{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.8549450635910034 } ], "prob": 0.85494506, "models": [ { "m": "az", "raw": 0.21526383, "prob": 0.85494506, "class": 0 }, { "m": "az/scripts", "raw": 0.16396427, "prob": 0.6460582, "class": 0 }, { "m": "az/batch", "raw": 0.6742187, "prob": 0.99776316, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T13:34:39Z" }, "path": "BatchGotAdmin International-Fix Code.bat", "raw": { "v": "6", "fs": [ { "f": "O(C)H(Os)", "x": 40, "ff": { "m": { "ast": { "max_depth": 6.0, "call_count": 10.0, "node_count": 111.0, "identifier_count": 6.0, "string_literal_count": 12.0 }, "file": { "size": 1007.0, "entropy": 5.12, "size_bytes": 1007.0 }, "text": { "tab_count": 2.0, "digit_ratio": 0.03, "space_count": 107.0, "total_lines": 29.0, "char_entropy": 5.12, "mixed_indent": 1.0, "unique_chars": 71.0, "string_density": 0.41, "ascii_art_lines": 2.0, "avg_line_length": 33.72, "max_line_length": 81.0, "empty_line_ratio": 0.17, "last_line_length": 36.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.16, "identifier_density": 0.31, "line_length_stddev": 27.68, "normalized_string_count": 2.23, "repeated_char_sequences": 2.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.2, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 45.0, "normalized_unique_identifiers": 1.24 }, "calls": { "count": 10.0 }, "binary": { "overall_entropy": 5.12 }, "strings": { "total": 12.0, "avg_length": 13.17, "max_length": 35.0, "avg_entropy": 3.21, "empty_count": 2.0, "total_bytes": 158.0, "entropy_stddev": 1.0 }, "comments": { "chars": 197.0, "lines": 5.0, "total": 5.0, "to_code_ratio": 0.21, "url_in_comments": 1.0, "base64_in_comments": 1.0 }, "identifiers": { "count": 6.0, "total": 9.0, "avg_length": 5.0, "max_length": 12.0, "min_length": 2.0, "avg_entropy": 1.89, "reuse_ratio": 0.67, "unique_count": 6.0, "length_stddev": 3.27, "all_uppercase_ratio": 0.83 } }, "s": [ [ 243, "u8", "%SYSTEMROOT%\\system32\\cacls.exe" ], [ 277, "u8", "%SYSTEMROOT%\\system32\\config\\system" ], [ 578, "u8", "Shell.Application" ], [ 650, "u8", "%~s0" ], [ 666, "u8", "RUNAS" ], [ 707, "u8", "%Temp%\\getadmin.vbs" ], [ 765, "u8", "%Temp%\\getadmin.vbs" ], [ 793, "u8", "%Temp%\\getadmin.vbs" ], [ 827, "u8", "%CD%" ], [ 844, "u8", "%~dp0" ] ], "v": { "file.stem": "BatchGotAdmin International-Fix Code", "file.basename": "BatchGotAdmin International-Fix Code.bat", "source.language": "batch" }, "id": "batch" }, "id": 0, "sz": 1007, "ts": [ { "d": "Five or fewer comment lines in file", "e": [ "comments.lines = 5.00" ], "i": "metadata/file/text/metrics::few-comment-lines", "l": 1 }, { "a": "T1105", "c": 0.7799999713897705, "d": "Loader key argument hint", "e": [ " permissions" ], "i": "objectives/command-and-control/dropper/execution/batch::rc4-key-argument-hint", "l": 1 }, { "c": 0.7200000286102295, "d": "LLM instruction context", "e": [ "Prompt" ], "i": "micro-behaviors/data/text/llm/override::llm-instruction-context", "l": 1 }, { "c": 0.75, "d": "Tiny multi-line text script", "e": [ "text.total_lines = 29.00" ], "i": "metadata/file/text/profile::tiny-text-script", "l": 2 }, { "c": 0.699999988079071, "d": "Windows %TEMP% or %TMP% environment reference", "e": [ "%Temp%" ], "i": "micro-behaviors/fs/path/temp::win-temp-env", "l": 2 }, { "a": "T1548.002", "c": 0.9399999976158142, "d": "Batch checks admin with cacls", "e": [ "cacls.exe\" \"%SYSTEMROOT%\\system32\\config\\system" ], "i": "objectives/command-and-control/dropper/staging/embedded::cacls-runas-self-elevation", "l": 4 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "RUNAS" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "d": ".vbs extension reference", "e": [ ".vbs" ], "i": "micro-behaviors/fs/path/extension::vbs", "l": 2 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "c": 0.8799999952316284, "d": "Codebase deletion target", "e": [ "Code" ], "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase", "l": 1 }, { "c": 0.699999988079071, "d": "Redirect output to null", "e": [ "\u003enul" ], "i": "objectives/command-and-control/dropper/execution/batch::redirect-null", "l": 1 }, { "c": 0.550000011920929, "d": "Stdout redirected to NUL", "e": [ "\u003enul" ], "i": "micro-behaviors/os/console/io::windows-stdout-to-nul", "l": 2 }, { "c": 0.9399999976158142, "d": "Batch echo redirects staged content", "e": [ " ECHO Set UAC = CreateObject^(\"Shell.Application\"^) \u003e " ], "i": "objectives/command-and-control/dropper/execution/batch::grouped-echo-stage-redirect--rx-3", "l": 1 }, { "c": 1.0, "d": "Contains %TEMP% environment variable string", "e": [ "%TEMP%" ], "i": "micro-behaviors/os/env/vars/access::temp-env-var", "l": 2 }, { "a": "T1485", "c": 1.0, "d": "Windows recursive deletion target SYSTEMROOT", "e": [ "%SYSTEMROOT%" ], "i": "objectives/impact/system/directory::windows-recursive-delete-target-systemroot", "l": 1 }, { "a": "T1071.001", "c": 0.75, "d": "HTTP/HTTPS URL literal (raw)", "e": [ "https://sites.google.com" ], "i": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal-raw", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "Batch script extension", "e": [ "BatchGotAdmin International-Fix Code.bat" ], "i": "metadata/file/extension::bat", "l": 2 }, { "a": "T1547.001", "c": 0.6000000238418579, "d": "Run value name string", "e": [ "Run" ], "i": "objectives/persistence/login/startup/registry::run-value-name", "l": 1 }, { "c": 1.0, "d": ".vbs extension", "e": [ ".vbs" ], "i": "objectives/command-and-control/dropper/builder::vbs-ext", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 } ], "sha": "247d35a0c4544ccaf9b862f787b11a3961494d4901f0a6d911eb706adc507966", "path": "/data/samples/good/projects/batch/Batch-Tools-SysAdmin/functions/RunAsAdministrator/BatchGotAdmin International-Fix Code.bat", "type": "batch" } ], "tv": "318d5" } }