{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.19900932908058167, "class": 0 } ], "prob": 0.19900933, "class": 0, "models": [ { "m": "az", "prob": 0.060943644, "class": 0 }, { "m": "az/scripts", "prob": 0.19900933, "class": 0 }, { "m": "az/javascript", "prob": 0.070818074, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T06:34:22Z" }, "path": "0a05273bb73566630135a3afb59b48fd.js", "raw": { "v": "5", "fs": [ { "f": "Hâ‚‚(FU)", "x": 4, "ff": { "i": [ [ "", "document.querySelector" ], [ "", "document.createElement" ], [ "", "document.querySelector" ], [ "", "t.src" ], [ "", "t.setAttribute" ], [ "", "t.addEventListener" ], [ "", "t.parentNode.removeChild" ], [ "", "setTimeout" ], [ "", "i.parentNode.insertBefore" ], [ "", "n.match" ], [ "", "t.map.indexOf" ], [ "", "t.map" ], [ "", "n.toLowerCase" ], [ "", "e.toLowerCase" ], [ "", "n.push" ], [ "", "t.indexOf" ], [ "", "iub.invTcfC" ], [ "", "Date.now" ], [ "", "iub.csConfigLegacy" ], [ "", "iub.GVL2" ], [ "", "iub.GVL3" ], [ "", "iub.vendorsCountGVL3" ], [ "", "iub.cc" ], [ "", "Object.keys" ], [ "", "t.language.toLowerCase" ], [ "", "e.forEach" ], [ "", "s.push" ], [ "", "s.push.apply" ], [ "", "n.lang" ], [ "", "n.lang" ], [ "", "n.loadCore" ], [ "", "Object.defineProperty" ] ], "m": { "ast": { "max_depth": 26.0, "bind_count": 28.0, "call_count": 30.0, "node_count": 1047.0, "target_count": 25.0, "member_depth_max": 3.0, "string_bind_count": 2.0, "string_literal_count": 43.0, "array_literal_max_length": 27.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 1645.0, "entropy": 5.28, "size_bytes": 1645.0 }, "text": { "digit_ratio": 0.04, "space_count": 22.0, "total_lines": 1.0, "char_entropy": 5.28, "unique_chars": 78.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 43.0, "avg_line_length": 1644.0, "lines_over_1000": 1.0, "max_line_length": 1644.0, "last_line_length": 1644.0, "long_token_count": 7.0, "whitespace_ratio": 0.01, "most_common_ratio": 0.07, "identifier_density": 185.0, "normalized_string_count": 43.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 110.0, "suspicious_identifier_ratio": 0.2 }, "source": { "function_count": 4.0 }, "strings": { "total": 43.0, "url_count": 1.0, "avg_length": 4.7, "max_length": 63.0, "avg_entropy": 1.46, "total_bytes": 202.0, "entropy_stddev": 0.86 }, "functions": { "count": 4.0, "anonymous": 5.0, "avg_params": 0.89, "max_params": 3.0, "one_liners": 9.0, "avg_name_length": 1.0, "no_params_count": 3.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "nested_functions": 4.0, "avg_nesting_depth": 1.22, "max_nesting_depth": 2.0, "single_char_names": 4.0, "single_char_params": 8.0, "avg_param_name_length": 1.0, "density_per_100_lines": 900.0, "code_in_functions_ratio": 9.0 }, "identifiers": { "total": 185.0, "avg_length": 6.94, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.11, "reuse_ratio": 0.26, "unique_count": 49.0, "length_stddev": 4.94, "has_digit_ratio": 0.08, "sequential_names": 9.0, "base64_like_names": 1.0, "single_char_count": 9.0, "single_char_ratio": 0.18, "high_entropy_count": 4.