{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.8254117965698242 } ], "prob": 0.8254118, "models": [ { "m": "az", "prob": 0.8254118, "class": 0 }, { "m": "az/scripts", "prob": 0.5673232, "class": 2 }, { "m": "az/javascript", "prob": 0.479798, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-01T19:00:08Z" }, "path": "VirusShare_20ea45b61d5cba4b7ff5339ce5d1972f", "raw": { "v": "6", "fs": [ { "f": "H₂(Cm₃F)", "x": 5, "ff": { "i": [ [ "", "server" ], [ "", "job" ], [ "", "workers" ], [ "", "ws" ], [ "", "receiveStack" ], [ "", "sendStack" ], [ "", "totalhashes" ], [ "", "connected" ], [ "", "reconnector" ], [ "", "attempts" ], [ "", "throttleMiner" ], [ "", "handshake" ], [ "", "wasmSupported" ], [ "", "Uint8Array.of" ], [ "", "logicalProcessors" ], [ "", "logicalProcessors" ], [ "", "logicalProcessors" ], [ "", "logicalProcessors" ], [ "", "addWorker" ], [ "", "openWebSocket" ], [ "", "ws.close" ], [ "", "server.split" ], [ "", "ws" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "ws.onmessage" ], [ "", "ws.onerror" ], [ "", "connected" ], [ "", "job" ], [ "", "ws.onclose" ], [ "", "connected" ], [ "", "job" ], [ "", "ws.onopen" ], [ "", "ws.send" ], [ "", "JSON.stringify" ], [ "", "connected" ], [ "", "attempts" ], [ "", "reconnector" ], [ "", "openWebSocket" ], [ "", "setTimeout" ], [ "", "stopBroadcast" ], [ "", "Math.random" ], [ "", "l.push" ], [ "", "g.onmessage" ], [ "", "l.indexOf" ], [ "", "l.push" ], [ "", "startBroadcast.bc" ], [ "", "startBroadcast.id" ], [ "", "setInterval" ], [ "", "g.postMessage" ], [ "", "l.sort" ], [ "", "l.push" ], [ "", "startBroadcast.bc.close" ], [ "", "clearInterval" ], [ "", "stopMining" ], [ "", "connected" ], [ "", "handshake" ], [ "", "startBroadcast" ], [ "", "addWorkers" ], [ "", "reconnector" ], [ "", "stopMining" ], [ "", "connected" ], [ "", "handshake" ], [ "", "startBroadcast" ], [ "", "addWorkers" ], [ "", "reconnector" ], [ "", "connected" ], [ "", "ws.close" ], [ "", "deleteAllWorkers" ], [ "", "job" ], [ "", "stopBroadcast" ], [ "", "URL.createObjectURL" ], [ "", "a.locateFile" ], [ "", "U.set" ], [ "", "S.f" ], [ "", "ja" ], [ "", "d.apply" ], [ "", "ka" ], [ "", "V.decode" ], [ "", "b.subarray" ], [ "", "String.fromCharCode" ], [ "", "String.fromCharCode" ], [ "", "String.fromCharCode" ], [ "", "String.fromCharCode" ], [ "", "b.charCodeAt" ], [ "", "b.charCodeAt" ], [ "", "a.d" ], [ "", "b.shift" ], [ "", "a.dynCall_v" ], [ "", "a.dynCall_vi" ], [ "", "b.startsWith" ], [ "", "b.indexOf" ], [ "", "a.readBinary" ], [ "", "fetch.then.catch" ], [ "", "fetch.then" ], [ "", "fetch" ], [ "", "b.arrayBuffer" ], [ "", "a.asm" ], [ "", "a.monitorRunDependencies" ], [ "", "clearInterval" ], [ "", "la.then.then" ], [ "", "la.then" ], [ "", "la" ], [ "", "WebAssembly.instantiate" ], [ "", "a.monitorRunDependencies" ], [ "", "a.instantiateWasm" ], [ "", "WebAssembly.instantiateStreaming.then" ], [ "", "WebAssembly.instantiateStreaming" ], [ "", "fetch" ], [ "", "String.fromCharCode" ], [ "", "a.push" ], [ "", "String.fromCharCode" ], [ "", "a.join" ], [ "", "b.slice" ], [ "", "Buffer.from" ], [ "", "pa" ], [ "", "f.a" ], [ "", "c.charCodeAt" ], [ "", "Error" ], [ "", "a.calledRun" ], [ "", "aa" ], [ "", "a.onRuntimeInitialized" ], [ "", "a.postRun" ], [ "", "ba.unshift" ], [ "", "a.postRun.shift" ], [ "", "a.preRun" ], [ "", "ca.unshift" ], [ "", "a.preRun.shift" ], [ "", "a.setStatus" ], [ "", "setTimeout" ], [ "", "setTimeout" ], [ "", "a.setStatus" ], [ "", "a.onAbort" ], [ "", "da" ], [ "", "JSON.stringify" ], [ "", "parseInt" ], [ "", "b.match.reverse.join" ], [ "", "b.match.reverse" ], [ "", "b.match" ], [ "", "a.hasOwnProperty" ], [ "", "F.p" ], [ "", "a.arguments" ], [ "", "a.thisProgram" ], [ "", "a.quit" ], [ "", "a.preRun" ], [ "", "a.postRun" ], [ "", "fa" ], [ "", "fa" ], [ "", "a.read" ], [ "", "require" ], [ "", "require" ], [ "", "Q.normalize" ], [ "", "P.readFileSync" ], [ "", "e.toString" ], [ "", "a.readBinary" ], [ "", "a.read" ], [ "", "a.thisProgram" ], [ "", "a.arguments" ], [ "", "process.argv.slice" ], [ "", "module.exports" ], [ "", "process.on" ], [ "", "process.on" ], [ "", "a.quit" ], [ "", "process.exit" ], [ "", "a.inspect" ], [ "", "a.read" ], [ "", "read" ], [ "", "a.readBinary" ], [ "", "readbuffer" ], [ "", "read" ], [ "", "a.arguments" ], [ "", "a.arguments" ], [ "", "a.quit" ], [ "", "quit" ], [ "", "q.indexOf" ], [ "", "q.substr" ], [ "", "q.lastIndexOf" ], [ "", "a.read" ], [ "", "a.open" ], [ "", "a.send" ], [ "", "a.readBinary" ], [ "", "b.open" ], [ "", "b.responseType" ], [ "", "b.send" ], [ "", "a.readAsync" ], [ "", "b.open" ], [ "", "b.responseType" ], [ "", "b.onload" ], [ "", "b.onerror" ], [ "", "b.send" ], [ "", "a.setWindowTitle" ], [ "", "document.title" ], [ "", "da" ], [ "", "console.log.bind" ], [ "", "console.warn.bind" ], [ "", "F.hasOwnProperty" ], [ "", "a.p" ], [ "", "ha" ], [ "", "na" ], [ "", "ha" ], [ "", "a.buffer" ], [ "", "a.HEAP8" ], [ "", "a.HEAP16" ], [ "", "a.HEAP32" ], [ "", "a.HEAPU8" ], [ "", "a.HEAPU16" ], [ "", "a.HEAPU32" ], [ "", "a.HEAPF32" ], [ "", "a.HEAPF64" ], [ "", "ca" ], [ "", "qa" ], [ "", "ra" ], [ "", "ba" ], [ "", "aa" ], [ "", "a.preloadedImages" ], [ "", "a.preloadedAudios" ], [ "", "a.asm" ], [ "", "c.memory" ], [ "", "c.table" ], [ "", "c.__memory_base" ], [ "", "c.__table_base" ], [ "", "ma" ], [ "", "sa" ], [ "", "oa" ], [ "", "pa" ], [ "", "a.replace" ], [ "", "\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\".indexOf" ], [ "", "a.charAt" ], [ "", "\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\".indexOf" ], [ "", "a.charAt" ], [ "", "\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\".indexOf" ], [ "", "a.charAt" ], [ "", "\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\".indexOf" ], [ "", "a.charAt" ], [ "", "String.fromCharCode" ], [ "", "String.fromCharCode" ], [ "", "String.fromCharCode" ], [ "", "a.asm" ], [ "", "a.___errno_location" ], [ "", "A.set" ], [ "", "A.subarray" ], [ "", "Date.now" ], [ "", "a.getUTCSeconds" ], [ "", "a.getUTCMinutes" ], [ "", "a.getUTCHours" ], [ "", "a.getUTCDate" ], [ "", "a.getUTCMonth" ], [ "", "a.getUTCFullYear" ], [ "", "a.getUTCDay" ], [ "", "Date.UTC" ], [ "", "a.getUTCFullYear" ], [ "", "a.getTime" ], [ "", "a.asm" ], [ "", "a._hash_cn" ], [ "", "a.asm.k.apply" ], [ "", "a.stackAlloc" ], [ "", "a.asm.l.apply" ], [ "", "ka" ], [ "", "a.stackRestore" ], [ "", "a.asm.m.apply" ], [ "", "ja" ], [ "", "a.stackSave" ], [ "", "a.asm.n.apply" ], [ "", "a.asm" ], [ "", "a.ccall" ], [ "", "a.cwrap" ], [ "", "I.prototype" ], [ "", "Error" ], [ "", "I.prototype.constructor" ], [ "", "a.run" ], [ "", "a.abort" ], [ "", "a.preInit" ], [ "", "a.preInit.pop" ], [ "", "a.preInit.pop" ], [ "", "a.noExitRuntime" ], [ "", "a.cwrap" ], [ "", "onmessage" ], [ "", "ea" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "d.toString" ], [ "", "Array.join" ], [ "", "Array" ], [ "", "c.blob.substring" ], [ "", "c.blob.substring" ], [ "", "ea" ], [ "", "f.substring" ], [ "", "console.log" ], [ "", "postMessage" ], [ "", "JSON.stringify" ], [ "", "postMessage" ], [ "", "performance.now" ], [ "", "performance.now" ], [ "", "setTimeout" ], [ "", "Math.round" ], [ "", "workers.push" ], [ "", "c.onmessage" ], [ "", "setTimeout" ], [ "", "informWorker" ], [ "", "workers.shift.terminate" ], [ "", "workers.shift" ], [ "", "workers.i.terminate" ], [ "", "workers" ], [ "", "on_workermsg" ], [ "", "JSON.parse" ], [ "", "receiveStack.push" ], [ "", "job" ], [ "", "setTimeout" ], [ "", "informWorker" ], [ "", "JSON.parse" ], [ "", "ws.send" ], [ "", "sendStack.push" ], [ "", "setTimeout" ], [ "", "informWorker" ], [ "", "g.postMessage" ], [ "", "Math.max" ], [ "", "Math.min" ], [ "", "fs" ], [ "", "path" ] ], "m": { "ast": { "op.eq": 45.0, "op.ge": 4.0, "op.gt": 6.0, "op.le": 6.0, "op.lt": 19.0, "op.ne": 40.0, "op.add": 52.0, "op.bor": 20.0, "op.div": 6.0, "op.lor": 26.0, "op.mod": 3.0, "op.mul": 5.0, "op.shl": 11.0, "op.shr": 14.0, "op.sub": 13.0, "op.band": 18.0, "op.land": 70.0, "op.lnot": 38.0, "max_depth": 46.0, "bind_count": 272.0, "call_count": 298.0, "node_count": 9108.0, "member_count": 212.0, "sequence_count": 40.0, "identifier_count": 315.0, "member_depth_max": 4.0, "string_literal_count": 141.0, "array_literal_max_length": 4.0, "string_concat_chain_max_length": 7.0 }, "file": { "size": 184524.0, "entropy": 5.24, "size_bytes": 184524.0 }, "text": { "digit_ratio": 0.05, "space_count": 324.0, "total_lines": 31.0, "char_entropy": 5.24, "unique_chars": 91.0, "lines_over_200": 30.0, "lines_over_500": 22.0, "string_density": 4.55, "avg_line_length": 5951.39, "lines_over_1000": 1.0, "max_line_length": 170441.0, "last_line_length": 468.0, "long_token_count": 33.0, "whitespace_ratio": 0.0, "most_common_ratio": 0.17, "identifier_density": 55.71, "line_length_stddev": 30031.67, "normalized_string_count": 25.32, "repeated_char_sequences": 33.0, "suspicious_string_ratio": 0.01, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 65.0, "suspicious_identifier_ratio": 0.18, "normalized_unique_identifiers": 63.58 }, "binds": { "count": 272.0 }, "calls": { "count": 298.0 }, "binary": { "overall_entropy": 5.24 }, "source": { "function_count": 32.0 }, "imports": { "count": 2.0, "stdlib_count": 2.0, "stdlib_ratio": 1.0, "unique_modules": 2.0 }, "members": { "count": 212.0 }, "strings": { "total": 141.0, "url_count": 1.0, "avg_length": 1217.32, "max_length": 170017.0, "path_count": 1.0, "avg_entropy": 2.69, "empty_count": 15.0, "total_bytes": 171642.0, "entropy_stddev": 1.18, "very_long_strings": 1.0, "high_entropy_count": 4.0, "embedded_code_candidates": 1.0 }, "functions": { "count": 32.0, "anonymous": 59.0, "avg_params": 0.96, "max_params": 5.0, "one_liners": 74.0, "length_stddev": 3.18, "avg_name_length": 4.97, "no_params_count": 35.0, "avg_length_lines": 1.68, "max_length_lines": 23.0, "min_length_lines": 1.0, "nested_functions": 16.0, "avg_nesting_depth": 1.8, "max_nesting_depth": 4.0, "single_char_names": 20.0, "single_char_params": 90.0, "avg_param_name_length": 1.0, "density_per_100_lines": 303.23, "code_in_functions_ratio": 5.1 }, "identifiers": { "count": 315.0, "total": 1727.0, "avg_length": 6.55, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.04, "reuse_ratio": 0.18, "unique_count": 315.0, "length_stddev": 4.34, "has_digit_ratio": 0.05, "sequential_names": 50.0, "base64_like_names": 8.0, "single_char_count": 50.0, "single_char_ratio": 0.16, "high_entropy_count": 6.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.55, "all_uppercase_ratio": 0.1, "numeric_suffix_count": 8.0, "underscore_prefix_count": 5.0 } }, "s": [ [ 11, "u8", "wss://dta.shush.se:8892/" ], [ 12, "u8", "wss://dta.shush.se:8892/" ], [ 102, "10", "0" ], [ 114, "10", "0" ], [ 128, "10", "0" ], [ 139, "10", "1" ], [ 155, "10", "0" ], [ 204, "u8", "object" ], [ 205, "u8", "object" ], [ 235, "u8", "function" ], [ 236, "u8", "function" ], [ 323, "10", "0" ], [ 325, "10", "97" ], [ 328, "10", "115" ], [ 332, "10", "109" ], [ 336, "10", "1" ], [ 338, "10", "0" ], [ 340, "10", "0" ], [ 342, "10", "0" ], [ 465, "10", "1" ], [ 518, "10", "1" ], [ 610, "10", "4" ], [ 612, "10", "0" ], [ 633, "10", "40" ], [ 674, "10", "4" ], [ 682, "10", "0" ], [ 787, "u8", ";" ], [ 788, "u8", ";" ], [ 897, "10", "2" ], [ 921, "10", "2" ], [ 956, "10", "2" ], [ 980, "10", "2" ], [ 1068, "10", "1" ], [ 1096, "10", "3" ], [ 1122, "10", "0" ], [ 1141, "10", "1" ], [ 1190, "10", "3" ], [ 1274, "u8", "function" ], [ 1275, "u8", "function" ], [ 1363, "u8", "channel" ], [ 1364, "u8", "channel" ], [ 1397, "10", "0" ], [ 1402, "10", "0" ], [ 1439, "10", "1" ], [ 1560, "10", "0" ], [ 1566, "10", "2" ], [ 1581, "10", "0" ], [ 1600, "10", "1" ], [ 1604, "10", "0" ], [ 1656, "u8", "undefined" ], [ 1657, "u8", "undefined" ], [ 1722, "u8", "undefined" ], [ 1723, "u8", "undefined" ], [ 1836, "10", "0" ], [ 1843, "10", "1" ], [ 1854, "10", "0" ], [ 1904, "10", "0" ], [ 1928, "u8", "handshake" ], [ 1929, "u8", "handshake" ], [ 1967, "10", "7" ], [ 2067, "10", "0" ], [ 2085, "10", "0" ], [ 2092, "10", "1" ], [ 2103, "10", "0" ], [ 2153, "10", "0" ], [ 2177, "u8", "handshake" ], [ 2178, "u8", "handshake" ], [ 2232, "10", "7" ], [ 2324, "10", "3" ], [ 2460, "u8", "(" ], [ 2461, "u8", "(" ], [ 2552, "u8", "Assertion failed: " ], [ 2553, "u8", "Assertion failed: " ], [ 2598, "u8", "_" ], [ 2599, "u8", "_" ], [ 2616, "u8", "Cannot call unknown function " ], [ 2617, "u8", "Cannot call unknown function " ], [ 2650, "u8", ", make sure it is exported" ], [ 2651, "u8", ", make sure it is exported" ], [ 2732, "10", "0" ], [ 2746, "10", "0" ], [ 2759, "10", "1" ], [ 2772, "10", "2" ], [ 2881, "10", "0" ], [ 2899, "10", "0" ], [ 2939, "10", "0" ], [ 3006, "u8", "string" ], [ 3007, "u8", "string" ], [ 3032, "10", "0" ], [ 3038, "u8", "boolean" ], [ 3039, "u8", "boolean" ], [ 3058, "10", "0" ], [ 3131, "10", "16" ], [ 3217, "10", "128" ], [ 3230, "10", "63" ], [ 3243, "10", "192" ], [ 3249, "10", "224" ], [ 3263, "10", "63" ], [ 3273, "10", "65536" ], [ 3282, "10", "224" ], [ 3288, "10", "240" ], [ 3296, "10", "15" ], [ 3303, "10", "12" ], [ 3309, "10", "6" ], [ 3314, "10", "7" ], [ 3320, "10", "18" ], [ 3326, "10", "12" ], [ 3332, "10", "6" ], [ 3334, "10", "63" ], [ 3375, "10", "65536" ], [ 3404, "10", "55296" ], [ 3414, "10", "10" ], [ 3417, "10", "56320" ], [ 3423, "10", "1023" ], [ 3461, "10", "31" ], [ 3468, "10", "6" ], [ 3538, "10", "0" ], [ 3550, "10", "0" ], [ 3566, "10", "1" ], [ 3578, "10", "0" ], [ 3618, "10", "55296" ], [ 3628, "10", "57343" ], [ 3641, "10", "65536" ], [ 3649, "10", "1023" ], [ 3658, "10", "10" ], [ 3662, "10", "1023" ], [ 3689, "10", "127" ], [ 3728, "10", "2047" ], [ 3745, "10", "1" ], [ 3760, "10", "192" ], [ 3767, "10", "6" ], [ 3777, "10", "65535" ], [ 3795, "10", "2" ], [ 3810, "10", "224" ], [ 3817, "10", "12" ], [ 3833, "10", "3" ], [ 3848, "10", "240" ], [ 3855, "10", "18" ], [ 3865, "10", "128" ], [ 3872, "10", "12" ], [ 3875, "10", "63" ], [ 3885, "10", "128" ], [ 3892, "10", "6" ], [ 3894, "10", "63" ], [ 3904, "10", "128" ], [ 3908, "10", "63" ], [ 3927, "10", "0" ], [ 3952, "10", "0" ], [ 3984, "u8", "function" ], [ 3985, "u8", "function" ], [ 4019, "u8", "number" ], [ 