq", "source.strings[40]": "dxegna", "source.strings[41]": "ebgylw", "source.strings[42]": "eciback", "source.strings[43]": "ecsosva", "source.strings[44]": "efbynd", "source.strings[45]": "efimza", "source.strings[46]": "egmuny", "source.strings[47]": "egopnadt", "source.strings[48]": "ejbyvwo", "source.strings[49]": "ellajvotw", "source.strings[50]": "emolidb", "source.strings[51]": "enkigu", "source.strings[52]": "ennuqet", "source.strings[53]": "enohxez", "source.strings[54]": "epsexu", "source.strings[55]": "errocy", "source.strings[56]": "etgumbo", "source.strings[57]": "evcuru", "source.strings[58]": "ewaxop", "source.strings[59]": "ewjyseg", "source.strings[60]": "fabory", "source.strings[61]": "fawiqba", "source.strings[62]": "ffartula", "source.strings[63]": "fotxolj", "source.strings[64]": "fwujiwz", "source.strings[65]": "gaksuq", "source.strings[66]": "glorohku", "source.strings[67]": "gocqode", "source.strings[68]": "gsafehu", "source.strings[69]": "gxycyq", "source.strings[70]": "hifjyqi", "source.strings[71]": "hukjito", "source.strings[72]": "hygijk", "source.strings[73]": "hyptid", "source.strings[74]": "icavymf", "source.strings[75]": "icifabh", "source.strings[76]": "ihoqwin", "source.strings[77]": "ihumaws", "source.strings[78]": "ijalemv", "source.strings[79]": "ijyzbix", "source.strings[80]": "ikobalg", "source.strings[81]": "iltozpush", "source.strings[82]": "immuqqogn", "source.strings[83]": "inaqru", "source.strings[84]": "iqahkyr", "source.strings[85]": "iqvebuh", "source.strings[86]": "iqymzi", "source.strings[87]": "irdyfx", "source.strings[88]": "isarja", "source.strings[89]": "isduhhoxm", "source.strings[90]": "isexovm", "source.strings[91]": "itdyrka", "source.strings[92]": "itewqek", "source.strings[93]": "ixrazno", "source.strings[94]": "ixytigw", "source.strings[95]": "izeduzl", "source.strings[96]": "jgikgahby", "source.strings[97]": "jorfyn", "source.strings[98]": "jvotmof", "source.strings[99]": "kenojg", "source.strings[100]": "kenyjy", "source.strings[101]": "kirucw", "source.strings[102]": "klegus", "source.strings[103]": "kocrawi", "source.strings[104]": "kpodve", "source.strings[105]": "kroxotv", "source.strings[106]": "ksovcott", "source.strings[107]": "kuqaqp", "source.strings[108]": "kyjykh", "source.strings[109]": "lahetxe", "source.strings[110]": "lasiht", "source.strings[111]": "ltarsa", "source.strings[112]": "magedo", "source.strings[113]": "mbycuzu", "source.strings[114]": "melbyso", "source.strings[115]": "mfaxuqqy", "source.strings[116]": "mgovirry", "source.strings[117]": "mmetji", "source.strings[118]": "mudydz", "source.strings[119]": "mxalwoco", "source.strings[120]": "ngovykge", "source.strings[121]": "nilowva", "source.strings[122]": "nkaljaqi", "source.strings[123]": "nqetmu", "source.strings[124]": "nsegobo", "source.strings[125]": "nygmotf", "source.strings[126]": "ociqja", "source.strings[127]": "octanalc", "source.strings[128]": "ocvebv", "source.strings[129]": "odnyfi", "source.strings[130]": "odublo", "source.strings[131]": "ofqaty", "source.strings[132]": "ofrabfylz", "source.strings[133]": "ogzichic", "source.strings[134]": "ohroxm", "source.strings[135]": "ojmuhp", "source.strings[136]": "ojuvotv", "source.strings[137]": "okugmu", "source.strings[138]": "osulgy", "source.strings[139]": "ovxocyg