{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9473684430122375, "class": 0 } ], "prob": 0.94736844, "class": 0, "models": [ { "m": "az", "prob": 0.6687533, "class": 0 }, { "m": "az/scripts", "prob": 0.39449543, "class": 0 }, { "m": "az/javascript", "prob": 0.94736844, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-12T14:54:38Z" }, "path": "20170410_9a7cbdaa66ef8e3cbe080c51f72e79f6.js", "raw": { "v": "4", "fs": [ { "f": "O₃(AsCXe)H₂(Os₂Po₂)", "k": { "source.imports[0]": "Base", "source.imports[1]": "Bulk", "source.imports[2]": "Copy", "source.imports[3]": "Fold", "source.imports[4]": "Guam", "source.imports[5]": "Hac", "source.imports[6]": "IF", "source.imports[7]": "Id", "source.imports[8]": "Isle", "source.imports[9]": "JIS", "source.strings[0]": " Bypass';$IRC='^user", "source.strings[1]": "$Run='^nv:temp+", "source.strings[2]": "$Run='^nv:temp+''\\\\II", "source.strings[3]": "$e189='^e(''http://n", "source.strings[4]": "$path); ';$e159='^Ne", "source.strings[5]": "-Expression ($tint+$", "source.strings[6]": ".php?f=2.';$e077='^e", "source.strings[7]": "89+$e077+$IRC+$ie+$S", "source.strings[8]": "MAA:://D;OFMF", "source.strings[9]": "S';$Site='^Start-Pro", "source.has_imports": true, "source.imports[10]": "MKD", "source.imports[11]": "Mess", "source.imports[12]": "More", "source.imports[13]": "Move", "source.imports[14]": "Omsk", "source.imports[15]": "PHP", "source.imports[16]": "REST", "source.imports[17]": "SET", "source.imports[18]": "SH", "source.imports[19]": "STOR", "source.imports[20]": "Some", "source.imports[21]": "Tome", "source.imports[22]": "Unix", "source.imports[23]": "Wake", "source.imports[24]": "a0", "source.imports[25]": "ante", "source.imports[26]": "b3f", "source.imports[27]": "b7", "source.imports[28]": "bca", "source.imports[29]": "chr", "source.imports[30]": "city", "source.imports[31]": "cols", "source.imports[32]": "cos", "source.imports[33]": "dims", "source.imports[34]": "dir", "source.imports[35]": "drop", "source.imports[36]": "e015", "source.imports[37]": "e063", "source.imports[38]": "e096", "source.imports[39]": "e097", "source.imports[40]": "e124", "source.imports[41]": "e125", "source.imports[42]": "e143", "source.imports[43]": "e176", "source.imports[44]": "e188", "source.imports[45]": "eget", "source.imports[46]": "elem", "source.imports[47]": "f126", "source.imports[48]": "f534", "source.imports[49]": "fade", "source.imports[50]": "far", "source.imports[51]": "fast", "source.imports[52]": "ftp", "source.imports[53]": "gasp", "source.imports[54]": "good", "source.imports[55]": "grad", "source.imports[56]": "gz", "source.imports[57]": "h3", "source.imports[58]": "h6", "source.imports[59]": "hack", "source.imports[60]": "hero", "source.imports[61]": "hi", "source.imports[62]": "kr", "source.imports[63]": "lot", "source.imports[64]": "meet", "source.imports[65]": "mr", "source.imports[66]": "need", "source.imports[67]": "pin", "source.imports[68]": "plan", "source.imports[69]": "port", "source.imports[70]": "prev", "source.imports[71]": "puts", "source.imports[72]": "rsd", "source.imports[73]": "sets", "source.imports[74]": "sftp", "source.imports[75]": "sin", "source.imports[76]": "skin", "source.imports[77]": "sync", "source.imports[78]": "tail", "source.imports[79]": "task", "source.imports[80]": "tl", "source.imports[81]": "uri", "source.imports[82]": "utf8", "source.imports[83]": "v3", "source.imports[84]": "v_nb", "source.imports[85]": "way", "source.imports[86]": "x20", "source.strings[10]": "WScript.Shell", "source.strings[11]": "^ss; $path=($e';$ti", "source.strings[12]": "_dfw+$I+$f141+$Run+$", "source.strings[13]": "boolean", "source.strings[14]": "br+$ki+$e159+$No+$e1", "source.strings[15]": "cess';$I='^ -Scope P", "source.strings[16]": "cmd.exe /c ", "source.strings[17]": "cmd.exe /c \\\"powershe", "source.strings[18]": "ew-O';$_dfw='^Policy", "source.strings[19]": "ite+$urna);", "source.strings[20]": "ite+$urna);\\\\\\", "source.strings[21]": "ll $urna='^ $path';", "source.strings[22]": "lopoenz.top/';$f141=", "source.strings[23]": "nt='^Set-Execution';", "source.strings[24]": "oadFil';$ie='^gif'',", "source.strings[25]": "ob';$br='^.exe'');(N", "source.strings[26]": "object", "source.strings[27]": "powershe", "source.strings[28]": "roce';$ki='^bject Sy", "source.strings[29]": "stem.';$No='^).Downl", "source.strings[30]": "t.Webclient'; Invoke", "source.functions[0]": "A", "source.functions[1]": "Copy", "source.functions[2]": "Hac", "source.functions[3]": "Isle", "source.functions[4]": "STOR", "source.functions[5]": "Some", "source.functions[6]": "Unix", "source.functions[7]": "b7", "source.functions[8]": "city", "source.functions[9]": "e063", "source.functions[10]": "e124", "source.functions[11]": "e125", "source.functions[12]": "e176", "source.functions[13]": "f126", "source.functions[14]": "fade", "source.functions[15]": "far", "source.functions[16]": "gasp", "source.functions[17]": "hack", "source.functions[18]": "kr", "source.functions[19]": "lot", "source.functions[20]": "meet", "source.functions[21]": "need", "source.functions[22]": "plan", "source.functions[23]": "rsd", "source.functions[24]": "sets", "source.functions[25]": "sin", "source.functions[26]": "tl", "source.functions[27]": "uri" }, "x": 39, "id": 0, "is": [ "good", "cos", "e143", "bca", "v_nb", "prev", "h6", "Guam", "chr", "e096", "Base", "Omsk", "e015", "SH", "drop", "v3", "Tome", "e097", "Id", "eget", "MKD", "e188", "grad", "JIS", "sync", "utf8", "tl", "port", "b3f", "sin", "gz", "ante", "f534", "way", "e176", "e124", "h3", "elem", "Mess", "sets", "Some", "city", "Isle", "hack", "f126", "STOR", "Unix", "plan", "gasp", "lot", "meet", "Hac", "b7", "uri", "e063", "kr", "rsd", "fade", "need", "far", "Copy", "Move", "Fold", "ftp", "x20", "Wake", "cols", "mr", "SET", "hero", "e125", "More", "skin", "dir", "dims", "PHP", "puts", "tail", "a0", "task", "IF", "pin", "fast", "sftp", "hi", "Bulk", "REST" ], "ms": { "file": { "size": 5895.0 }, "text": { "digit_ratio": 0.09, "space_count": 1715.0, "total_lines": 228.0, "char_entropy": 4.76, "unique_chars": 84.0, "import_density": 38.16, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.54, "avg_line_length": 24.86, "lines_over_1000": 1.0, "max_line_length": 1022.0, "empty_line_ratio": 0.19, "last_line_length": 1.0, "most_common_char": "e", "whitespace_ratio": 0.33, "most_common_ratio": 0.05, "identifier_density": 1.14, "line_length_stddev": 68.62, "normalized_import_count": 5.76, "normalized_string_count": 8.21, "repeated_char_sequences": 46.0, "suspicious_string_ratio": 0.02, "max_inline_whitespace_run": 2.0, "normalized_function_count": 1.85, "trailing_whitespace_lines": 11.0, "imports_to_functions_ratio": 3.11, "strings_to_functions_ratio": 4.43, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 20.17, "identifiers_to_functions_ratio": 5.64 }, "imports": { "total": 87.0, "unique_modules": 87.0, "third_party_count": 87.0, "third_party_ratio": 1.0 }, "strings": { "total": 124.0, "avg_length": 9.62, "max_length": 21.0, "avg_entropy": 2.37, "total_bytes": 1193.0, "entropy_stddev": 1.18, "shell_command_strings": 2.0 }, "comments": { "chars": 1000.0, "lines": 23.0, "total": 23.0, "to_code_ratio": 0.11, "empty_comments": 4.0 }, "functions": { "total": 28.0, "length_stddev": 0.49, "avg_name_length": 3.46, "no_params_count": 28.0, "avg_length_lines": 