{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.999761164188385, "class": 2 } ], "prob": 0.99976116, "class": 2, "models": [ { "m": "az", "prob": 0.9365423, "class": 0 }, { "m": "az/scripts", "prob": 0.9966535, "class": 1 }, { "m": "az/javascript", "prob": 0.99976116, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T11:36:27Z" }, "path": "20170127_ac02f835cc57f3f58c788eb66d607275.js", "raw": { "v": "4", "fs": [ { "f": "KO₆(As₃Xe₂CCoErS₃)H(Po)Md(Pa₂)", "k": { "source.imports[0]": "apxadulne6", "source.imports[1]": "ecifu7", "source.imports[2]": "gepuvdyh0", "source.imports[3]": "hqarow3", "source.imports[4]": "hzaqygu5", "source.imports[5]": "itnijovke6", "source.imports[6]": "ivagujco5", "source.imports[7]": "kvigriton0", "source.imports[8]": "sojubh1", "source.imports[9]": "ujkelif0", "source.strings[0]": "ablogv", "source.strings[1]": "agcecsil", "source.strings[2]": "agjifbe", "source.strings[3]": "ahezyf", "source.strings[4]": "ahmuqji", "source.strings[5]": "ahnunv", "source.strings[6]": "ajcyli", "source.strings[7]": "ajlacjo", "source.strings[8]": "ajryqut", "source.strings[9]": "ajupihr", "source.has_imports": true, "source.strings[10]": "akhehi", "source.strings[11]": "akzacp", "source.strings[12]": "aletvidb", "source.strings[13]": "amxygbyn", "source.strings[14]": "anzevy", "source.strings[15]": "apmikqop", "source.strings[16]": "apolanc", "source.strings[17]": "appogm", "source.strings[18]": "apzezh", "source.strings[19]": "aqenhut", "source.strings[20]": "aqihwy", "source.strings[21]": "ascohse", "source.strings[22]": "axkucu", "source.strings[23]": "azeqxok", "source.strings[24]": "bdacxazd", "source.strings[25]": "bjuxqaku", "source.strings[26]": "bkyndadi", "source.strings[27]": "bmyxmyxxy", "source.strings[28]": "boqviq", "source.strings[29]": "bsifodz", "source.strings[30]": "bweminpu", "source.strings[31]": "bwugoz", "source.strings[32]": "bzawan", "source.strings[33]": "cehoqca", "source.strings[34]": "cgapufm", "source.strings[35]": "cgigady", "source.strings[36]": "ckitef", "source.strings[37]": "comunu", "source.strings[38]": "csytak", "source.strings[39]": "cukxite", "source.strings[40]": "cynbyse", "source.strings[41]": "dgepli", "source.strings[42]": "djyvhu", "source.strings[43]": "dloqdum", "source.strings[44]": "dmazhu", "source.strings[45]": "dtorxetnu", "source.strings[46]": "dufeqn", "source.strings[47]": "dvazvitwe", "source.strings[48]": "ecudkym", "source.strings[49]": "ednygz", "source.strings[50]": "efmymky", "source.strings[51]": "efpexduj", "source.strings[52]": "efsijzam", "source.strings[53]": "egqicjut", "source.strings[54]": "egzedpo", "source.strings[55]": "ehrahuq", "source.strings[56]": "ejkany", "source.strings[57]": "ejyfvu", "source.strings[58]": "ekqixadt", "source.strings[59]": "emfykf", "source.strings[60]": "encofhilw", "source.strings[61]": "epdepmozn", "source.strings[62]": "eqbonqe", "source.strings[63]": "erfazsu", "source.strings[64]": "erxebx", "source.strings[65]": "etohepw", "source.strings[66]": "evnebo", "source.strings[67]": "ewamjilk", "source.strings[68]": "ewynit", "source.strings