", "source.strings[140]": "owodxyv", "source.strings[141]": "oxoxta", "source.strings[142]": "oxpizke", "source.strings[143]": "pekudmu", "source.strings[144]": "pexsif", "source.strings[145]": "piqfirhu", "source.strings[146]": "pkyrfuzk", "source.strings[147]": "pnitursi", "source.strings[148]": "pocalo", "source.strings[149]": "psonde", "source.strings[150]": "ptyqozw", "source.strings[151]": "pyqxika", "source.strings[152]": "qapjemu", "source.strings[153]": "qfoxjaqw", "source.strings[154]": "qikerka", "source.strings[155]": "qsucmobd", "source.strings[156]": "qucazro", "source.strings[157]": "quntyqz", "source.strings[158]": "qverhuqo", "source.strings[159]": "rafjidva", "source.strings[160]": "rcekboba", "source.strings[161]": "rgulaka", "source.strings[162]": "rihsasda", "source.strings[163]": "rovbivl", "source.strings[164]": "ruxcijo", "source.strings[165]": "rxibbarw", "source.strings[166]": "salxyt", "source.strings[167]": "sjespopp", "source.strings[168]": "soqmyjfi", "source.strings[169]": "sycravqi", "source.strings[170]": "thoqis", "source.strings[171]": "thydwimz", "source.strings[172]": "tjebxi", "source.strings[173]": "tmijfo", "source.strings[174]": "tnafxi", "source.strings[175]": "tsifzi", "source.strings[176]": "tsoszykte", "source.strings[177]": "ttexynxe", "source.strings[178]": "tysiri", "source.strings[179]": "ubguxric", "source.strings[180]": "ubnyjz", "source.strings[181]": "uccabby", "source.strings[182]": "ucfijga", "source.strings[183]": "ucfovoj", "source.strings[184]": "ufgapu", "source.strings[185]": "ufgocticd", "source.strings[186]": "uhdolfun", "source.strings[187]": "uhijpa", "source.strings[188]": "ujnycni", "source.strings[189]": "ukezof", "source.strings[190]": "ukhysesh", "source.strings[191]": "ukqogfy", "source.strings[192]": "ukxobisj", "source.strings[193]": "ulwixex", "source.strings[194]": "umehgows", "source.strings[195]": "upmikmep", "source.strings[196]": "uranhyf", "source.strings[197]": "usizland", "source.strings[198]": "utajquth", "source.strings[199]": "utdamw", "source.strings[200]": "uwipah", "source.strings[201]": "uwpinc", "source.strings[202]": "uxatry", "source.strings[203]": "uxgadu", "source.strings[204]": "uxurbo", "source.strings[205]": "vatytbu", "source.strings[206]": "verzylr", "source.strings[207]": "vodoxta", "source.strings[208]": "vvuswo", "source.strings[209]": "vywhejdu", "source.strings[210]": "wexiqp", "source.strings[211]": "wmykge", "source.strings[212]": "wupqybbo", "source.strings[213]": "wuqinx", "source.strings[214]": "wyzvifgu", "source.strings[215]": "xcaxyf", "source.strings[216]": "xdasaf", "source.strings[217]": "xlumemi", "source.strings[218]": "xqubyzo", "source.strings[219]": "xqufxyxy", "source.strings[220]": "xtakvupwe", "source.strings[221]": "xvecefe", "source.strings[222]": "ybgyfa", "source.strings[223]": "ycanne", "source.strings[224]": "ycjime", "source.strings[225]": "ycpuciz", "source.strings[226]": "ycycro", "source.strings[227]": "ydnyqo", "source.strings[228]": "ydyxegc", "source.strings[229]": "yfozzolv", "source.strings[230]": "yjbustulr", "source.strings[231]": "yjtekom", "source.strings[232]": "ykatri", "source.strings[233]": "ykohca", "source.strings[234]": "ynicvihc", "source.strings[235]": "ypokdo", "source.strings[236]": "yqdyxy", "source.strings[237]