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.51, "numeric_suffix_count": 3.0, "underscore_prefix_count": 1.0 } }, "s": [ [ 13, "u8", "use strict" ], [ 14, "u8", "use strict" ], [ 43, "u8", "bg" ], [ 44, "u8", "bg" ], [ 48, "u8", "ca" ], [ 49, "u8", "ca" ], [ 53, "u8", "cs" ], [ 54, "u8", "cs" ], [ 58, "u8", "da" ], [ 59, "u8", "da" ], [ 63, "u8", "de" ], [ 64, "u8", "de" ], [ 68, "u8", "el" ], [ 69, "u8", "el" ], [ 73, "u8", "en" ], [ 74, "u8", "en" ], [ 78, "u8", "en-GB" ], [ 79, "u8", "en-GB" ], [ 86, "u8", "es" ], [ 87, "u8", "es" ], [ 91, "u8", "fr" ], [ 92, "u8", "fr" ], [ 96, "u8", "it" ], [ 97, "u8", "it" ], [ 101, "u8", "nl" ], [ 102, "u8", "nl" ], [ 106, "u8", "no" ], [ 107, "u8", "no" ], [ 111, "u8", "pl" ], [ 112, "u8", "pl" ], [ 116, "u8", "pt" ], [ 117, "u8", "pt" ], [ 121, "u8", "pt-BR" ], [ 122, "u8", "pt-BR" ], [ 129, "u8", "ro" ], [ 130, "u8", "ro" ], [ 134, "u8", "ru" ], [ 135, "u8", "ru" ], [ 139, "u8", "sv" ], [ 140, "u8", "sv" ], [ 144, "u8", "et" ], [ 145, "u8", "et" ], [ 149, "u8", "fi" ], [ 150, "u8", "fi" ], [ 154, "u8", "hr" ], [ 155, "u8", "hr" ], [ 159, "u8", "hu" ], [ 160, "u8", "hu" ], [ 164, "u8", "lt" ], [ 165, "u8", "lt" ], [ 169, "u8", "lv" ], [ 170, "u8", "lv" ], [ 174, "u8", "sk" ], [ 175, "u8", "sk" ], [ 179, "u8", "sl" ], [ 180, "u8", "sl" ], [ 206, "u8", "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.76.2/core-" ], [ 207, "u8", "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.76.2/core-" ], [ 298, "u8", ".js" ], [ 299, "u8", ".js" ], [ 333, "u8", "script[src=\"" ], [ 334, "u8", "script[src=" ], [ 350, "u8", "\"]" ], [ 351, "u8", "]" ], [ 388, "u8", "script" ], [ 389, "u8", "script" ], [ 429, "u8", "script" ], [ 430, "u8", "script" ], [ 462, "u8", "charset" ], [ 463, "u8", "charset" ], [ 472, "u8", "UTF-8" ], [ 473, "u8", "UTF-8" ], [ 500, "u8", "error" ], [ 501, "u8", "error" ], [ 846, "u8", "object" ], [ 847, "u8", "object" ], [ 1169, "u8", "EU" ], [ 1170, "u8", "EU" ], [ 1331, "u8", "en" ], [ 1332, "u8", "en" ], [ 1392, "u8", "-" ], [ 1393, "u8", "-" ], [ 1564, "u8", "en" ], [ 1565, "u8", "en" ], [ 1614, "u8", "__esModule" ], [ 1615, "u8", "__esModule" ] ], "v": { "source.language": "javascript", "source.imports[0]": "Date.now", "source.imports[1]": "Object.defineProperty", "source.imports[2]": "Object.keys", "source.imports[3]": "document.createElement", "source.imports[4]": "document.querySelector", "source.imports[5]": "e.forEach", "source.imports[6]": "e.toLowerCase", "source.imports[7]": "i.parentNode.insertBefore", "source.imports[8]": "iub.GVL2", "source.imports[9]": "iub.GVL3", "source.strings[0]": "__esModule", "source.strings[1]": "charset", "source.strings[2]": "https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.76.2/core-", "source.strings[3]": "object", "source.strings[4]": "script", "source.strings[5]": "script[src=", "source.strings[6]": "script[src=\"", "source.strings[7]": "use strict", "source.has_imports": true, "source.imports[10]": "iub.cc", "source.imports[11]": "iub.csConfigLegacy", "source.imports[12]": "iub.invTcfC", "source.imports[13]": "iub.vendorsCountGVL3", "source.imports[14]": "n.lang", "source.imports[15]": "n.loadCore", "source.imports[16]": "n.match", "source.imports[17]": "n.push", "source.imports[18]": "n.toLowerCase", "source.imports[19]": "s.push", "source.imports[20]": "s.push.apply", "source.imports[21]": "setTimeout", "source.imports[22]": "t.addEventListener", "source.imports[23]": "t.indexOf", "source.imports[24]": "t.language.toLowerCase", "source.imports[25]": "t.map", "source.imports[26]": "t.map.indexOf", "source.imports[27]": "t.parentNode.removeChild", "source.imports[28]": "t.setAttribute", "source.imports[29]": "t.src", "source.functions[0]": "anonymous", "source.functions[1]": "i", "source.functions[2]": "o", "source.functions[3]": "r", "source.functions[4]": "u" }, "ca": [ [ "Object.defineProperty", "__esModule" ], [ "document.createElement", "script" ], [ "document.querySelector", "\"]" ], [ "document.querySelector", "script" ], [ "document.querySelector", "script[src=\"" ], [ "i", "en" ], [ "t.addEventListener", "error" ], [ "t.setAttribute", "UTF-8" ], [ "t.setAttribute", "charset" ], [ "u", "-" ] ], "ct": [ "Date.now", "Object.defineProperty", "Object.keys", "document.createElement", "document.querySelector", "e.forEach", "e.toLowerCase", "i", "i.parentNode.insertBefore", "n.match", "n.push", "n.toLowerCase", "o", "r", "s.push", "s.push.apply", "setTimeout", "t.addEventListener", "t.indexOf", "t.language.toLowerCase", "t.map", "t.map().indexOf", "t.parentNode.removeChild", "t.setAttribute", "u" ], "id": "javascript", "mc": [ "Date.now", "Object.defineProperty", "Object.keys", "_iub.GVL2", "_iub.GVL3", "_iub.cc", "_iub.csConfigLegacy", "_iub.csConfiguration", "_iub.csConfiguration.i18n", "_iub.csConfiguration.lang", "_iub.csLangConfiguration", "_iub.invTcfC", "_iub.vendorsCountGVL3", "document.createElement", "document.documentElement", "document.documentElement.lang", "document.querySelector", "e.forEach", "e.toLowerCase", "i().language", "i.parentNode", "i.parentNode.insertBefore", "n.lang", "n.loadCore", "n.match", "n.push", "n.toLowerCase", "navigator.language", "s.length", "s.push", "s.push.apply", "t.addEventListener", "t.indexOf", "t.language", "t.language.toLowerCase", "t.map", "t.map().indexOf", "t.parentNode", "t.parentNode.removeChild", "t.region", "t.setAttribute", "t.src" ] }, "id": 0, "sz": 1645, "ts": [ { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ ";for(" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for(let e=0;e\u003cs.length;++e){const t=s[e];if(r(t))return void(n.lang=t)}" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny JavaScript file lines", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::tiny-javascript-file-lines", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "c": 0.949999988079071, "d": "JavaScript or TypeScript basename", "e": [ "0a05273bb73566630135a3afb59b48fd.js" ], "i": "metadata/lang/source::js-ts-source-basename", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1644.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "error" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3", "l": 1 }, { "c": 0.6000000238418579, "d": "use strict directive string", "e": [ "use strict" ], "i": "metadata/package/tooling::use-strict-quote", "l": 1 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "c": 0.8199999928474426, "d": "JavaScript static key string assignment", "e": [ "=\"https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.76.2/core-\"" ], "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "c": 0.6000000238418579, "d": "__esModule property", "e": [ "__esModule" ], "i": "metadata/package/tooling::esmodule-export", "l": 1 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Date.now" ], "i": "objectives/anti-analysis/timing/jitter::js-date-diff-jitter-pattern--rx-2", "l": 1 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 9.