{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999003410339355, "class": 2 } ], "prob": 0.99990034, "class": 2, "models": [ { "m": "az", "prob": 0.9878079, "class": 2 }, { "m": "az/scripts", "prob": 0.99814475, "class": 1 }, { "m": "az/javascript", "prob": 0.99990034, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T20:19:31Z" }, "path": "20170119_f47ea835414e2b0d12a9755067415fdf.js", "raw": { "v": "4", "fs": [ { "f": "K₂O₇(As₈Xe₂AlCCoEr₂S₂)H₃(DbPo₄Cr)Md", "k": { "source.imports[0]": "acujusuhecezatifmofipirezyssuxyfijiscasagirtogpujmilipuxeqewyhehwovsintacnidebkerpozvyctepzimelevvy", "source.imports[1]": "alapuktobomtowzowataxizybinvuducgidjonmuhtugycamahxurixyberselofubyfajwerofdyhybohaveqsugwugole", "source.imports[2]": "aqopyrbasrucyhyfzakamevwamadcuvkolisiwiguregdifyvanuwejubfyqharuhcykbovreliruknommeppihodidbostehi", "source.imports[3]": "bari3", "source.imports[4]": "bzoxoxa5", "source.imports[5]": "cuparo1", "source.imports[6]": "dehjapsixyczipkivyfufhipexkedubocobfahykakhentaridopowresmotodumygijotxyzoqmobjimdehzaxpyterbuktelu", "source.imports[7]": "docorfumorevoqirgemihyxelveqkatuwqagoxtygenhanokwohqelubsygoziguscapuzoxvewotqowtetubosoxazapbo", "source.imports[8]": "etpapm0", "source.imports[9]": "evqylowyhalidfocfuntuwboqlacozvevurufmogobkilzokulelanyxomsecizmakozossevqadybimeqejgequzqojgybif", "source.has_imports": true, "source.imports[10]": "ezsybw", "source.imports[11]": "felwatarjyllopolwizebagireragryjezpekqivjakepqywiwzawhyxyckatzibogavaripifecligmefarahokrixabqeto", "source.imports[12]": "hefqapy", "source.imports[13]": "iblogdehho", "source.imports[14]": "itojekduf2", "source.imports[15]": "ixryccotywribocotukkiqypodosyqtygyvenigepsyqafgymqugonuvofajkazwumurcunizogdozedkotusuwetvyjmyln", "source.imports[16]": "oroveqnebyzobopyqarvymabhocajluvuwsijixipeqrarewkarmehbotacibvybvevnilelveddetiwtapalogyckatigfyham", "source.imports[17]": "oxufrucvynuxbuchakyhelzarujolinyhtynaqamqylkurifupgysvuqudusygocyvijodajduxineralyqirlyvbyhydevjo", "source.imports[18]": "ozrovzuxzy", "source.imports[19]": "pkabufe6", "source.imports[20]": "pnicopbytci5", "source.imports[21]": "tadjyfinzehobxajlymgizsihofonhankufugoqocusufutakqersemejexumugezkavwugludlaxegofhybdycufnijytuxada", "source.imports[22]": "tvypnucdot9", "source.imports[23]": "ujwevqycmefevcysodappuhkypugojfejidimerjuwenonsasirrabkinuzaqicgatujlyfjiznuwalykzujopujiqyfaryf", "source.imports[24]": "ydlyzebsu", "source.imports[25]": "ygytotutlurcidojetyrdulwirzusefyvavazmagawalpoghysqavcychidihvywypefgedateqegjeplarazykikundygruhan", "source.imports[26]": "ymadezbudamyquxyktimzebunvutudygipabbulnezelebuvcuftobapaqalnosmyxezatakjorryhawejubnerexacyxephiho", "source.imports[27]": "ymuweclyrd", "source.imports[28]": "zensehobjozaxjedheryzizunizurretekepzugvohotnebsilidryxhexyrunetunenexijyzxifsapahlexciqqezijyjigyl", "source.imports[29]": "zicocsidamlemjyruzfyhmyxenagikovakpysokogesdulcamixtopozfuwegymcafuqwakijfotfekbyjefugwerapaxogu", "source.imports[30]": "zqikhydu0" }, "x": 74, "id": 0, "is": [ "acujusuhecezatifmofipirezyssuxyfijiscasagirtogpujmilipuxeqewyhehwovsintacnidebkerpozvyctepzimelevvy", "ujwevqycmefevcysodappuhkypugojfejidimerjuwenonsasirrabkinuzaqicgatujlyfjiznuwalykzujopujiqyfaryf", "docorfumorevoqirgemihyxelveqkatuwqagoxtygenhanokwohqelubsygoziguscapuzoxvewotqowtetubosoxazapbo", "oxufrucvynuxbuchakyhelzarujolinyhtynaqamqylkurifupgysvuqudusygocyvijodajduxineralyqirlyvbyhydevjo", "oroveqnebyzobopyqarvymabhocajluvuwsijixipeqrarewkarmehbotacibvybvevnilelveddetiwtapalogyckatigfyham", "ixryccotywribocotukkiqypodosyqtygyvenigepsyqafgymqugonuvofajkazwumurcunizogdozedkotusuwetvyjmyln", "felwatarjyllopolwizebagireragryjezpekqivjakepqywiwzawhyxyckatzibogavaripifecligmefarahokrixabqeto", "dehjapsixyczipkivyfufhipexkedubocobfahykakhentaridopowresmotodumygijotxyzoqmobjimdehzaxpyterbuktelu", "ezsybw", "evqylowyhalidfocfuntuwboqlacozvevurufmogobkilzokulelanyxomsecizmakozossevqadybimeqejgequzqojgybif", "ymadezbudamyquxyktimzebunvutudygipabbulnezelebuvcuftobapaqalnosmyxezatakjorryhawejubnerexacyxephiho", "zensehobjozaxjedheryzizunizurretekepzugvohotnebsilidryxhexyrunetunenexijyzxifsapahlexciqqezijyjigyl", "tadjyfinzehobxajlymgizsihofonhankufugoqocusufutakqersemejexumugezkavwugludlaxegofhybdycufnijytuxada", "alapuktobomtowzowataxizybinvuducgidjonmuhtugycamahxurixyberselofubyfajwerofdyhybohaveqsugwugole", "ygytotutlurcidojetyrdulwirzusefyvavazmagawalpoghysqavcychidihvywypefgedateqegjeplarazykikundygruhan", "zicocsidamlemjyruzfyhmyxenagikovakpysokogesdulcamixtopozfuwegymcafuqwakijfotfekbyjefugwerapaxogu", "aqopyrbasrucyhyfzakamevwamadcuvkolisiwiguregdifyvanuwejubfyqharuhcykbovreliruknommeppihodidbostehi", "hefqapy", "pnicopbytci5", "bzoxoxa5", "itojekduf2", "ydlyzebsu", "etpapm0", "ozrovzuxzy", "tvypnucdot9", "zqikhydu0", "pkabufe6", "bari3", "iblogdehho", "cuparo1", "ymuweclyrd" ], "ms": { "file": { "size": 41158.0 }, "text": { "tab_count": 29.0, "digit_ratio": 0.02, "space_count": 1059.0, "total_lines": 200.0, "char_entropy": 4.98, "unique_chars": 75.0, "import_density": 15.5, "lines_over_200": 23.0, "lines_over_500": 12.0, "string_density": 1.7, "avg_line_length": 204.79, "lines_over_1000": 8.0, "max_line_length": 2583.0, "last_line_length": 3.0, "long_token_count": 299.0, "most_common_char": "a", "whitespace_ratio": 0.03, "most_common_ratio": 0.06, "identifier_density": 1.76, "line_length_stddev": 325.55, "normalized_import_count": 2.19, "normalized_string_count": 23.97, "suspicious_comment_ratio": 0.67, "max_inline_whitespace_run": 1.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 24.46 }, "imports": { "total": 31.0, "unique_modules": 31.0, "third_party_count": 31.0, "third_party_ratio": 1.0 }, "strings": { "total": 339.0, "avg_length": 2.22, "max_length": 4.0, "path_count": 4.0, "avg_entropy": 1.07, "total_bytes": 754.0, "entropy_stddev": 0.4 }, "comments": { "chars": 3723.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.02, "high_entropy_comments": 2.0 }, "functions": {}, "identifiers": { "total": 353.0, "avg_length": 97.07, "max_length": 117.0, "min_length": 5.0, "avg_entropy": 4.28, "reuse_ratio": 0.53, "unique_count": 187.0, "length_stddev": 28.45, "has_digit_ratio": 0.05, "high_entropy_count": 170.0, "high_entropy_ratio": 0.91, "all_lowercase_ratio": 0.94, "numeric_suffix_count": 9.0, "keyboard_pattern_names": 2.0 } }, "ss": [ [ 111, "nd" ], [ 112, "nd" ], [ 244, "ru" ], [ 