": "ysdegxuqx", "source.strings[238]": "ysgojy", "source.strings[239]": "ysipyl", "source.strings[240]": "ysradj", "source.strings[241]": "ywcibl", "source.strings[242]": "yxxehhyr", "source.strings[243]": "yzahogr", "source.strings[244]": "zdebpa", "source.strings[245]": "zedxipa", "source.strings[246]": "zehexj", "source.strings[247]": "zofawa", "source.strings[248]": "zqemwo", "source.strings[249]": "zqyduq", "source.strings[250]": "zumylse", "source.strings[251]": "zussace", "source.strings[252]": "zutipe", "source.strings[253]": "zvytsen", "source.strings[254]": "zxovokwe", "source.strings[255]": "zykbop" }, "x": 72, "id": 0, "is": [ "qyfunuvri0", "bhirojxy1", "imoncuw4", "elhylnewe1", "muctim7", "ypovlozy6", "fjedbukw4", "iqwisuztu6", "iqussicja1", "iqussicja1", "wemygqi0", "ukelowra3", "iqussicja1", "iqussicja1", "iqussicja1", "iqussicja1", "iqussicja1" ], "ms": { "file": { "size": 39065.0 }, "text": { "tab_count": 17.0, "digit_ratio": 0.02, "space_count": 4040.0, "total_lines": 20.0, "char_entropy": 4.53, "unique_chars": 72.0, "import_density": 85.0, "lines_over_200": 19.0, "lines_over_500": 18.0, "string_density": 286.8, "avg_line_length": 1952.3, "lines_over_1000": 10.0, "max_line_length": 9964.0, "last_line_length": 3.0, "most_common_char": "\"", "whitespace_ratio": 0.1, "most_common_ratio": 0.2, "identifier_density": 1.95, "line_length_stddev": 2149.46, "normalized_import_count": 3.8, "normalized_string_count": 1282.61, "max_inline_whitespace_run": 1.0, "normalized_unique_identifiers": 2.78 }, "imports": { "total": 17.0, "unique_modules": 11.0, "third_party_count": 17.0, "third_party_ratio": 1.0 }, "strings": { "total": 5736.0, "avg_length": 5.47, "max_length": 9.0, "path_count": 6.0, "avg_entropy": 2.21, "total_bytes": 31364.0, "entropy_stddev": 0.5 }, "comments": { "chars": 9963.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.11, "code_in_comments": 1.0 }, "functions": {}, "identifiers": { "total": 39.0, "avg_length": 8.83, "max_length": 10.0, "min_length": 7.0, "avg_entropy": 2.93, "reuse_ratio": 0.31, "unique_count": 12.0, "length_stddev": 1.07, "has_digit_ratio": 0.92, "numeric_suffix_count": 11.0 } }, "ss": [ [ 18, "qikerka" ], [ 19, "qikerka" ], [ 42, "xcaxyf" ], [ 43, "xcaxyf" ], [ 52, "baqitvy" ], [ 53, "baqitvy" ], [ 63, "octanalc" ], [ 64, "octanalc" ], [ 76, "ucfijga" ], [ 77, "ucfijga" ], [ 87, "ybgyfa" ], [ 88, "ybgyfa" ], [ 97, "ltaw" ], [ 98, "ltaw" ], [ 105, "obe" ], [ 106, "obe" ], [ 112, "Cre" ], [ 113, "Cre" ], [ 123, "vatytbu" ], [ 124, "vatytbu" ], [ 134, "ujokd" ], [ 135, "ujokd" ], [ 143, "ysipyl" ], [ 144, "ysipyl" ], [ 153, "ejbyvwo" ], [ 154, "ejbyvwo" ], [ 164, "iryb" ], [ 165, "iryb" ], [ 172, "ije" ], [ 173, "ije" ], [ 179, "umer" ], [ 180, "umer" ], [ 187, "ptyqozw" ], [ 188, "ptyqozw" ], [ 198, "nryfb" ], [ 199, "nryfb" ], [ 207, "ifwa" ], [ 208, "ifwa" ], [ 215, "xvuqo" ], [ 216, "xvuqo" ], [ 224, "afzovfibq" ], [ 225, "afzovfibq" ], [ 237, "avexoq" ], [ 238, "avexoq" ], [ 247, "bowsax" ], [ 248, "bowsax" ], [ 263, "mgovirry" ], [ 264, "mgovirry" ], [ 275, "bubveld" ], [ 276, "bubveld" ], [ 286, "esuk" ], [ 287, "esuk" ], [ 294, "wkija" ], [ 295, "wkija" ], [ 303, "ulwixex" ], [ 304, "ulwixex" ], [ 314, "errocy" ], [ 315, "errocy" ], [ 324, "pkyrfuzk" ], [ 325, "pkyrfuzk" ], [ 336, "ltarsa" ], [ 337, "ltarsa" ], [ 