{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9067564,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99766356,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T14:02:43Z"
  },
  "path": "24d409627bab5b40ff90556fd076314d302c8ff4c2c9f95024cb5177221652c6.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(As₃Xe)",
        "x": 35,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 71.0,
              "call_count": 1.0,
              "node_count": 423.0,
              "target_count": 0.0,
              "string_literal_count": 3.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 4244.0,
              "entropy": 4.07,
              "size_bytes": 4244.0
            },
            "text": {
              "digit_ratio": 0.8,
              "space_count": 8.0,
              "total_lines": 1.0,
              "char_entropy": 4.07,
              "unique_chars": 69.0,
              "lines_over_200": 1.0,
              "lines_over_500": 1.0,
              "string_density": 3.0,
              "avg_line_length": 4244.0,
              "lines_over_1000": 1.0,
              "max_line_length": 4244.0,
              "last_line_length": 4244.0,
              "long_token_count": 2.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.13,
              "identifier_density": 19.0,
              "encoded_string_ratio": 0.33,
              "normalized_string_count": 3.0,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 1.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 49.0
            },
            "strings": {
              "total": 3.0,
              "avg_length": 1335.67,
              "max_length": 3998.0,
              "avg_entropy": 3.46,
              "empty_count": 1.0,
              "hex_strings": 1.0,
              "total_bytes": 4007.0,
              "entropy_stddev": 0.29,
              "very_long_strings": 1.0
            },
            "comments": {
              "chars": 4242.0,
              "lines": 1.0,
              "total": 1.0,
              "base64_in_comments": 1.0
            },
            "identifiers": {
              "total": 19.0,
              "avg_length": 5.5,
              "max_length": 9.0,
              "min_length": 4.0,
              "avg_entropy": 2.35,
              "reuse_ratio": 0.42,
              "unique_count": 8.0,
              "length_stddev": 1.73,
              "has_digit_ratio": 0.63,
              "numeric_suffix_count": 5.0
            }
          },
          "s": [
            [
              44,
              "u8",
              "jEwZmzFqv"
            ],
            [
              44,
              "u8",
              "jEwZmzFqv"
            ],
            [
              61,
              "u8",
              "4e3310381949764c5131160e29191f2b5f380f31590908083018150f151833030e0b10180b22122830407c22130930053319031603191e2a143501471d220f19"
            ],
            [
              61,
              "u8",
              "4e3310381949764c5131160e29191f2b5f380f31590908083018150f151833030e0b10180b22122830407c22130930053319031603191e2a143501471d220f19"
            ]
          ],
          "v": {
            "source.language": "powershell",
            "source.strings[0]": "4e3310381949764c5131160e29191f2b5f380f31590908083018150f151833030e0b10180b22122830407c22130930053319031603191e2a143501471d220f1931123743342305583920142f1f13320826182a03350e152a250f1a202a60572e2a0247587e533d5a476156411062506149127e4c514d06030e373715354e2b72507d565e2f484b202a1e34402a27051e4a6112341b4012343b3a655f013e03350513076b3e15432a27051e377f4d1d080e1410180e2a1a1c0416233f1707205f734441081401470c033f005a6b38020f2823231d1f66351f1820142e02083f515b3a2403324d5e2f4856470318280e1f3a3e031e68392f01167d551c5b754a100213285c260b311f7a49137f515e31160e29191f2b5f3f256b273b19121b4b4c2d2003080c14221e1b2c2c1b3f231b2b145e436e507d431f3e14514d6c4c7e064b774c3c052c19773d1b3219564e2c4e7a45211508051e201a7424356821171e2d2a60573d2305240b2b1335003c2f1d1324241a3f45536d565144625071491d71584d4e294668504a7d1719186d53375c497b414d4e2846694d572a055659655a3b031e665c180531577e014b744a520774447146533d0504133e1e3c4557281e024a6d233f1e0e6b21171e2d577e074b76585f110c192c0211235c210f27253f1c0f2302024a682228045a61561e1e3107295755691d05032e1d2903096813130f37583b1d1369460c44200f3f4a5d665c391f313133011f66551c5b7557773809233317192c140a0c083518180d383e341b152d145b3d201508080b3314051e655a0f1f136656510231032a1e40695e1a192c1c301e14355f140f2005750c0a2f5e1f04211222430a2e01490b7813364b0e291a130478466d0b1b744413527442625e4f72414f5e27446a094b704712527714390e4b2041465d204062081c7647120b21136a081f7e40155b20126a5d497510455b71467c1e08254c15062a023e0b162703134c2615670e12341e1b0f63053f0b472e05021a3652692c5f7437535803152f00182a14140f201d3b1e0a2303150f2b032808542903114f77317c001522144b0929182f091c2a10040f62507a40353305300329127a49117740564710043f2f1b3518153a2405290414214a1f0c6d233f1e0e6b21171e2d577e064b77580d4e294668504b3b141