[69]": "exnuwo", "source.strings[70]": "ezgobc", "source.strings[71]": "favwawl", "source.strings[72]": "fborci", "source.strings[73]": "fcogzytcu", "source.strings[74]": "fduqvuhj", "source.strings[75]": "fmexligh", "source.strings[76]": "focgeck", "source.strings[77]": "fvepfynv", "source.strings[78]": "fymnugsy", "source.strings[79]": "ggyxek", "source.strings[80]": "gjoqaro", "source.strings[81]": "gnethy", "source.strings[82]": "gotjiqi", "source.strings[83]": "gvywlo", "source.strings[84]": "gysjuwt", "source.strings[85]": "hbapcifje", "source.strings[86]": "hhovma", "source.strings[87]": "hiqjipli", "source.strings[88]": "howepj", "source.strings[89]": "ibwutumc", "source.strings[90]": "ibytti", "source.strings[91]": "icqidy", "source.strings[92]": "icsuqpyc", "source.strings[93]": "iddiwyt", "source.strings[94]": "idhicne", "source.strings[95]": "idrewub", "source.strings[96]": "ihgojiwh", "source.strings[97]": "ihulur", "source.strings[98]": "ijizasn", "source.strings[99]": "ijutvyrt", "source.strings[100]": "ilxadq", "source.strings[101]": "iprekusl", "source.strings[102]": "iqetdur", "source.strings[103]": "itrebpog", "source.strings[104]": "ivahzo", "source.strings[105]": "ivruduk", "source.strings[106]": "iwetum", "source.strings[107]": "ixpirrulk", "source.strings[108]": "ixuzjav", "source.strings[109]": "izbibeq", "source.strings[110]": "jaccarr", "source.strings[111]": "jedtice", "source.strings[112]": "jivzynte", "source.strings[113]": "jmaniqni", "source.strings[114]": "jyqfehbo", "source.strings[115]": "jyrjugq", "source.strings[116]": "keghily", "source.strings[117]": "kpotafh", "source.strings[118]": "kzapary", "source.strings[119]": "ldeshe", "source.strings[120]": "lejtur", "source.strings[121]": "levijtu", "source.strings[122]": "lezirji", "source.strings[123]": "ljuhvu", "source.strings[124]": "lyhufa", "source.strings[125]": "madkad", "source.strings[126]": "mduzpemna", "source.strings[127]": "meckeggo", "source.strings[128]": "mijebfu", "source.strings[129]": "mkyvli", "source.strings[130]": "mlejyz", "source.strings[131]": "muwetz", "source.strings[132]": "mwysle", "source.strings[133]": "ndotosm", "source.strings[134]": "nechihi", "source.strings[135]": "newyqs", "source.strings[136]": "njirku", "source.strings[137]": "nogape", "source.strings[138]": "objejxe", "source.strings[139]": "obyfovv", "source.strings[140]": "odgubqern", "source.strings[141]": "ogyham", "source.strings[142]": "ohlywi", "source.strings[143]": "oloxny", "source.strings[144]": "omgibgaxt", "source.strings[145]": "onmyvruqq", "source.strings[146]": "onrypzefx", "source.strings[147]": "osazov", "source.strings[148]": "osvytp", "source.strings[149]": "osyvxym", "source.strings[150]": "owtemwoc", "source.strings[151]": "oxyjsuq", "source.strings[152]": "pefoxi", "source.strings[153]": "pemnibbu", "source.strings[154]": "pemoxfu", "source.strings[155]": "pgekusu", "source.strings[156]": "pifdynk", "source.strings[157]": "pwamru", "source.strings[158]": "pzylal", "source.strings[159]": "qafgyj", "source.strings[160]": "qawopke", "source.strings[161]": "qbukuv", "source.strings[162]": "qejmymu", "source.strings[163]": "qetgojme", "source.strings[164]": "qfytcurgi", "source.strings[165]": "qkobged", "source.strings[166]": "qmojukza", "source.strings[167]": "qotoho", "source.strings[168]": "quwily", "source.strings[169]": "qwugxeju", "source.strings[170]": "qyjnile", "source.strings[171]": "rceziwc", "source.strings[172]": "rcyznu", "source.strings[173]": "rewdehd", "source.strings[174]": "ribqem", "source.strings[175]": "rmexhyspe", "source.strings[176]": "roqvipe", "source.strings[177]": "saknuvh", "source.strings[178]": "sfifqoga", "source.strings[179]": "sguwcosi", "source.strings[180]": "sipcapn", "source.strings[181]": "sjozsudl", "source.strings[182]": "smuvtyflo", "source.strings[183]": "snaspynfo", "source.strings[184]": "sopgad", "source.strings[185]": "sowtuzve", "source.strings[186]": "spemcul", "source.strings[187]": "sywefcy", "source.strings[188]": "tboszali", "source.strings[189]": "tesiclo", "source.strings[190]": "tewhoje", "source.strings[191]": "tixihmy", "source.strings[192]": "ucfywlijd", "source.strings[193]": "ucqejxon", "source.strings[194]": "udecex", "source.strings[195]": "ufgesajw", "source.strings[196]": "ufjaqwi", "source.strings[197]": "ugqofcur", "source.strings[198]": "ugyxno", "source.strings[199]": "uhimge", "source.strings[200]": "ujzalubs", "source.strings[201]": "ukxufu", "source.strings[202]": "ulefko", "source.strings[203]": "ullefxo", "source.strings[204]": "umimdexc", "source.strings[205]": "urwasd", "source.strings[206]": "uselol", "source.strings[207]": "uskoru", "source.strings[208]": "uvucni", "source.strings[209]": "uwxempock", "source.strings[210]": "uzismoss", "source.strings[211]": "uzvevy", "source.strings[212]": "vbeluri", "source.strings[213]": "webvoh", "source.strings[214]": "wfiluvry", "source.strings[215]": "wilragr", "source.strings[216]": "wmecuqpe", "source.strings[217]": "wohryr", "source.strings[218]": "wqussoje", "source.strings[219]": "wwavxo", "source.strings[220]": "wwifbuby", "source.strings[221]": "wwirym", "source.strings[222]": "wxemtu", "source.strings[223]": "wyrvotqo", "source.strings[224]": "xcawzo", "source.strings[225]": "xdetuma", "source.strings[226]": "xlizis", "source.strings[227]": "xpubujti", "source.strings[228]": "xxuruki", "source.strings[229]": "xzagjon", "source.strings[230]": "ybsyzo", "source.strings[231]": "yfnekjub", "source.strings[232]": "yfsuke", "source.strings[233]": "yfyckepr", "source.strings[234]": "yggixd", "source.strings[235]": "ygjuhz", "source.strings[236]": "yhopmi", "source.strings[237]": "ykoqerv", "source.strings[238]": "yljictevk", "source.strings[239]": "ymgyceb", "source.strings[240]": "ypfasky", "source.strings[241]": "ypkoflip", "source.strings[242]": "yqzydduq", "source.strings[243]": "yrvodxy", "source.strings[244]": "yshyjo", "source.strings[245]": "ytimsa", "source.strings[246]": "yvasne", "source.strings[247]": "yvlazmybz", "source.strings[248]": "yxvets", "source.strings[249]": "yzvafxa", "source.strings[250]": "zapegky", "source.strings[251]": "zaqfitg", "source.strings[252]": "zehjujc", "source.strings[253]": "zofbofi", "source.strings[254]": "zperni", "source.strings[255]": "zxednu" }, "x": 