3.61, "max_length_lines": 4.0, "min_length_lines": 3.0, "single_char_names": 1.0, "numeric_suffix_names": 1.0, "density_per_100_lines": 12.28, "code_in_functions_ratio": 0.44 }, "identifiers": { "total": 259.0, "avg_length": 3.42, "max_length": 13.0, "min_length": 1.0, "avg_entropy": 1.64, "reuse_ratio": 0.61, "unique_count": 158.0, "length_stddev": 1.13, "has_digit_ratio": 0.22, "sequential_names": 11.0, "single_char_count": 4.0, "single_char_ratio": 0.03, "all_lowercase_ratio": 0.49, "all_uppercase_ratio": 0.09, "numeric_suffix_count": 31.0 } }, "ss": [ [ 27, "43400" ], [ 28, "43400" ], [ 298, "65503" ], [ 299, "65503" ], [ 855, "WScript.Shell" ], [ 856, "WScript.Shell" ], [ 3083, "utc" ], [ 3084, "utc" ], [ 3130, "object" ], [ 3131, "object" ], [ 3588, "38777" ], [ 3589, "38777" ], [ 3782, "boolean" ], [ 3783, "boolean" ], [ 3827, "run" ], [ 3828, "run" ], [ 3847, "fn" ], [ 3848, "fn" ], [ 3854, "cmd.exe /c \\\"powershe" ], [ 3855, "cmd.exe /c " ], [ 3868, "powershe" ], [ 3890, "a8c" ], [ 3891, "a8c" ], [ 3898, "ll $urna='^ $path';" ], [ 3899, "ll $urna='^ $path';" ], [ 3933, "TRUE" ], [ 3934, "TRUE" ], [ 3942, "$e189='^e(''http://n" ], [ 3943, "$e189='^e(''http://n" ], [ 3977, "r" ], [ 3978, "r" ], [ 3983, "ob';$br='^.exe'');(N" ], [ 3984, "ob';$br='^.exe'');(N" ], [ 4018, "INI" ], [ 4019, "INI" ], [ 4026, "ew-O';$_dfw='^Policy" ], [ 4027, "ew-O';$_dfw='^Policy" ], [ 4058, "IP" ], [ 4059, "IP" ], [ 4065, " Bypass';$IRC='^user" ], [ 4066, " Bypass';$IRC='^user" ], [ 4100, "init" ], [ 4101, "init" ], [ 4109, ".php?f=2.';$e077='^e" ], [ 4110, ".php?f=2.';$e077='^e" ], [ 4144, "aa" ], [ 4145, "aa" ], [ 4151, "lopoenz.top/';$f141=" ], [ 4152, "lopoenz.top/';$f141=" ], [ 4186, "rem" ], [ 4187, "rem" ], [ 4194, "^ss; $path=($e';$ti" ], [ 4195, "^ss; $path=($e';$ti" ], [ 4229, "sup" ], [ 4230, "sup" ], [ 4237, "nt='^Set-Execution';" ], [ 4238, "nt='^Set-Execution';" ], [ 4272, "aka" ], [ 4273, "aka" ], [ 4280, "$Run='^nv:temp+''\\\\II" ], [ 4281, "$Run='^nv:temp+" ], [ 4300, "II" ], [ 4315, "ISO" ], [ 4316, "ISO" ], [ 4323, "S';$Site='^Start-Pro" ], [ 4324, "S';$Site='^Start-Pro" ], [ 4358, "x1" ], [ 4359, "x1" ], [ 4365, "cess';$I='^ -Scope P" ], [ 4366, "cess';$I='^ -Scope P" ], [ 4399, "num" ], [ 4400, "num" ], [ 4407, "roce';$ki='^bject Sy" ], [ 4408, "roce';$ki='^bject Sy" ], [ 4440, "May" ], [ 4441, "May" ], [ 4448, "stem.';$No='^).Downl" ], [ 4449, "stem.';$No='^).Downl" ], [ 4482, "nx" ], [ 4483, "nx" ], [ 4489, "oadFil';$ie='^gif''," ], [ 4490, "oadFil';$ie='^gif''," ], [ 4524, "e197" ], [ 4525, "e197" ], [ 4533, "$path); ';$e159='^Ne" ], [ 4534, "$path); ';$e159='^Ne" ], [ 4566, "_0" ], [ 4567, "_0" ], [ 4573, "t.Webclient'; Invoke" ], [ 4574, "t.Webclient'; Invoke" ], [ 4607, "sake" ], [ 4608, "sake" ], [ 4616, "-Expression ($tint+$" ], [ 4617, "-Expression ($tint+$" ], [ 4651, "ajax" ], [ 4652, "ajax" ], [ 4660, "_dfw+$I+$f141+$Run+$" ], [ 4661, "_dfw+$I+$f141+$Run+$" ], [ 4695, "zu" ], [ 4696, "zu" ], [ 4702, "br+$ki+$e159+$No+$e1" ], [ 4703, "br+$ki+$e159+$No+$e1" ], [ 4736, "echo" ], [ 4737, "echo" ], [ 4745, "89+$e077+$IRC+$ie+$S" ], [ 4746, "89+$e077+$IRC+$ie+$S" ], [ 4780, "xls" ], [ 4781, "xls" ], [ 4788, "ite+$urna);\\\\\\" ], [ 4789, "ite+$urna);" ], [ 4879, "79538" ], [ 4880, "79538" ], [ 5003, "purl" ], [ 5004, "purl" ], [ 5538, "boolean" ], [ 5539, "boolean" ], [ 5664, "14178" ], [ 5665, "14178" ], [ 5721, "dv" ], [ 5722, "dv" ], [ 5750, "95258" ], [ 5751, "95258" ], [ 5854, "76500" ], [ 5855, "76500" ], [ 4295, "xor", "MAA:://D;OFMF" ] ], "sz": 5895, "ts": [ { "c": 0.8500000238418579, "d": "Execute commands via cmd.exe /c", "e": [ "cmd.exe /c" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command", "l": 