245, "ru" ], [ 368, "eTo" ], [ 369, "eTo" ], [ 493, "s\\\\" ], [ 494, "s" ], [ 623, "ir." ], [ 624, "ir." ], [ 763, "ti" ], [ 764, "ti" ], [ 883, "Ty" ], [ 884, "Ty" ], [ 1014, "me" ], [ 1015, "me" ], [ 1138, "ng" ], [ 1139, "ng" ], [ 1275, "c\\\\" ], [ 1276, "c" ], [ 1398, "Fi" ], [ 1399, "Fi" ], [ 1519, "pNa" ], [ 1520, "pNa" ], [ 1641, "ct" ], [ 1642, "ct" ], [ 1759, "ct" ], [ 1760, "ct" ], [ 1887, "C:" ], [ 1888, "C:" ], [ 2005, "\\\\\\\\" ], [ 2135, "ib" ], [ 2136, "ib" ], [ 2271, "e/i" ], [ 2272, "e/i" ], [ 2392, "si" ], [ 2393, "si" ], [ 2508, "Sav" ], [ 2509, "Sav" ], [ 2639, "ipt" ], [ 2640, "ipt" ], [ 2761, "op" ], [ 2762, "op" ], [ 2895, " A" ], [ 2896, " A" ], [ 3023, "p:/" ], [ 3024, "p:/" ], [ 3149, "on" ], [ 3150, "on" ], [ 3264, "Sy" ], [ 3265, "Sy" ], [ 3395, "ade" ], [ 3396, "ade" ], [ 3523, "\\\\W" ], [ 3526, "W" ], [ 3639, "-be" ], [ 3640, "-be" ], [ 3773, "Re" ], [ 3774, "Re" ], [ 3915, "ADO" ], [ 3916, "ADO" ], [ 4045, "lFo" ], [ 4046, "lFo" ], [ 4172, "Cr" ], [ 4173, "Cr" ], [ 4287, "je" ], [ 4288, "je" ], [ 4406, "nak" ], [ 4407, "nak" ], [ 4531, "Get" ], [ 4532, "Get" ], [ 4649, "se" ], [ 4650, "se" ], [ 4771, "es" ], [ 4772, "es" ], [ 4905, "le" ], [ 4906, "le" ], [ 5031, "cmd" ], [ 5032, "cmd" ], [ 5157, "ri" ], [ 5158, "ri" ], [ 5283, "XM" ], [ 5284, "XM" ], [ 5412, "tu" ], [ 5413, "tu" ], [ 5546, "Fil" ], [ 5547, "Fil" ], [ 5669, "hel" ], [ 5670, "hel" ], [ 5795, "n.d" ], [ 5796, "n.d" ], [ 5919, "il" ], [ 5920, "il" ], [ 6048, "iv" ], [ 6049, "iv" ], [ 6170, "ys" ], [ 6171, "ys" ], [ 6289, ".X" ], [ 6290, ".X" ], [ 6426, "r" ], [ 6427, "r" ], [ 6552, "pe" ], [ 6553, "pe" ], [ 6691, "Wr" ], [ 6692, "Wr" ], [ 6818, "er" ], [ 6819, "er" ], [ 6943, "Ge" ], [ 6944, "Ge" ], [ 7085, "Sc" ], [ 7086, "Sc" ], [ 7209, "exe" ], [ 7210, "exe" ], [ 7338, "te" ], [ 7339, "te" ], [ 7453, "lde" ], [ 7454, "lde" ], [ 7585, "Spe" ], [ 7586, "Spe" ], [ 7701, "it" ], [ 7702, "it" ], [ 7819, "ore" ], [ 7820, "ore" ], [ 7951, "in" ], [ 7952, "in" ], [ 8066, "Sy" ], [ 8067, "Sy" ], [ 8188, "sp" ], [ 8189, "sp" ], [ 8319, "e" ], [ 8320, "e" ], [ 8436, "je" ], [ 8437, "je" ], [ 8551, "\\\\S" ], [ 8554, "S" ], [ 8670, "eam" ], [ 8671, "eam" ], [ 8797, "ws" ], [ 8798, "ws" ], [ 8924, "Bo" ], [ 8925, "Bo" ], [ 9054, "Get" ], [ 9055, "Get" ], [ 9175, "Ob" ], [ 9176, "Ob" ], [ 9310, "e /" ], [ 9311, "e /" ], [ 9427, "MS" ], [ 9428, "MS" ], [ 9559, "me" ], [ 9560, "me" ], [ 9693, "es/" ], [ 9694, "es/" ], [ 9826, "/ww" ], [ 9827, "/ww" ], [ 9960, "mag" ], [ 9961, "mag" ], [ 10089, "Scr" ], [ 10090, "Scr" ], [ 10215, "st" ], [ 10216, "st" ], [ 10337, "eX" ], [ 10338, "eX" ], [ 10507, "tr" ], [ 10508, "tr" ], [ 10632, "GE" ], [ 10633, "GE" ], [ 10755, "ea" ], [ 10756, "ea" ], [ 10876, "ct" ], [ 10877, "ct" ], [ 10996, "de" ], [ 10997, "de" ], [ 11111, "se" ], [ 11112, "se" ], [ 11254, "pt" ], [ 11255, "pt" ], [ 11384, "WSc" ], [ 11385, "WSc" ], [ 11511, "m3" ], [ 11512, "m3" ], [ 11649, "le" ], [ 11650, "le" ], [ 11781, "Ob" ], [ 11782, "Ob" ], [ 11911, "tF" ], [ 11912, "tF" ], [ 12040, "se" ], [ 12041, "se" ], [ 12172, "ope" ], [ 12173, "ope" ], [ 12298, "us" ], [ 12299, "us" ], [ 12424, "rli" ], [ 12425, "rli" ], [ 12555, "do" ], [ 