70, "id": 0, "is": [ "hzaqygu5", "ivagujco5", "ecifu7", "kvigriton0", "hqarow3", "apxadulne6", "sojubh1", "ujkelif0", "ujkelif0", "gepuvdyh0", "itnijovke6", "ujkelif0", "ujkelif0", "ujkelif0", "ujkelif0", "ujkelif0" ], "ms": { "file": { "size": 24096.0 }, "text": { "tab_count": 17.0, "digit_ratio": 0.03, "space_count": 2358.0, "total_lines": 20.0, "char_entropy": 4.66, "unique_chars": 75.0, "import_density": 80.0, "lines_over_200": 19.0, "lines_over_500": 14.0, "string_density": 148.7, "avg_line_length": 1203.85, "lines_over_1000": 9.0, "max_line_length": 5516.0, "last_line_length": 3.0, "most_common_char": "\"", "whitespace_ratio": 0.1, "most_common_ratio": 0.18, "identifier_density": 1.85, "line_length_stddev": 1188.31, "normalized_import_count": 3.58, "normalized_string_count": 665.01, "suspicious_comment_ratio": 0.67, "max_inline_whitespace_run": 1.0, "normalized_unique_identifiers": 2.31 }, "imports": { "total": 16.0, "unique_modules": 10.0, "third_party_count": 16.0, "third_party_ratio": 1.0 }, "strings": { "total": 2974.0, "avg_length": 5.93, "max_length": 9.0, "path_count": 6.0, "avg_entropy": 2.32, "total_bytes": 17634.0, "entropy_stddev": 0.51 }, "comments": { "chars": 7607.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.18, "code_in_comments": 1.0, "high_entropy_comments": 2.0 }, "functions": {}, "identifiers": { "total": 37.0, "avg_length": 8.4, "max_length": 10.0, "min_length": 6.0, "avg_entropy": 2.99, "reuse_ratio": 0.27, "unique_count": 10.0, "length_stddev": 1.36, "has_digit_ratio": 1.0, "numeric_suffix_count": 10.0 } }, "ss": [ [ 7630, "rizny" ], [ 7631, "rizny" ], [ 7639, "pemnibbu" ], [ 7640, "pemnibbu" ], [ 7652, "xypa" ], [ 7653, "xypa" ], [ 7660, "WS" ], [ 7661, "WS" ], [ 7666, "puher" ], [ 7667, "puher" ], [ 7676, "xzagjon" ], [ 7677, "xzagjon" ], [ 7687, "gawy" ], [ 7688, "gawy" ], [ 7695, "axuls" ], [ 7696, "axuls" ], [ 7704, "ifegy" ], [ 7705, "ifegy" ], [ 7713, "qafgyj" ], [ 7714, "qafgyj" ], [ 7723, "ijizasn" ], [ 7724, "ijizasn" ], [ 7734, "ujzalubs" ], [ 7735, "ujzalubs" ], [ 7755, "uwixc" ], [ 7756, "uwixc" ], [ 7764, "anedx" ], [ 7765, "anedx" ], [ 7773, "azeqxok" ], [ 7774, "azeqxok" ], [ 7784, "uprap" ], [ 7785, "uprap" ], [ 7793, "onem" ], [ 7794, "onem" ], [ 7802, "ytops" ], [ 7803, "ytops" ], [ 7811, "cr" ], [ 7812, "cr" ], [ 7818, "imos" ], [ 7819, "imos" ], [ 7826, "cgapufm" ], [ 7827, "cgapufm" ], [ 7837, "gylly" ], [ 7838, "gylly" ], [ 7846, "jivzynte" ], [ 7847, "jivzynte" ], [ 7858, "eqbonqe" ], [ 7859, "eqbonqe" ], [ 7878, "usyst" ], [ 7879, "usyst" ], [ 7887, "fajbe" ], [ 7888, "fajbe" ], [ 7896, "baxaj" ], [ 7897, "baxaj" ], [ 7905, "xxuruki" ], [ 7906, "xxuruki" ], [ 7916, "ybsyzo" ], [ 7917, "ybsyzo" ], [ 7926, "onmyvruqq" ], [ 7927, "onmyvruqq" ], [ 7939, "gysjuwt" ], [ 7940, "gysjuwt" ], [ 7951, "xlizis" ], [ 7952, "xlizis" ], [ 7961, "ewzev" ], [ 7962, "ewzev" ], [ 7970, "ip" ], [ 7971, "ip" ], [ 7977, "hhovma" ], [ 7978, "hhovma" ], [ 7987, "azuqk" ], [ 7988, "azuqk" ], [ 7996, "ullefxo" ], [ 