347, "enkigu" ], [ 348, "enkigu" ], [ 357, "yfozzolv" ], [ 358, "yfozzolv" ], [ 369, "cliky" ], [ 370, "cliky" ], [ 378, "pxidd" ], [ 379, "pxidd" ], [ 387, "ate" ], [ 388, "ate" ], [ 398, "ubguxric" ], [ 399, "ubguxric" ], [ 410, "uzqoz" ], [ 411, "uzqoz" ], [ 419, "ifawg" ], [ 420, "ifawg" ], [ 428, "alekevr" ], [ 429, "alekevr" ], [ 439, "yxxehhyr" ], [ 440, "yxxehhyr" ], [ 451, "bmywb" ], [ 452, "bmywb" ], [ 460, "eqi" ], [ 461, "eqi" ], [ 467, "ata" ], [ 468, "ata" ], [ 474, "zehexj" ], [ 475, "zehexj" ], [ 484, "woso" ], [ 485, "woso" ], [ 492, "yqkyn" ], [ 493, "yqkyn" ], [ 507, "ycpuciz" ], [ 508, "ycpuciz" ], [ 518, "pif" ], [ 519, "pif" ], [ 525, "ogzichic" ], [ 526, "ogzichic" ], [ 537, "xlumemi" ], [ 538, "xlumemi" ], [ 548, "siqy" ], [ 549, "siqy" ], [ 556, "vywhejdu" ], [ 557, "vywhejdu" ], [ 568, "ecun" ], [ 569, "ecun" ], [ 576, "dvobd" ], [ 577, "dvobd" ], [ 585, "mrupy" ], [ 586, "mrupy" ], [ 594, "egmuny" ], [ 595, "egmuny" ], [ 604, "gok" ], [ 605, "gok" ], [ 611, "kwepu" ], [ 612, "kwepu" ], [ 620, "afralegq" ], [ 621, "afralegq" ], [ 632, "upyvj" ], [ 633, "upyvj" ], [ 641, "piwz" ], [ 642, "piwz" ], [ 649, "kici" ], [ 650, "kici" ], [ 657, "ttexynxe" ], [ 658, "ttexynxe" ], [ 669, "ondez" ], [ 670, "ondez" ], [ 679, "iqymzi" ], [ 680, "iqymzi" ], [ 689, "mow" ], [ 690, "mow" ], [ 696, "Obj" ], [ 697, "Obj" ], [ 707, "utdamw" ], [ 708, "utdamw" ], [ 724, "ejiza" ], [ 725, "ejiza" ], [ 733, "wbagr" ], [ 734, "wbagr" ], [ 742, "quntyqz" ], [ 743, "quntyqz" ], [ 753, "inu" ], [ 754, "inu" ], [ 760, "zxovokwe" ], [ 761, "zxovokwe" ], [ 773, "thydwimz" ], [ 774, "thydwimz" ], [ 785, "ozxi" ], [ 786, "ozxi" ], [ 793, "ofqaty" ], [ 794, "ofqaty" ], [ 803, "ect" ], [ 804, "ect" ], [ 810, "yfgy" ], [ 811, "yfgy" ], [ 822, "ojle" ], [ 823, "ojle" ], [ 830, "ykba" ], [ 831, "ykba" ], [ 838, "ofide" ], [ 839, "ofide" ], [ 847, "lahetxe" ], [ 848, "lahetxe" ], [ 858, "oso" ], [ 859, "oso" ], [ 865, "ovxocyg" ], [ 866, "ovxocyg" ], [ 876, "ysa" ], [ 877, "ysa" ], [ 883, "itewqek" ], [ 884, "itewqek" ], [ 894, "hygijk" ], [ 895, "hygijk" ], [ 904, "klyl" ], [ 905, "klyl" ], [ 912, "uxatry" ], [ 913, "uxatry" ], [ 927, "fawiqba" ], [ 928, "fawiqba" ], [ 938, "wupqybbo" ], [ 939, "wupqybbo" ], [ 950, "tsoszykte" ], [ 951, "tsoszykte" ], [ 963, "egu" ], [ 964, "egu" ], [ 970, "irdyfx" ], [ 971, "irdyfx" ], [ 980, "otji" ], [ 981, "otji" ], [ 988, "ivub" ], [ 989, "ivub" ], [ 996, "cumymnu" ], [ 997, "cumymnu" ], [ 1007, "yjyfq" ], [ 1008, "yjyfq" ], [ 1016, "hact" ], [ 1017, "hact" ], [ 1024, "ukume" ], [ 1025, "ukume" ], [ 1033, "uranhyf" ], [ 1034, "uranhyf" ], [ 1044, "ifpu" ], [ 1045, "ifpu" ], [ 1052, "kuqaqp" ], [ 1053, "kuqaqp" ], [ 1063, "Sc" ], [ 1064, "Sc" ], [ 1069, "kirucw" ], [ 1070, "kirucw" ], [ 1083, "tzepw" ], [ 1084, "tzepw" ], [ 1092, "ene" ], [ 1093, "ene" ], [ 1106, "nugba" ], [ 1107, "nugba" ], [ 1115, "cjek" ], [ 1116, "cjek" ], [ 1123, "xype" ], [ 1124, "xype" ], [ 1131, "bjofuxk" ], [ 1132, "bjofuxk" ], [ 1142, "guh" ], [ 1143, "guh" ], [ 1149, "iry" ], [ 1150, "iry" ], [ 1156, "ffartula" ], [ 1157, "ffartula" ], [ 1168, "ypa" ], [ 1169, "ypa" ], [ 1175, "waxk" ], [ 1176, "waxk" ], [ 1183, "adqovom" ], [ 1184, "adqovom" ], [ 1194, "vvuswo" ], [ 1195, "vvuswo" ], [ 1204, "oxpizke" ], [ 1205, "oxpizke" ], [ 1215, "itri" ], [ 