12556, "do" ], [ 12697, "em" ], [ 12698, "em" ], [ 12821, "cia" ], [ 12822, "cia" ], [ 12954, "et" ], [ 12955, "et" ], [ 13083, "DB." ], [ 13084, "DB." ], [ 13207, "ho" ], [ 13208, "ho" ], [ 13334, "in" ], [ 13335, "in" ], [ 13462, "w.s" ], [ 13463, "w.s" ], [ 13595, "ct" ], [ 13596, "ct" ], [ 13707, "ri" ], [ 13708, "ri" ], [ 13833, "Ob" ], [ 13834, "Ob" ], [ 13954, "Tem" ], [ 13955, "Tem" ], [ 14084, "rip" ], [ 14085, "rip" ], [ 14210, "st" ], [ 14211, "st" ], [ 14330, "htt" ], [ 14331, "htt" ], [ 14445, "e" ], [ 14446, "e" ], [ 14583, "TP" ], [ 14584, "TP" ], [ 14704, "Fi" ], [ 14705, "Fi" ], [ 14822, "ri" ], [ 14823, "ri" ], [ 14966, "Sc" ], [ 14967, "Sc" ], [ 15082, "St" ], [ 15083, "St" ], [ 15206, "pt" ], [ 15207, "pt" ], [ 15326, "rn" ], [ 15327, "rn" ], [ 15445, "Ful" ], [ 15446, "Ful" ], [ 15567, "s" ], [ 15568, "s" ], [ 15699, "je" ], [ 15700, "je" ], [ 15831, "je" ], [ 15832, "je" ], [ 15950, "at" ], [ 15951, "at" ], [ 16075, "le" ], [ 16076, "le" ], [ 16194, "Po" ], [ 16195, "Po" ], [ 16320, "n" ] ], "sz": 41158, "ts": [ { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170119_f47ea835414e2b0d12a9755067415fdf.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.800000011920929, "d": "JavaScript strings capped at five", "e": [ "strings.max_length = 4.00" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::js-max-string-length-short", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "from" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-benign-text--rx-10", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Quoted JSON IV field", "e": [ "\"iv\"" ], "i": "micro-behaviors/crypto/symmetric/aes/payload::quoted-iv-field", "l": 1, "m": "C0021.001" }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "from" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInNewContext--rx-9", "l": 1 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "home" ], "i": "objectives/evasion/masquerade/process/path::systemd-masquerade-reference--rx-9", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Decoded property function alias", "e": [ "var bzoxoxa5 = gibijevekalzidryqjeliwpipywasgahyggaxapmexnucgyckofejifzudahasgutqiwkoscakjexluwzuguzaqvorifihirumohj[0]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "identifiers.avg_length = 97.07" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 2583.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 1.0, "d": "cmd command name", "e": [ "cmd" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-name", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 200.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".X" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "from" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInContext--rx-4", "l": 1 }, { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "home" ], "i": "objectives/evasion/masquerade/process/path::systemd-masquerade-path--rx-5", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170119_f47ea835414e2b0d12a9755067415fdf.