3 }, { "c": 0.800000011920929, "d": "WScript.Shell object string", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/com/object::wscript-shell-literal", "l": 3 }, { "c": 0.9200000166893005, "d": "\"t.Sh\" fragment of split WScript.Shell", "e": [ "t.Sh" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-3", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1059", "c": 0.75, "d": "cmd.exe shell string", "e": [ "cmd.exe" ], "i": "objectives/command-and-control/reverse-shell/socket::cmd-exe-string", "l": 1 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 87.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Shell print command", "e": [ "echo" ], "i": "objectives/command-and-control/dropper/execution/browser::shell-print-command", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170410_9a7cbdaa66ef8e3cbe080c51f72e79f6.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1022.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.9200000166893005, "d": "\"crip\" fragment of split WScript.Shell", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 1.0, "d": "Regex component marker", "e": [ "good = null;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170410_9a7cbdaa66ef8e3cbe080c51f72e79f6.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 1.0, "d": "cmd command name", "e": [ "cmd" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-name", "l": 2 }, { "a": "T1105", "c": 0.8500000238418579, "d": "macOS shell interpreter", "e": [ "SH" ], "i": "objectives/command-and-control/dropper/execution/browser::macos-shell-interpreter", "l": 1, "m": "B0024" }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 87.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Opaque predicate using literal compare", "e": [ "if (e124() == 367)" ], "i": "objectives/anti-static/obfuscation/control-flow/retry::opaque-predicate-literal-compare", "l": 4 }, { "a": "T1105", "c": 0.8500000238418579, "d": "ClickFix copy-paste action word", "e": [ "Copy" ], "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word", "l": 1, "m": "B0024" }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".php" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Instantiates WScript.Shell object", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/wsh/file::wscript-shell-object", "l": 3 }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 11.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "echo" ], "i": "objectives/anti-static/obfuscation/syntax::js-eval-word-parts--rx-4", "l": 1 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "sync" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-storage-proxy-ops--rx-16", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 228.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 28.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Hardcoded .top domain", "e": [ "\"lopoenz.top/" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::hardcoded-domain-top", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.54" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript undefined literal", "e": [ "undefined" ], "i": "metadata/lang/scripted::undefined-literal", "l": 1 }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2b)", "e": [ "ipt.S" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2b", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "c": 1.0, "d": "References cmd.exe file path", "e": [ "cmd", ".exe" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-file-path", "l": 2 } ], "sha": "2b7216b1177ed76c12009ec2224a816d0a2e74a17cf69c19b87163df8b8196f8", "path": "20170410_9a7cbdaa66ef8e3cbe080c51f72e79f6.js", "type": "javascript" } ], "tv": "c1637" } }