1216, "itri" ], [ 1223, "tmijfo" ], [ 1224, "tmijfo" ], [ 1233, "edsu" ], [ 1234, "edsu" ], [ 1241, "agna" ], [ 1242, "agna" ], [ 1249, "xik" ], [ 1250, "xik" ], [ 1256, "rihsasda" ], [ 1257, "rihsasda" ], [ 1268, "ugac" ], [ 1269, "ugac" ], [ 1277, "xqubyzo" ], [ 1278, "xqubyzo" ] ], "sz": 39065, "ts": [ { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "a": "T1027.003", "c": 1.0, "d": "JavaScript or TypeScript source file extension", "e": [ "20170124_0ec4b612cc379bb036cc05d4ca24fc3b.js" ], "i": "objectives/anti-static/obfuscation/payload/container::js-source-extension", "l": 1, "m": "B0032" }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "atob" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-10", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".G" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 20.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "a": "T1195.002, T1059.007", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/supply-chain/hidden-payload/runtime::fetched-text-function-param--rx-5", "l": 1 }, { "c": 0.800000011920929, "d": "ADODB.Stream string fragment (ADODB/ADO)", "e": [ "ADO" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-1", "l": 3 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170124_0ec4b612cc379bb036cc05d4ca24fc3b.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1195.002", "c": 1.0, "d": "hex encoding string", "e": [ "hexgu", "zehexj", "yxrarhex" ], "i": "objectives/supply-chain/hidden-payload/staging::hex-str", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "atob" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-5", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Quoted JSON IV field", "e": [ "\"iv\"" ], "i": "micro-behaviors/crypto/symmetric/aes/payload::quoted-iv-field", "l": 1, "m": "C0021.001" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 9964.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170124_0ec4b612cc379bb036cc05d4ca24fc3b.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.800000011920929, "d": "Immediate indexing of array literal", "e": [ "['qikerka', WScript][1]" ], "i": "micro-behaviors/data/source/syntax/array::array-literal-indexing", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-1", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 10.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "c": 0.8399999737739563, "d": "JavaScript unusually long average lines", "e": [ "text.avg_line_length = 1952.30" ], "i": "objectives/anti-static/obfuscation/string/anomaly::javascript-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Multiple source lines exceed 1000 chars", "e": [ "text.lines_over_1000 = 10.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-layout", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny ResponseBody fragments (spon, seB, ody);)", "e": [ "seB" ], "i": "objectives/execution/interpreter/script/wsh-fragments::response-body-fragment-tiny-exact", "l": 4 }, { "c": 0.9200000166893005, "d": "Executable code embedded in comment", "e": [ "comments.code_in_comments = 1.00" ], "i": "objectives/anti-static/obfuscation/string/array::js-comment-exec-body", "l": 3 } ], "sha": "2230242707c291dd4e040e18392291725e1b0ef129004f3285a55a9189be40b6", "path": "20170124_0ec4b612cc379bb036cc05d4ca24fc3b.js", "type": "javascript" } ], "tv": "84923" } }