4020, "u8", "number" ], [ 4043, "10", "0" ], [ 4097, "10", "0" ], [ 4194, "10", "0" ], [ 4349, "u8", "both async and sync fetching of the wasm failed" ], [ 4350, "u8", "both async and sync fetching of the wasm failed" ], [ 4459, "u8", "function" ], [ 4460, "u8", "function" ], [ 4540, "u8", "same-origin" ], [ 4541, "u8", "same-origin" ], [ 4587, "u8", "failed to load wasm binary file at " ], [ 4588, "u8", "failed to load wasm binary file at " ], [ 4657, "u8", "catch" ], [ 4658, "u8", "catch" ], [ 4798, "10", "0" ], [ 4989, "u8", "failed to asynchronously prepare wasm: " ], [ 4990, "u8", "failed to asynchronously prepare wasm: " ], [ 5079, "10", "1" ], [ 5081, "10", "0" ], [ 5084, "u8", "global.Math" ], [ 5085, "u8", "global.Math" ], [ 5247, "u8", "Module.instantiateWasm callback failed with error: " ], [ 5248, "u8", "Module.instantiateWasm callback failed with error: " ], [ 5305, "10", "1" ], [ 5328, "u8", "function" ], [ 5329, "u8", "function" ], [ 5387, "u8", "function" ], [ 5388, "u8", "function" ], [ 5471, "u8", "same-origin" ], [ 5472, "u8", "same-origin" ], [ 5512, "u8", "wasm streaming compile failed: " ], [ 5513, "u8", "wasm streaming compile failed: " ], [ 5551, "u8", "falling back to ArrayBuffer instantiation" ], [ 5552, "u8", "falling back to ArrayBuffer instantiation" ], [ 5622, "u8", "OOM" ], [ 5623, "u8", "OOM" ], [ 5658, "10", "0" ], [ 5687, "10", "255" ], [ 5702, "10", "1" ], [ 5704, "u8", "Character code " ], [ 5705, "u8", "Character code " ], [ 5724, "u8", " (" ], [ 5725, "u8", " (" ], [ 5752, "u8", ") at offset " ], [ 5753, "u8", ") at offset " ], [ 5770, "u8", " not in 0x00-0xFF." ], [ 5771, "u8", " not in 0x00-0xFF." ], [ 5795, "10", "255" ], [ 5895, "u8", "boolean" ], [ 5896, "u8", "boolean" ], [ 5943, "u8", "base64" ], [ 5944, "u8", "base64" ], [ 5977, "u8", "base64" ], [ 5978, "u8", "base64" ], [ 6099, "10", "0" ], [ 6162, "u8", "Converting base64 string to bytes failed." ], [ 6163, "u8", "Converting base64 string to bytes failed." ], [ 6242, "u8", "ExitStatus" ], [ 6243, "u8", "ExitStatus" ], [ 6268, "u8", "Program terminated with exit(" ], [ 6269, "u8", "Program terminated with exit(" ], [ 6302, "u8", ")" ], [ 6303, "u8", ")" ], [ 6378, "10", "0" ], [ 6394, "10", "0" ], [ 6475, "u8", "function" ], [ 6476, "u8", "function" ], [ 6590, "10", "0" ], [ 6612, "u8", "function" ], [ 6613, "u8", "function" ], [ 6715, "10", "0" ], [ 6759, "u8", "Running..." ], [ 6760, "u8", "Running..." ], [ 6834, "10", "1" ], [ 6842, "10", "1" ], [ 6903, "10", "0" ], [ 6946, "10", "0" ], [ 6948, "u8", "abort(" ], [ 6949, "u8", "abort(" ], [ 6959, "u8", "). Build with -s ASSERTIONS=1 for more info." ], [ 6960, "u8", "). Build with -s ASSERTIONS=1 for more info." ], [ 7085, "10", "16" ], [ 7100, "10", "0" ], [ 7189, "u8", "./this.program" ], [ 7190, "u8", "./this.program" ], [ 7274, "10", "1" ], [ 7279, "10", "1" ], [ 7285, "10", "1" ], [ 7289, "u8", "object" ], [ 7290, "u8", "object" ], [ 7315, "u8", "function" ], [ 7316, "u8", "function" ], [ 7350, "u8", "object" ], [ 7351, "u8", "object" ], [ 7376, "u8", "function" ], [ 7377, "u8", "function" ], [ 7453, "u8", "/" ], [ 7454, "u8", "/" ], [ 7515, "u8", "fs" ], [ 7516, "u8", "fs" ], [ 7537, "u8", "path" ], [ 7538, "u8", "path" ], [ 7639, "10", "0" ], [ 7696, "10", "1" ], [ 7747, "10", "1" ] ], "v": { "file.stem": "VirusShare_20ea45b61d5cba4b7ff5339ce5d1972f", "file.basename": "VirusShare_20ea45b61d5cba4b7ff5339ce5d1972f", "source.language": "javascript", "source.imports[0]": "\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\".indexOf", "source.imports[1]": "A.set", "source.imports[2]": "A.subarray", "source.imports[3]": "Array", "source.imports[4]": "Array.join", "source.imports[5]": "Buffer.from", "source.imports[6]": "Date.UTC", "source.imports[7]": "Date.now", "source.imports[8]": "Error", "source.imports[9]": "F.hasOwnProperty", "source.strings[0]": " not in 0x00-0xFF.", "source.strings[1]": "! (TOTAL_STACK=5242880)", "source.strings[2]": "'?p.;\"\u00265{://'o;t.1RQPWVUT[ZYX_^]\\CBA@GFEDKJIrqpwvut{zyx", "source.strings[3]": ") at offset ", "source.strings[4]": "). Build with -s ASSERTIONS=1 for more info.", "source.strings[5]": ", make sure it is exported", "source.strings[6]": "./this.program", "source.strings[7]": "4294967296", "source.strings[8]": "5242880", "source.strings[9]": "5256656", "source.has_imports": true, "source.imports[10]": "F.p", "source.imports[11]": "I.prototype", "source.imports[12]": "I.prototype.constructor", "source.imports[13]": "JSON.parse", "source.imports[14]": "JSON.stringify", "source.imports[15]": "Math.floor", "source.imports[16]": "Math.max", "source.imports[17]": "Math.min", "source.imports[18]": "Math.random", "source.imports[19]": "Math.round", "source.imports[20]": "P.readFileSync", "source.imports[21]": "Q.normalize", "source.imports[22]": "S.f", "source.imports[23]": "String.fromCharCode", "source.imports[24]": "U.set", "source.imports[25]": "URL.createObjectURL", "source.imports[26]": "Uint8Array.of", "source.imports[27]": "V.decode", "source.imports[28]": "WebAssembly.instantiate", "source.imports[29]": "WebAssembly.instantiateStreaming", "source.imports[30]": "WebAssembly.instantiateStreaming.then", "source.imports[31]": "a.HEAP16", "source.imports[32]": "a.HEAP32", "source.imports[33]": "a.HEAP8", "source.imports[34]": "a.HEAPF32", "source.imports[35]": "a.HEAPF64", "source.imports[36]": "a.HEAPU16", "source.imports[37]": "a.HEAPU32", "source.imports[38]": "a.HEAPU8", "source.imports[39]": "a.___errno_location", "source.imports[40]": "a._hash_cn", "source.imports[41]": "a.abort", "source.imports[42]": "a.arguments", "source.imports[43]": "a.asm", "source.imports[44]": "a.asm.k.apply", "source.imports[45]": "a.asm.l.apply", "source.imports[46]": "a.asm.m.apply", "source.imports[47]": "a.asm.n.apply", "source.imports[48]": "a.buffer", "source.imports[49]": "a.calledRun", "source.imports[50]": "a.ccall", "source.imports[51]": "a.charAt", "source.imports[52]": "a.cwrap", "source.imports[53]": "a.d", "source.imports[54]": "a.dynCall_v", "source.imports[55]": "a.dynCall_vi", "source.imports[56]": "a.getTime", "source.imports[57]": "a.getUTCDate", "source.imports[58]": "a.getUTCDay", "source.imports[59]": "a.getUTCFullYear", "source.imports[60]": "a.getUTCHours", "source.imports[61]": "a.getUTCMinutes", "source.imports[62]": "a.getUTCMonth", "source.imports[63]": "a.getUTCSeconds", "source.imports[64]": "a.hasOwnProperty", "source.imports[65]": "a.inspect", "source.imports[66]": "a.instantiateWasm", "source.imports[67]": "a.join", "source.imports[68]": "a.locateFile", "source.imports[69]": "a.monitorRunDependencies", "source.imports[70]": "a.noExitRuntime", "source.imports[71]": "a.onAbort", "source.imports[72]": "a.onRuntimeInitialized", "source.imports[73]": "a.open", "source.imports[74]": "a.p", "source.imports[75]": "a.postRun", "source.imports[76]": "a.postRun.shift", "source.imports[77]": "a.preInit", "source.imports[78]": "a.preInit.pop", "source.imports[79]": "a.preRun", "source.imports[80]": "a.preRun.shift", "source.imports[81]": "a.preloadedAudios", "source.imports[82]": "a.preloadedImages", "source.imports[83]": "a.push", "source.imports[84]": "a.quit", "source.imports[85]": "a.read", "source.imports[86]": "a.readAsync", "source.imports[87]": "a.readBinary", "source.imports[88]": "a.replace", "source.imports[89]": "a.run", "source.imports[90]": "a.send", "source.imports[91]": "a.setStatus", "source.imports[92]": "a.setWindowTitle", "source.imports[93]": "a.stackAlloc", "source.imports[94]": "a.stackRestore", "source.imports[95]": "a.stackSave", "source.imports[96]": "a.thisProgram", "source.imports[97]": "aa", "source.imports[98]": "addWorker", "source.imports[99]": "addWorkers", "source.strings[10]": "67108864", "source.strings[11]": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", "source.strings[12]": "Assertion