7997, "ullefxo" ], [ 8016, "bjuxqaku" ], [ 8017, "bjuxqaku" ], [ 8029, "ucumc" ], [ 8030, "ucumc" ], [ 8038, "t" ], [ 8039, "t" ], [ 8044, "jmaniqni" ], [ 8045, "jmaniqni" ], [ 8056, "ldeshe" ], [ 8057, "ldeshe" ], [ 8066, "ekobi" ], [ 8067, "ekobi" ], [ 8075, "qzulo" ], [ 8076, "qzulo" ], [ 8084, "cynbyse" ], [ 8085, "cynbyse" ], [ 8095, "ijutvyrt" ], [ 8096, "ijutvyrt" ], [ 8107, "rceziwc" ], [ 8108, "rceziwc" ], [ 8118, "nujy" ], [ 8119, "nujy" ], [ 8157, "kadyb" ], [ 8158, "kadyb" ], [ 8166, "apedy" ], [ 8167, "apedy" ], [ 8175, "erxebx" ], [ 8176, "erxebx" ], [ 8185, "sowtuzve" ], [ 8186, "sowtuzve" ], [ 8197, "wgygy" ], [ 8198, "wgygy" ], [ 8207, "Cr" ], [ 8208, "Cr" ], [ 8213, "casva" ], [ 8214, "casva" ], [ 8222, "sido" ], [ 8223, "sido" ], [ 8231, "yjfyd" ], [ 8232, "yjfyd" ], [ 8240, "mijebfu" ], [ 8241, "mijebfu" ], [ 8251, "ukxufu" ], [ 8252, "ukxufu" ], [ 8261, "qwugxeju" ], [ 8262, "qwugxeju" ], [ 8273, "ajcyli" ], [ 8274, "ajcyli" ], [ 8283, "ucfywlijd" ], [ 8284, "ucfywlijd" ], [ 8305, "foklu" ], [ 8306, "foklu" ], [ 8314, "wwifbuby" ], [ 8315, "wwifbuby" ], [ 8326, "ednygz" ], [ 8327, "ednygz" ], [ 8336, "siffi" ], [ 8337, "siffi" ], [ 8345, "tixihmy" ], [ 8346, "tixihmy" ], [ 8356, "cyxlu" ], [ 8357, "cyxlu" ], [ 8365, "bkyndadi" ], [ 8366, "bkyndadi" ], [ 8378, "ea" ], [ 8379, "ea" ], [ 8384, "efpexduj" ], [ 8385, "efpexduj" ], [ 8396, "zehjujc" ], [ 8397, "zehjujc" ], [ 8408, "cbumo" ], [ 8409, "cbumo" ], [ 8417, "odgubqern" ], [ 8418, "odgubqern" ], [ 8430, "ahmuqji" ], [ 8431, "ahmuqji" ], [ 8450, "sofku" ], [ 8451, "sofku" ], [ 8459, "ohuv" ], [ 8460, "ohuv" ], [ 8467, "roqvipe" ], [ 8468, "roqvipe" ], [ 8478, "egzedpo" ], [ 8479, "egzedpo" ], [ 8490, "wxemtu" ], [ 8491, "wxemtu" ], [ 8500, "te" ], [ 8501, "te" ], [ 8507, "ejyfvu" ], [ 8508, "ejyfvu" ], [ 8517, "fare" ], [ 8518, "fare" ], [ 8525, "sfifqoga" ], [ 8526, "sfifqoga" ], [ 8537, "iqetdur" ], [ 8538, "iqetdur" ], [ 8548, "uwatv" ], [ 8549, "uwatv" ], [ 8557, "madkad" ], [ 8558, "madkad" ], [ 8576, "isigp" ], [ 8577, "isigp" ], [ 8585, "hbapcifje" ], [ 8586, "hbapcifje" ], [ 8598, "uskoru" ], [ 8599, "uskoru" ], [ 8608, "gotjiqi" ], [ 8609, "gotjiqi" ], [ 8619, "ysycb" ], [ 8620, "ysycb" ], [ 8628, "yggixd" ], [ 8629, "yggixd" ], [ 8639, "mduzpemna" ], [ 8640, "mduzpemna" ], [ 8652, "ajlacjo" ], [ 8653, "ajlacjo" ], [ 8663, "Ob" ], [ 8664, "Ob" ], [ 8670, "ngeno" ], [ 8671, "ngeno" ], [ 8679, "anzevy" ], [ 8680, "anzevy" ], [ 8689, "vucze" ], [ 8690, "vucze" ], [ 8698, "wilragr" ], [ 8699, "wilragr" ], [ 8709, "uvucni" ], [ 8710, "uvucni" ], [ 8728, "aqenhut" ], [ 8729, "aqenhut" ], [ 8739, "yljictevk" ], [ 8740, "yljictevk" ], [ 8752, "ylypf" ], [ 8753, "ylypf" ], [ 8761, "vacwi" ], [ 8762, "vacwi" ], [ 8770, "zaqfitg" ], [ 8771, "zaqfitg" ], [ 8781, "olad" ], [ 8782, "olad" ], [ 8789, "ihgojiwh" ], [ 8790, "ihgojiwh" ], [ 8801, "hiqjipli" ], [ 8802, "hiqjipli" ], [ 8813, "vbeluri" ], [ 8814, "vbeluri" ], [ 8825, "mweby" ], [ 8826, "mweby" ], [ 8834, "sipcapn" ], [ 8835, "sipcapn" ], [ 8845, "je" ], [ 8846, "je" ], [ 8861, "jyrjugq" ], [ 8862, "jyrjugq" ], [ 8872, "dufeqn" ], [ 