a19200c09191b34055b3929123f1d5a6b2213092a193e1e5a740c0b09240339050115051718315a09011f23015647161239021422025658380a61041c6e5c1805315772391f35055b3a2403324d5e2d4047436c0c3f1513320c4d4e2b466e50302918184715162e055a62184f4a6d2c09140932141b440c38743d1b32192b507f303f1928271f1205283133011f08101b0f6d5e73563423065b233112374d570f051307110e2a085a0218040f2603351f03665c260b311f7a4914774556470318280e1f3a3e031e68392f01167d55195b704a1a455d6109514d69507d400361565f512c117249127e515b0420577d4a5d61580d4e2a466f46476e56514735507d465e2e495f1761186b58517b59514d68187d4a51621f475e6c4c7e024b735a4b4e2e466b56132059220f3603773d1b3219564e2f466a44016051520074477a2d1577440a25300377230f2a1d0b0f29043f16293210041e68272802192302054a683133011f161002026553315c4b665c21032b13351a2932081a0f653f33091e231f0b5161076b5b4701140247061f33011e0f051307655a0a0c0e2e51520474437a403c2f1d020f375770431f3e145647171239180835145647031e36080615141a0f26037722182c14151e655a1c04083505565b7e532b5c4d7b36131e68343204162238020f2857773d1b3219564e2b466e4d5700181a1e20057a47542b021f4a68253f0e0f3402134a683133011f3a22130620142e4035241b13093157772b133402024a744c7e1f4b7e4c5204301b36565e35404f5761192f01167d18104261076b5b533d55045b7d4a7e1d4b705f301f291b140c17234a5219744e67490a7747582e2c053f0e0e29030f440302360134271c1317201b2908132059521b744073165e34404e5761066b5a5400041a060b163708416202475378532b5c4d68351f1820142e02083f5f301f291b140c17230c1306361221490877494b4e2e466b10412f175e4e37466244012f175e4e364663440115051718315a0a1f1525140519655a1c04162321171e2d577e1f4b7e515b3d2a0531041421351f1820142e02083f515219744e7a402d2f1f120532242e141623513e0321133f0307231d050f3e242e0c08325c26182a143f1e09665c300329120a0c0e2e515218744f7a402d2f1f120532242e141623513e0321133f03073b4a02183c0c080817290713470c033f005a6b3d1f1e20053b012a27051e4a611c6b5c5a6b37191826127a403f3403191804142e04152851250329123419163f321904311e34181f3b12171e261f21104132030f112c1172391f35055b3a2403324d5e2c4046433e253f001530145b233112374d570a18020f3716363d1b3219564e2f466a4d57001e04092057772808341e042b260333021466221f0620192e0103051e181e2c192f08073b12171e261f211041614a251e24052e402a341e150f36047a402d2f1f120532242e141623513e0321133f035a361e010f37043208162a515b2b37102f001f28053a0336037a4a57081e26182a1133011f615d5147121e3409153122021329127d415d0e18120e20197d415d6b321907281634095d6a55000d2703695d4123091f1e",
            "source.strings[1]": "jEwZmzFqv"
          },
          "id": "powershell"
        },
        "id": 0,
        "sz": 4244,
        "ts": [
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[convert]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "a": "T1059.001",
            "c": 0.699999988079071,
            "d": "ScriptBlock execution",
            "e": [
              "[ScriptBlock]"
            ],
            "i": "objectives/execution/interpreter/eval/invoke::scriptblock",
            "l": 3,
            "m": "E1059"
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "a": "T1059.001",
            "d": "PowerShell call operator",
            "e": [
              "\u0026("
            ],
            "i": "objectives/execution/interpreter/eval/invoke::call-operator",
            "l": 3,
            "m": "E1059"
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 4244.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "d": "PowerShell bitwise XOR operator",
            "e": [
              "-bxor"
            ],
            "i": "objectives/command-and-control/dropper/lnk/remcos::powershell-bxor-op",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 4244.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Suspicious long PowerShell line",
            "e": [
              "text.max_line_length = 4244.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.75,
            "d": "Large hex-encoded string (1024+ chars)",
            "e": [
              "4e3310381949764c5131160e29191f2b5f380f31590908083018150f151833030e0b10180b22122830407c22130930053319031603191e2a143501471d220f19"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encoded::large-hex-string-dup",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Very long base64 strings present",
            "e": [
              "4e3310381949764c5131160e29191f2b5f380f31590908083018150f151833030e0b10180b22122830407c22130930053319031603191e2a143501471d220f19"
            ],
            "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 4244.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.4000000059604645,
            "d": "Very few string literals (string obfuscation indicator)",
            "e": [
              "strings.total = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          }
        ],
        "sha": "24d409627bab5b40ff90556fd076314d302c8ff4c2c9f95024cb5177221652c6",
        "path": "24d409627bab5b40ff90556fd076314d302c8ff4c2c9f95024cb5177221652c6.ps1",
        "type": "powershell"
      }
    ],
    "tv": "9ea7c"
  }
}