failed: ", "source.strings[13]": "Cannot call unknown function ", "source.strings[14]": "Character code ", "source.strings[15]": "Converting base64 string to bytes failed.", "source.strings[16]": "ExitStatus", "source.strings[17]": "Module.instantiateWasm callback failed with error: ", "source.strings[18]": "Program terminated with exit(", "source.strings[19]": "Running...", "source.strings[20]": "TOTAL_MEMORY should be larger than TOTAL_STACK, was ", "source.strings[21]": "[Emscripten Module object]", "source.strings[22]": "abort(", "source.strings[23]": "algorithm not supported!", "source.strings[24]": "anyfunc", "source.strings[25]": "arraybuffer", "source.strings[26]": "base64", "source.strings[27]": "binary", "source.strings[28]": "boolean", "source.strings[29]": "both async and sync fetching of the wasm failed", "source.strings[30]": "channel", "source.strings[31]": "cn-half", "source.strings[32]": "cn-lite", "source.strings[33]": "cn-pico", "source.strings[34]": "data:application/octet-stream;base64,", "source.strings[35]": "debugger", "source.strings[36]": "f64-rem", "source.strings[37]": "failed to asynchronously prepare wasm: ", "source.strings[38]": "failed to load wasm binary file at ", "source.strings[39]": "falling back to ArrayBuffer instantiation", "source.strings[40]": "function", "source.strings[41]": "global.Math", "source.strings[42]": "handshake", "source.strings[43]": "hash_cn", "source.strings[44]": "no native wasm support detected", "source.strings[45]": "nothing", "source.strings[46]": "number", "source.strings[47]": "object", "source.strings[48]": "same-origin", "source.strings[49]": "solved", "source.strings[50]": "string", "source.strings[51]": "text/javascript", "source.strings[52]": "uncaughtException", "source.strings[53]": "undefined", "source.strings[54]": "unhandledRejection", "source.strings[55]": "utf-16le", "source.strings[56]": "wakeup", "source.strings[57]": "wasm streaming compile failed: ", "source.strings[58]": "wss://dta.shush.se:8892/", "source.functions[0]": "G", "source.functions[1]": "H", "source.functions[2]": "I", "source.functions[3]": "L", "source.functions[4]": "O", "source.functions[5]": "R", "source.functions[6]": "W", "source.functions[7]": "X", "source.functions[8]": "Y", "source.functions[9]": "addWorker", "source.imports[100]": "attempts", "source.imports[101]": "b.arrayBuffer", "source.imports[102]": "b.charCodeAt", "source.imports[103]": "b.indexOf", "source.imports[104]": "b.match", "source.imports[105]": "b.match.reverse", "source.imports[106]": "b.match.reverse.join", "source.imports[107]": "b.onerror", "source.imports[108]": "b.onload", "source.imports[109]": "b.open", "source.imports[110]": "b.responseType", "source.imports[111]": "b.send", "source.imports[112]": "b.shift", "source.imports[113]": "b.slice", "source.imports[114]": "b.startsWith", "source.imports[115]": "b.subarray", "source.imports[116]": "ba", "source.imports[117]": "ba.unshift", "source.imports[118]": "c.__memory_base", "source.imports[119]": "c.__table_base", "source.imports[120]": "c.blob.substring", "source.imports[121]": "c.charCodeAt", "source.imports[122]": "c.memory", "source.imports[123]": "c.onmessage", "source.imports[124]": "c.table", "source.imports[125]": "ca", "source.imports[126]": "ca.unshift", "source.imports[127]": "clearInterval", "source.imports[128]": "connected", "source.imports[129]": "console.log", "source.imports[130]": "console.log.bind", "source.imports[131]": "console.warn.bind", "source.imports[132]": "d.apply", "source.imports[133]": "d.toString", "source.imports[134]": "da", "source.imports[135]": "deleteAllWorkers", "source.imports[136]": "document.title", "source.imports[137]": "e.toString", "source.imports[138]": "ea", "source.imports[139]": "f.a", "source.imports[140]": "f.substring", "source.imports[141]": "fa", "source.imports[142]": "fetch", "source.imports[143]": "fetch.then", "source.imports[144]": "fetch.then.catch", "source.imports[145]": "fs", "source.imports[146]": "g.onmessage", "source.imports[147]": "g.postMessage", "source.imports[148]": "ha", "source.imports[149]": "handshake", "source.imports[150]": "informWorker", "source.imports[151]": "ja", "source.imports[152]": "job", "source.imports[153]": "ka", "source.imports[154]": "l.indexOf", "source.imports[155]": "l.push", "source.imports[156]": "l.sort", "source.imports[157]": "la", "source.imports[158]": "la.then", "source.imports[159]": "la.then.then", "source.imports[160]": "logicalProcessors", "source.imports[161]": "ma", "source.imports[162]": "module.exports", "source.imports[163]": "na", "source.imports[164]": "oa", "source.imports[165]": "on_workermsg", "source.imports[166]": "onmessage", "source.imports[167]": "openWebSocket", "source.imports[168]": "pa", "source.imports[169]": "parseInt", "source.imports[170]": "path", "source.imports[171]": "performance.now", "source.imports[172]": "postMessage", "source.imports[173]": "process.argv.slice", "source.imports[174]": "process.exit", "source.imports[175]": "process.on", "source.imports[176]": "q.indexOf", "source.imports[177]": "q.lastIndexOf", "source.imports[178]": "q.substr", "source.imports[179]": "qa", "source.imports[180]": "quit", "source.imports[181]": "ra", "source.imports[182]": "read", "source.imports[183]": "readbuffer", "source.imports[184]": "receiveStack", "source.imports[185]": "receiveStack.push", "source.imports[186]": "reconnector", "source.imports[187]": "require", "source.imports[188]": "sa", "source.imports[189]": "sendStack", "source.imports[190]": "sendStack.push", "source.imports[191]": "server", "source.imports[192]": "server.split", "source.imports[193]": "setInterval", "source.imports[194]": "setTimeout", "source.imports[195]": "startBroadcast", "source.imports[196]": "startBroadcast.bc", "source.imports[197]": "startBroadcast.bc.close", "source.imports[198]": "startBroadcast.id", "source.imports[199]": "stopBroadcast", "source.imports[200]": "stopMining", "source.imports[201]": "throttleMiner", "source.imports[202]": "totalhashes", "source.imports[203]": "wasmSupported", "source.imports[204]": "workers", "source.imports[205]": "workers.i.terminate", "source.imports[206]": "workers.push", "source.imports[207]": "workers.shift", "source.imports[208]": "workers.shift.terminate", "source.imports[209]": "ws", "source.imports[210]": "ws.close", "source.imports[211]": "ws.onclose", "source.imports[212]": "ws.onerror", "source.imports[213]": "ws.onmessage", "source.imports[214]": "ws.onopen", "source.imports[215]": "ws.send", "source.functions[10]": "addWorkers", "source.functions[11]": "anonymous", "source.functions[12]": "c", "source.functions[13]": "d", "source.functions[14]": "deleteAllWorkers", "source.functions[15]": "e", "source.functions[16]": "ea", "source.functions[17]": "f", "source.functions[18]": "informWorker", "source.functions[19]": "l", "source.functions[20]": "la", "source.functions[21]": "ma", "source.functions[22]": "n", "source.functions[23]": "on_servermsg", "source.functions[24]": "on_workermsg", "source.functions[25]": "removeWorker", "source.functions[26]": "startBroadcast", "source.functions[27]": "startMining", "source.functions[28]": "startMiningWithId", "source.functions[29]": "stopBroadcast", "source.functions[30]": "stopMining", "source.functions[31]": "u", "source.functions[32]": "w" }, "ct": [ "A.set", "A.subarray", "Array", "Array().join", "ArrayBuffer", "Blob", "BroadcastChannel", "Buffer", "Buffer.from", "Date", "Date.UTC", "Date.now", "Error", "F.hasOwnProperty", "Float32Array", "Float64Array", "G", "H", "Int16Array", "Int32Array", "Int8Array", "JSON.parse", "JSON.stringify", "K", "L", "Math.floor", "Math.max", "Math.min", "Math.random", "Math.round", "O", "P.readFileSync", "Promise", "Q.normalize", "R", "String.fromCharCode", "T", "TextDecoder", "U.set", "URL.createObjectURL", "Uint16Array", "Uint32Array", "Uint8Array", "Uint8Array.of", "V.decode", "W", "WebAssembly.Instance", "WebAssembly.Memory", "WebAssembly.Module", "WebAssembly.Table", "WebAssembly.instantiate", "WebAssembly.instantiateStreaming", "WebAssembly.instantiateStreaming().then", "WebSocket", "Worker", "X", "XMLHttpRequest", "Y", "a.___errno_location", "a.asm", "a.asm.k.apply", "a.asm.l.apply", "a.asm.m.apply", "a.asm.n.apply", "a.charAt", "a.cwrap", "a.dynCall_v", "a.dynCall_vi", "a.getTime", "a.getUTCDate", "a.getUTCDay", "a.getUTCFullYear", "a.getUTCHours", "a.getUTCMinutes", "a.getUTCMonth", "a.getUTCSeconds", "a.hasOwnProperty", "a.instantiateWasm", "a.join", "a.locateFile", "a.monitorRunDependencies", "a.onAbort", "a.onRuntimeInitialized", "a.open", "a.postRun.shift", "a.preInit.pop", "a.preInit.pop()", "a.preRun.shift", "a.push", "a.read", "a.readBinary", "a.replace", "a.send", "a.setStatus", "addWorker", "addWorkers", "b", "b.arrayBuffer", "b.charCodeAt", "b.indexOf", "b.match", "b.match().reverse", "b.match().reverse().join", "b.open", "b.send", "b.shift", "b.slice", "b.startsWith", "b.subarray", "ba.unshift", "c", "c.blob.substring", "c.charCodeAt", "ca.unshift", "clearInterval", "console.log", "console.log.bind", "console.warn.bind", "d", "d.apply", "d.toString", "da", "deleteAllWorkers", "e", "e.toString", "ea", "f", "f.substring", "fetch", "fetch().then", "fetch().then().catch", "g", "g.postMessage", "informWorker", "ja", "k", "ka", "l", "l.indexOf", "l.push", "l.sort", "la", "la().then", "la().then().then", "ma", "n", "on_workermsg", "openWebSocket", "pa", "parseInt", "performance.now", "postMessage", "process.argv.slice", "process.exit", "process.on", "q.indexOf", "q.lastIndexOf", "q.substr", "quit", "read", "readbuffer", "receiveStack.push", "reconnector", "require", "sendStack.push", "server.split", "setInterval", "setTimeout", "startBroadcast", "startBroadcast.bc.close", "stopBroadcast", "stopMining", "u", "w", "workers.push", "workers.shift", "workers.shift().terminate", "ws.close", "ws.send", "z" ], "id": "javascript", "mc": [ "A.set", "A.subarray", "Array().join", "Buffer.from", "Date.UTC", "Date.now", "F.hasOwnProperty", "I.prototype", "I.prototype.constructor", "JSON.parse", "JSON.stringify", "M.length", "Math.floor", "Math.max", "Math.min", "Math.random", "Math.round", "P.readFileSync", "Q.normalize", "String.fromCharCode", "String.prototype", "String.prototype.startsWith", "U.set", "URL.createObjectURL", "Uint8Array.of", "V.decode", "WebAssembly.Instance", "WebAssembly.Memory", "WebAssembly.Module", "WebAssembly.Table", "WebAssembly.instantiate", "WebAssembly.instantiateStreaming", "WebAssembly.instantiateStreaming().then", "a.HEAP16", "a.HEAP32", "a.HEAP8", "a.HEAPF32", "a.HEAPF64", "a.HEAPU16", "a.HEAPU32", "a.HEAPU8", "a.TOTAL_MEMORY", "a.___errno_location", "a._hash_cn", "a.abort", "a.arguments", "a.asm", "a.asm.k", "a.asm.k.apply", "a.asm.l", "a.asm.l.apply", "a.asm.m", "a.asm.m.apply", "a.asm.n", "a.asm.n.apply", "a.buffer", "a.byteLength", "a.byteOffset", "a.calledRun", "a.ccall", "a.charAt", "a.cwrap", "a.data", "a.dynCall_v", "a.dynCall_vi", "a.getTime", "a.getUTCDate", "a.getUTCDay", "a.getUTCFullYear", "a.getUTCHours", "a.getUTCMinutes", "a.getUTCMonth", "a.getUTCSeconds", "a.hasOwnProperty", "a.inspect", "a.instantiateWasm", "a.job", "a.join", "a.length", "a.locateFile", "a.monitorRunDependencies", "a.noExitRuntime", "a.onAbort", "a.onRuntimeInitialized", "a.open", "a.postRun", "a.postRun.length", "a.postRun.shift", "a.preInit", "a.preInit.length", "a.preInit.pop", "a.preRun", "a.preRun.length", "a.preRun.shift", "a.preloadedAudios", "a.preloadedImages", "a.print", "a.printErr", "a.push", "a.quit", "a.read", "a.readAsync", "a.readBinary", "a.replace", "a.responseText", "a.run", "a.send", "a.setStatus", "a.setWindowTitle", "a.stackAlloc", "a.stackRestore", "a.stackSave", "a.thisProgram", "a.throttle", "a.wasmBinary", "b.arrayBuffer", "b.buffer", "b.charCodeAt", "b.exports", "b.indexOf", "b.instance", "b.length", "b.match", "b.match().reverse", "b.match().reverse().join", "b.ok", "b.onerror", "b.onload", "b.open", "b.response", "b.responseType", "b.send", "b.shift", "b.slice", "b.startsWith", "b.status", "b.subarray", "ba.unshift", "c.__memory_base", "c.__table_base", "c.algo", "c.blob", "c.blob.length", "c.blob.substring", "c.buffer", "c.charCodeAt", "c.data", "c.height", "c.identifier", "c.job_id", "c.length", "c.memory", "c.onmessage", "c.table", "c.target", "c.variant", "ca.unshift", "console.log", "console.log.bind", "console.warn", "console.warn.bind", "d.apply", "d.toString", "d.toString().length", "document.currentScript", "document.currentScript.src", "document.title", "e.arg", "e.func", "e.toString", "f.substring", "fetch().then", "fetch().then().catch", "g.onmessage", "g.postMessage", "l.indexOf", "l.push", "l.sort", "la().then", "la().then().then", "module.exports", "performance.now", "process.argv", "process.argv.length", "process.argv.slice", "process.exit", "process.on", "q.indexOf", "q.lastIndexOf", "q.substr", "r.length", "receiveStack.push", "self.location", "self.location.href", "sendStack.push", "server.split", "startBroadcast.bc", "startBroadcast.bc.close", "startBroadcast.id", "window.navigator", "window.navigator.hardwareConcurrency", "workers.length", "workers.push", "workers.shift", "workers.shift().terminate", "ws.close", "ws.onclose", "ws.onerror", "ws.onmessage", "ws.onopen", "ws.readyState", "ws.send" ] }, "id": 0, "sz": 184524, "ts": [ { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "JavaScript static key string assignment", "e": [ "=\"wss://dta.shush.se:8892/\"" ], "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment", "l": 1 }, { "c": 0.699999988079071, "d": "Node.js process exit event listener registered", "e": [ "process.on" ], "i": "micro-behaviors/process/exit/terminate::process-on-exit", "l": 2, "el": [ "1eab" ] }, { "a": "T1005", "c": 0.30000001192092896, "d": "Boolean-true return fragment", "e": [ "return 0" ], "i": "objectives/credential-access/financial/credit-card::card-filter-return-true", "l": 1, "m": "B0030" }, { "a": "T1098.004", "c": 0.8999999761581421, "d": "JavaScript Windows drive enumeration marker", "e": [ "CDEFGHIJ" ], "i": "objectives/persistence/login/ssh/backdoor::js-windows-drive-enumeration", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Uint8Array constructor/of/from invocation", "e": [ "Uint8Array.of(0" ], "i": "objectives/anti-static/obfuscation/payload/config::api-named-byte-array-const--rx-1", "l": 1, "m": "B0032" }, { "a": "T1552.