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1056", "c": 0.8999999761581421, "d": "document.getElement*/querySelector* DOM lookup", "e": [ "document.querySelector" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5", "l": 1 }, { "c": 0.8399999737739563, "d": "Creates script DOM element", "e": [ "createElement(\"script\")" ], "i": "micro-behaviors/ui/window/manage/dom::browser-create-script-element", "l": 3 }, { "c": 0.8399999737739563, "d": "Hidden directory path literal", "e": [ ".js" ], "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "l": 1 }, { "c": 0.8199999928474426, "d": "JavaScript substring search call", "e": [ "indexOf(" ], "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "l": 2 }, { "c": 0.6000000238418579, "d": "Object.defineProperty call marker", "e": [ "Object.defineProperty" ], "i": "metadata/lang/javascript-features::object-define-property", "l": 2 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "0a05273bb73566630135a3afb59b48fd.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Nemucod network fragment op/en/se/nd", "e": [ "lang=\"en\"" ], "i": "well-known/malware/dropper/nemucod::nemucod-network-fragment-opense", "l": 1 }, { "c": 0.75, "d": "Reads browser UI language", "e": [ "navigator.language" ], "i": "micro-behaviors/fs/path/sensitive/browser::navigator-language", "l": 3 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1644.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.699999988079071, "d": "DOM write API insertBefore", "e": [ ".insertBefore(" ], "i": "objectives/impact/ui/delivery::dynamic-ad-injection-dom-api-b", "l": 1 }, { "a": "T1195.002", "c": 0.7799999713897705, "d": "Decoder table indexOf operations (AST)", "e": [ "indexOf" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoder-indexof-ast", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Derived string condition", "e": [ "createElement(\"script\")" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::inject-script-element__any_1", "l": 2 }, { "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 900.00" ], "i": "metadata/file/text/metrics::high-function-density", "l": 2 }, { "c": 0.800000011920929, "d": "Many comma sequence expressions (obfuscation)", "e": [ "++e,e\u003c5\u0026\u0026(t.parentNode.removeChild(t),setTimeout(o,10))", "_iub.cc='EU',function(){const n=_iub.csConfiguration;if(!n.lang){const e=Object.keys(_iub.csLangConf...", "_iub.csConfigLegacy=!1,_iub.GVL2=_iub.GVL2||224,_iub.GVL3=_iub.GVL3||97,_iub.vendorsCountGVL3=_iub.v...", "t.src=n,t.setAttribute(\"charset\",\"UTF-8\"),t.addEventListener(\"error\",(function(){++e,e\u003c5\u0026\u0026(t.parentN...", "o||u(s,c,e),e.forEach((function(n){i(n).language===c\u0026\u0026s.push(n)})),s.push.apply(s,e);" ], "i": "objectives/anti-static/obfuscation/syntax::js-comma-sequence-obfuscation-v2", "l": 2 }, { "c": 0.699999988079071, "d": "JavaScript file under 5KB", "e": [ "0a05273bb73566630135a3afb59b48fd.js" ], "i": "metadata/file/text/metrics::javascript-small-file-5k", "l": 1 }, { "c": 0.8500000238418579, "d": "JavaScript transpiler or minifier markers", "e": [ "use strict", "__esModule" ], "i": "metadata/package/quality::terser-output", "l": 2 } ], "sha": "2e0d76b5139977a11a0ce74d8f5ce2d7d9b1d12cdcc1dc9ee0d8611d849a2bc2", "path": "0a05273bb73566630135a3afb59b48fd.js", "type": "javascript" } ], "tv": "9ea7c" } }