8873, "dufeqn" ], [ 8882, "ehrahuq" ], [ 8883, "ehrahuq" ], [ 8893, "ewynit" ], [ 8894, "ewynit" ], [ 8903, "saknuvh" ], [ 8904, "saknuvh" ], [ 8914, "duji" ], [ 8915, "duji" ], [ 8922, "uhov" ], [ 8923, "uhov" ], [ 8930, "qmumo" ], [ 8931, "qmumo" ], [ 8940, "ct" ], [ 8941, "ct" ], [ 8946, "ibytti" ], [ 8947, "ibytti" ], [ 8957, "ivruduk" ], [ 8958, "ivruduk" ], [ 8968, "nevxa" ], [ 8969, "nevxa" ], [ 8985, "hkuli" ], [ 8986, "hkuli" ], [ 8995, "Scr" ], [ 8996, "Scr" ], [ 9002, "uwxempock" ], [ 9003, "uwxempock" ] ], "sz": 24096, "ts": [ { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 5516.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170127_ac02f835cc57f3f58c788eb66d607275.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "a": "T1195.002, T1059.007", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/supply-chain/hidden-payload/runtime::fetched-text-function-param--rx-5", "l": 1 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170127_ac02f835cc57f3f58c788eb66d607275.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-1", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 20.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".Fi" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1552.001, T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "chat" ], "i": "objectives/supply-chain/recon-exfil/ai-cli::llm-cli-inventory-file-prompt--rx-24", "l": 1, "m": "E1552" }, { "a": "T1027.003", "c": 1.0, "d": "JavaScript or TypeScript source file extension", "e": [ "20170127_ac02f835cc57f3f58c788eb66d607275.js" ], "i": "objectives/anti-static/obfuscation/payload/container::js-source-extension", "l": 1, "m": "B0032" }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "c": 0.800000011920929, "d": "ADODB.Stream string fragment (ADODB/ADO)", "e": [ "ADO" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-1", "l": 3 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.10" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.9200000166893005, "d": "Executable code embedded in comment", "e": [ "comments.code_in_comments = 1.00" ], "i": "objectives/anti-static/obfuscation/string/array::js-comment-exec-body", "l": 3 }, { "c": 0.8399999737739563, "d": "JavaScript unusually long average lines", "e": [ "text.avg_line_length = 1203.85" ], "i": "objectives/anti-static/obfuscation/string/anomaly::javascript-line-bloat", "l": 4 }, { "c": 0.8999999761581421, "d": "Tiny ResponseBody fragments (spon, seB, ody);)", "e": [ "seB" ], "i": "objectives/execution/interpreter/script/wsh-fragments::response-body-fragment-tiny-exact", "l": 4 }, { "c": 0.8999999761581421, "d": "Exact tiny WScript fragments (She, ll)", "e": [ "ll" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-exact-2", "l": 4 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 9.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" } ], "sha": "2db838a4bea1e2ce8b496e966ac942fb220ed97f9c82a11421d75fc3d22b21df", "path": "/data/samples/bad/datasets/javascript-malware-collection/2017/20170127/20170127_ac02f835cc57f3f58c788eb66d607275.js", "type": "javascript" } ], "tv": "84923" } }