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "fetch" ], "i": "objectives/supply-chain/credential-theft/registry::js-creds-to-fetch--rx-12", "l": 1 }, { "c": 0.8500000238418579, "d": "MIME octet-stream content type", "e": [ "application/octet-stream" ], "i": "micro-behaviors/communications/email/mime::mime-octet-stream", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ").reverse" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-11", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript console object", "e": [ "console" ], "i": "micro-behaviors/os/console/io::js-console-object", "l": 1 }, { "a": "T1041", "c": 0.8600000143051147, "d": "postinstall encodes report with Buffer.from", "e": [ "Buffer.from" ], "i": "objectives/supply-chain/install-hook/scripts/hook-file::postinstall-buffer-from-report", "l": 1 }, { "a": "T1059.007", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "ws.onmessage=" ], "i": "objectives/command-and-control/remote-command/control::websocket-onmessage-assignment--rx-1", "l": 1 }, { "c": 0.949999988079071, "d": "require('fs') call (flatted tamper fragment)", "e": [ "require(\"fs\")" ], "i": "well-known/lib/flatted::flatted-tamper-fs", "l": 1 }, { "a": "T1195.002", "d": "JS module export syntax", "e": [ "module.exports" ], "i": "objectives/supply-chain/trojanized/app/config-injection::js-export-boundary", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "WebSocket constructor call", "e": [ "WebSocket" ], "i": "micro-behaviors/communications/http/websocket::websocket-constructor-call", "l": 3, "m": "C0002", "el": [ "31b" ] }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "JSON.parse call symbol", "e": [ "JSON.parse" ], "i": "objectives/supply-chain/trojanized/library/remote-eval::json-parse-call-symbol", "l": 1, "el": [ "2cf12" ] }, { "a": "T1195.002", "c": 1.0, "d": "'Buffer' identifier reference", "e": [ "falling back to ArrayBuffer instantiation" ], "i": "objectives/supply-chain/hidden-payload/staging::buffer-keyword", "l": 1, "el": [ "15af" ] }, { "c": 0.9800000190734863, "d": "Emscripten module wrapper marker", "e": [ "[Emscripten Module object]" ], "i": "metadata/library/structure::js-emscripten-module-marker", "l": 1 }, { "c": 1.0, "d": ".toString() method call", "e": [ ".toString()" ], "i": "micro-behaviors/data/encode/tostring::tostring-call", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").reverse" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-2", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Large minified JavaScript bundle", "e": [ "text.max_line_length = 170441.00" ], "i": "metadata/library/structure::js-large-minified-bundle", "l": 2 }, { "c": 0.8199999928474426, "d": "JavaScript substring search call", "e": [ "indexOf(" ], "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "l": 2 }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "Node.js require call in non-code file", "e": [ "require(" ], "i": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "DOM script element literal", "e": [ "[Emscripten Module object]", "text/javascript" ], "i": "micro-behaviors/process/create/load/remote-code::js-dom-script-literal", "l": 1, "el": [ "1f58", "2cdaa" ] }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for(;0\u003clogicalProcessors--;)addWorker()", "for(p in F)F.hasOwnProperty(p)\u0026\u0026(a[p]=F[p]);", "for(var a=[],d=0;d\u003cb.length;d++){var c=b[d];255\u003cc\u0026\u0026(oa\u0026\u0026f(!1,\"Character code \"+c+\" (\"+String.fromCha...", "for(i=0;i\u003cworkers.length;i++)workers[i].terminate();", "for(a=a.replace(/[^A-Za-z0-9\\+\\/=]/g,\"\");b=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123...", "for(;0\u003cb.length;){var e=b.shift();if(\"function\"!=typeof e){var d=e.func;\"number\"==typeof d?void 0===...", "for(a=0;a\u003cc.length;++a)f[a]=c.charCodeAt(a);", "for(var f=\n0;f\u003cr.length;f++){var g=c[a[f]];S[f]=g?(0===b\u0026\u0026(b=ja()),g(r[f])):r[f]}", "for(\"function\"==typeof a.preInit\u0026\u0026(a.preInit=[a.preInit]);0\u003ca.preInit.length;)a.preInit.pop()();", "for(p in a)a.hasOwnProperty(p)\u0026\u0026(F[p]=a[p]);", "for(d=a;b[d]\u0026\u0026!(e\u003c=d);)++d;", "for(e=\"\";a\u003cd;){var c=b[a++];if(128\u0026c){var v=63\u0026b[a++];if(192!=(224\u0026c)){var k=63\u0026b[a++];65536\u003e(c=224=...", "for(var r=0;r\u003cb.length;++r){var k=b.charCodeAt(r);55296\u003c=k\u0026\u002657343\u003e=k\u0026\u0026(k=65536+((1023\u0026k)\u003c\u003c10)|1023\u0026b...", "for(\"function\"==typeof a.postRun\u0026\u0026\n(a.postRun=[a.postRun]);a.postRun.length;)ba.unshift(a.postRun.sh...", "for(\"function\"==typeof a.preRun\u0026\u0026(a.preRun=[a.preRun]);a.preRun.length;)ca.unshift(a.preRun.shift())..." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2, "el": [ "2:207", "21:382", "14:156", "30:333", "24:284", "11:21", "15:100", "8:497", "28:53", "17:109", "9:203", "9:288", "10:158", "15:478", "16:103" ] }, { "a": "T1204.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "audio" ], "i": "objectives/execution/lure/video-meeting::meeting-device-permission-lure--rx-7", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "join(" ], "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4", "l": 1 }, { "c": 0.9800000190734863, "d": "Emscripten WebAssembly support marker", "e": [ "no native wasm support detected" ], "i": "metadata/library/structure::js-emscripten-wasm-marker", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Many single-char params", "e": [ "functions.single_char_params = 90.