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Public IPv4 first octet list", "e": [ "[43," ], "i": "objectives/anti-static/obfuscation/encoding/ip-notation::int-octet-list", "l": 1, "m": "B0032" }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-analysis/timing/timer::js-newdate-then-eval--rx-5", "l": 1 }, { "c": 0.8799999952316284, "d": "Indirect bracketed WScript command invocation", "e": [ "ygikryjaxatofythumwacemigwikuloniqpujcipexifuwcuhaqnobxymsevpyvadozobejkixxyvvonukisacephejpizwovlugl[2]](ymuweclyrd, 0)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect", "l": 1 }, { "c": 0.800000011920929, "d": "ADODB.Stream string fragment (ADODB/ADO)", "e": [ "ADO" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-1", "l": 3 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "iwr" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.699999988079071, "d": "JavaScript new Function constructor", "e": [ "new Function(" ], "i": "micro-behaviors/process/interpreter/eval::js-new-function-constructor", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-14", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 8.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.03" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.75, "d": "JScript array index concatenation (URL obfuscation)", "e": [ "vughyxmujyljogxejabgevhicquhsitusferiwuzsuzeguhjipaqvipquhhebytosyzohxemhedurjiqsytvylfenelmubhylacsekweqanorvu[0] + mjohweveduz" ], "i": "objectives/anti-static/obfuscation/syntax::js-array-index-concatenation", "l": 4 }, { "a": "T1027", "c": 0.75, "d": "Large random variable names (obfuscation)", "e": [ "var yfagajapwemocijitzisasduhxugyvycjakoralantomuhbomysojsetofejuvemfiwomuhsiqtogliqoxesigolmexxiryhuczegyp" ], "i": "objectives/anti-static/obfuscation/string/array::large-random-variables", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate new Function invocation pattern", "e": [ "Function" ], "i": "micro-behaviors/data/source/dynamic/eval::new-function-iife", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Many random-looking source identifier names", "e": [ "identifiers.high_entropy_ratio = 0.91" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.8999999761581421, "d": "Exact tiny XMLHTTP fragments (XMLH, XML2., MS)", "e": [ "MS" ], "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-exact", "l": 1 }, { "c": 0.8399999737739563, "d": "JavaScript unusually long average lines", "e": [ "text.avg_line_length = 204.79" ], "i": "objectives/anti-static/obfuscation/string/anomaly::javascript-line-bloat", "l": 4 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "c": 0.9300000071525574, "d": "Nemucod short token cap", "e": [ "strings.max_length = 4.00" ], "i": "well-known/malware/dropper/nemucod::short-token-array-cap", "l": 1 }, { "c": 0.8999999761581421, "d": "Exact tiny readyState fragments (rea, dy, tate)", "e": [ "dy" ], "i": "objectives/execution/interpreter/script/wsh-fragments::readystate-fragment-tiny-exact", "l": 4 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate invocation of new Function", "e": [ "Function" ], "i": "objectives/anti-static/obfuscation/eval/function::suspicious-new-function-iife", "l": 4, "m": "B0032" } ], "sha": "34641ab2d5a5d84bcdbe1c8d6c87effc2a2a154627f81fdc0c8702d4363e37d2", "path": "20170119_f47ea835414e2b0d12a9755067415fdf.js", "type": "javascript" } ], "tv": "ac09c" } }