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::single-char-params", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "CommonJS require symbol", "e": [ "require" ], "i": "metadata/lang/scripted::require-symbol", "l": 1, "el": [ "1d53" ] }, { "a": "T1041", "c": 0.75, "d": "HTTP upload request call token", "e": [ "fetch" ], "i": "objectives/supply-chain/recon-exfil/npm-install-targeting::upload-request-call", "l": 1 }, { "c": 1.0, "d": "Math.random invocation", "e": [ "Math.random()" ], "i": "micro-behaviors/os/random/prng/stdlib::math-random-call", "l": 2, "el": [ "3:105" ] }, { "c": 1.0, "d": "ADODB.Stream Open method call", "e": [ ".open(" ], "i": "micro-behaviors/fs/write/stream::adodb-open", "l": 1 }, { "c": 0.699999988079071, "d": "String.fromCharCode() assembly", "e": [ "String.fromCharCode(" ], "i": "micro-behaviors/data/encode/charcode::from-char-code", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Math.random used for indexing (probabilistic character selection)", "e": [ "Math", "random", "floor" ], "i": "micro-behaviors/os/random/prng/stdlib::math-random-index", "l": 2, "el": [ "3:94", "3:110", "3:99" ] }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "atob" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-5", "l": 1, "m": "B0032" }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "info" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-4", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary number", "e": [ "number" ], "i": "metadata/file/text/format::vocab-number", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ "}for(" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "d": "JSON.stringify call", "e": [ "JSON.stringify" ], "i": "micro-behaviors/data/serialize/json::json-stringify-call", "l": 2, "el": [ "3fe" ] }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "performance.now" ], "i": "objectives/anti-analysis/timing/jitter::js-date-diff-jitter-pattern--rx-1", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12", "l": 1, "m": "B0032" }, { "c": 0.550000011920929, "d": "Array element swap pattern", "e": [ "var g=c[a[f]];S[f]=" ], "i": "objectives/anti-static/obfuscation/string/encoding::js-array-swap", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary object", "e": [ "object" ], "i": "metadata/file/text/format::vocab-object", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8", "l": 1, "m": "B0032" }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "send" ], "i": "objectives/command-and-control/remote-command/control::websocket-host-env-send--rx-12", "l": 1 }, { "c": 1.0, "d": "DOM or CSS size property", "e": [ "height" ], "i": "micro-behaviors/ui/window/manage/dom::size-prop", "l": 1 }, { "d": "Join using empty string delimiter", "e": [ ".join(\"\")" ], "i": "objectives/anti-static/obfuscation/string/encoding::js-array-join-symbol", "l": 1 }, { "c": 0.6600000262260437, "d": "Read files (Node.js)", "e": [ "readFileSync(" ], "i": "micro-behaviors/fs/file/read::read-node", "l": 3 }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030" }, { "a": "T1552.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "readFileSync" ], "i": "objectives/supply-chain/credential-theft/registry::js-env-home-cred--rx-2", "l": 1 }, { "a": "T1105", "c": 0.8999999761581421, "d": "JSON cookie repeats or detaches stage", "e": [ "setInterval" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::json-cookie-stage-repeat-or-detach", "l": 1, "m": "B0009.016" }, { "a": "T1027", "c": 0.9200000166893005, "d": "charCodeAt call marker", "e": [ "b.charCodeAt", "c.charCodeAt" ], "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-4", "l": 1, "m": "B0032", "el": [ "e12", "17e9" ] }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 31.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 1.0, "d": "JavaScript startsWith method", "e": [ "startsWith" ], "i": "metadata/lang/scripted::startswith-method", "l": 1 }, { "a": "T1195.002", "c": 0.949999988079071, "d": "Standard base64 alphabet string literal", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ], "i": "objectives/supply-chain/hidden-payload/runtime::base64-alphabet-literal", "l": 1, "el": [ "2c274" ] }, { "c": 0.9700000286102295, "d": "Validation vocabulary array", "e": [ "array" ], "i": "metadata/file/text/format::vocab-array", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "warn" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-5", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript undefined literal", "e": [ "undefined" ], "i": "metadata/lang/scripted::undefined-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "location.href" ], "i": "micro-behaviors/communications/http/url/path::browser-location-host-ref--rx-1", "l": 1 }, { "c": 1.0, "d": "Plain JavaScript identifier assignment", "e": [ "logicalProcessors=c;" ], "i": "metadata/lang/scripted::plain-js-identifier-assignment", "l": 1 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "atob" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-10", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "toString method token", "e": [ "toString" ], "i": "micro-behaviors/data/encode/tostring::tostring-token", "l": 1 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 2 }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "string" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.800000011920929, "d": "Accesses process.argv (Command line arguments)", "e": [ "process.argv" ], "i": "micro-behaviors/process/info/commandline::check-argv", "l": 2 }, { "c": 0.699999988079071, "d": "charCodeAt() method call", "e": [ ".charCodeAt(" ], "i": "micro-behaviors/data/encode/charcode::charcode-at", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 170441.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "charAt in loop pattern", "e": [ "a.charAt" ], "i": "objectives/anti-static/obfuscation/string/encoding::js-charat-loop", "l": 1, "m": "B0032", "el": [ "2c2c0" ] }, { "c": 0.8199999928474426, "d": "Hex toString call", "e": [ "toString(16)" ], "i": "objectives/command-and-control/dns/tunneling::hex-tostring-call", "l": 1 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 50.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "c": 0.30000001192092896, "d": "JavaScript Date object construction", "e": [ "new Date" ], "i": "micro-behaviors/time/query::js-new-date", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "WebSocket send() call", "e": [ "ws.send(" ], "i": "micro-behaviors/communications/websocket/server::websocket-send", "l": 1, "m": "C0002" }, { "c": 0.8600000143051147, "d": "Console logs JSON stringified payload", "e": [ "console.log(ia)}}},g=function(){e?postMessage(JSON.stringify(" ], "i": "micro-behaviors/os/telemetry/logging/llm::console-log-json-stringify-call", "l": 1, "m": "C0069" }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4", "l": 1, "m": "B0032" }, { "a": "T1195.002", "c": 0.949999988079071, "d": "A single line exceeds 50,000 characters", "e": [ "text.max_line_length = 170441.00" ], "i": "objectives/supply-chain/hidden-payload/runtime::high-max-line-length", "l": 1 }, { "a": "T1041", "c": 0.8999999761581421, "d": "postinstall serializes report JSON", "e": [ "JSON.stringify" ], "i": "objectives/supply-chain/install-hook/scripts/hook-file::postinstall-json-stringify-report", "l": 1 }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "debug" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-2", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "fetch() API call (JavaScript)", "e": [ "fetch(t,{credentials:\"same-origin\"})" ], "i": "micro-behaviors/communications/http/request/client::js-fetch-call", "l": 3, "m": "C0002", "el": [ "12:69" ] }, { "c": 0.800000011920929, "d": "Base64 decoding via Buffer.from (JS)", "e": [ "Buffer.from(b,\"base64\")" ], "i": "micro-behaviors/data/decode/base64::buffer-from-base64", "l": 2 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.8999999761581421, "d": "innerHTML/location.href rewrite (page blocker shape)", "e": [ "location.href" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-page-block", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "error" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3", "l": 1 }, { "c": 0.75, "d": "Synchronous file API suffix", "e": [ "FileSync" ], "i": "micro-behaviors/fs/file/read-write::filesync-api-suffix", "l": 1 }, { "c": 1.0, "d": "parseInt with radix 16", "e": [ "parseInt(b.match(/[a-fA-F0-9]{2}/g).reverse().join(\"\"),16)" ], "i": "micro-behaviors/data/encode/hex::parseint-16", "l": 2 }, { "c": 0.949999988079071, "d": "fetch/XMLHttpRequest/http(s) require (flatted tamper fragment)", "e": [ "fetch" ], "i": "well-known/lib/flatted::flatted-tamper-network", "l": 1 }, { "c": 0.8999999761581421, "d": "Medium minified JavaScript line", "e": [ "text.max_line_length = 170441.00" ], "i": "metadata/library/structure::js-medium-minified-line", "l": 1 }, { "d": "catch handler keyword", "e": [ "catch" ], "i": "metadata/package/error-handling::catch-keyword", "l": 2, "el": [ "1231" ] }, { "c": 0.8799999952316284, "d": "Codebase deletion target", "e": [ "code" ], "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "String.fromCharCode call marker", "e": [ "String.fromCharCode" ], "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-3", "l": 1, "m": "B0032", "el": [ "d14" ] }, { "a": "T1552.001", "c": 0.30000001192092896, "d": "\"password\" keyword", "e": [ "password" ], "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword", "l": 1 }, { "d": "JSON.parse call", "e": [ "JSON.parse(c.data)" ], "i": "micro-behaviors/data/serialize/json::json-parse-call", "l": 2, "el": [ "31:28" ] }, { "c": 0.800000011920929, "d": "base64 string literal", "e": [ "base64" ], "i": "micro-behaviors/data/encode/base64::base64-literal", "l": 1, "m": "C0026", "el": [ "1737" ] }, { "c": 0.9700000286102295, "d": "Validation vocabulary boolean", "e": [ "boolean" ], "i": "metadata/file/text/format::vocab-boolean", "l": 1 }, { "c": 0.699999988079071, "d": "require('fs') import", "e": [ "require", "\"fs\"" ], "i": "metadata/import/builtin::require-fs", "l": 2, "el": [ "17:500", "17:508" ] }, { "c": 1.0, "d": "new Promise() usage marker", "e": [ "new Promise(" ], "i": "metadata/lang/javascript-features::has-promise-new", "l": 2 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").reverse" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-7", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Date.now" ], "i": "objectives/anti-analysis/timing/jitter::js-date-diff-jitter-pattern--rx-2", "l": 1 }, { "c": 0.699999988079071, "d": "High ratio of single character function names", "e": [ "functions.single_char_names = 20.00" ], "i": "objectives/supply-chain/hidden-payload/extensions/vscode::single-char-names-dup", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "base64" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-benign-text--rx-8", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Prototype guard keyword", "e": [ "prototype" ], "i": "micro-behaviors/data/source/prototype::js-proto-guard-prototype", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "fetch() call string reference", "e": [ "fetch" ], "i": "micro-behaviors/communications/http/request/client::fetch-string", "l": 3, "m": "C0002", "el": [ "11a7" ] }, { "c": 0.6000000238418579, "d": "References script directory path", "e": [ "__dirname" ], "i": "objectives/discovery/system/fingerprint/hardware::node-dirname", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 20k character line", "e": [ "text.max_line_length = 170441.00" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::max-line-length-20000", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Many one-line source function definitions", "e": [ "functions.one_liners = 74.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-one-liner-functions", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Single-line packed JavaScript loader profile", "e": [ "text.max_line_length = 170441.00" ], "i": "objectives/supply-chain/hidden-payload/trojan::single-line-packed-loader-metrics", "l": 1, "m": "B0032" }, { "a": "T1555", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "base64" ], "i": "objectives/credential-access/wallet/solana::solana-secretkey-serialization--rx-6", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "wss:// URL scheme", "e": [ "wss://" ], "i": "micro-behaviors/communications/http/websocket::wss-scheme", "l": 3, "m": "C0002" }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "XMLHttpRequest" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "l": 3 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(g){}" ], "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Access to HTTP response body (.responseText)", "e": [ ".responseText" ], "i": "micro-behaviors/communications/http/client/response-body::response-text", "l": 3 }, { "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 35.00" ], "i": "metadata/file/text/metrics::many-no-param-functions", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Many anonymous source function definitions", "e": [ "functions.anonymous = 59.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-anonymous-functions", "l": 2, "m": "B0032" }, { "a": "T1027", "d": "Decoded property function alias", "e": [ "var c=b[d]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Prototype guard checks constructor", "e": [ "constructor" ], "i": "micro-behaviors/data/source/prototype::js-proto-guard-constructor", "l": 2 }, { "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 303.23" ], "i": "metadata/file/text/metrics::high-function-density", "l": 2 }, { "c": 0.949999988079071, "d": "imports fs", "e": [ "fs" ], "i": "metadata/import/npm::fs", "l": 2 }, { "c": 0.949999988079071, "d": "imports path", "e": [ "path" ], "i": "metadata/import/npm::path", "l": 2 }, { "c": 0.800000011920929, "d": "HTTP/HTTPS client request capability", "e": [ "fetch(t,{credentials:\"same-origin\"})", "fetch", "XMLHttpRequest" ], "i": "micro-behaviors/crypto/symmetric/aes/runtime-library::http-client-comp", "l": 1, "el": [ "12:69", "11a7", "" ] }, { "c": 0.9700000286102295, "d": "Form-validation vocabulary in dense non-ASCII file", "e": [ "boolean", "object", "array", "string", "number" ], "i": "metadata/file/text/format::i18n-validation-vocab", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "functions.one_liners = 74.00", "text.whitespace_ratio = 0.00", "identifiers.sequential_names = 50.00", "functions.density_per_100_lines = 303.23" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" } ], "sha": "307dcb30b956f5047d8c48dd75c67be8ae1e0a39d63c99746e5ad0819a1e13db", "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_20ea45b61d5cba4b7ff5339ce5d1972f", "type": "javascript" } ], "tv": "961ce" } }