{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9181916,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.852459,
        "class": 0
      },
      {
        "m": "az/batch",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-17T12:18:43Z"
  },
  "path": "3865914c1eeb6da9fcbb4f99edfa64bdddbe859f6cc40edfb7f1b77cd6660bbd.bat",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(AsC)",
        "x": 73,
        "id": 0,
        "ms": {
          "file": {
            "size": 406825.0
          },
          "text": {
            "digit_ratio": 0.16,
            "space_count": 29.0,
            "total_lines": 23.0,
            "char_entropy": 5.77,
            "unique_chars": 82.0,
            "lines_over_200": 3.0,
            "lines_over_500": 3.0,
            "avg_line_length": 17686.22,
            "lines_over_1000": 2.0,
            "max_line_length": 402676.0,
            "empty_line_ratio": 0.04,
            "last_line_length": 402676.0,
            "long_token_count": 6.0,
            "most_common_char": "Z",
            "whitespace_ratio": 0.0,
            "most_common_ratio": 0.04,
            "line_length_stddev": 82082.59,
            "max_inline_whitespace_run": 1.0
          }
        },
        "ss": [
          [
            13,
            "Set WmGVOJjmIYHhkhTi=AUHXlzK"
          ],
          [
            43,
            "Set KDTLmNfBKUKNxtq=PQiFvEn"
          ],
          [
            72,
            "Set jPGAXgu=BeMquRY"
          ],
          [
            93,
            "Set YfQGHIOv=CLfaSZD"
          ],
          [
            115,
            "Set zbtkbjYaUDoY=TOcbwgx"
          ],
          [
            141,
            "Set KfRZBRNhLeIH=dopGrNW"
          ],
          [
            167,
            "Set GxZtCGPoyRwXIfha=sjhVJIm"
          ],
          [
            197,
            "Set cGnzU=kty"
          ],
          [
            212,
            "base64",
            "ͻdn6\u001aP:\u0018"
          ],
          [
            761,
            "set \"TlWHi=%~f0\""
          ],
          [
            779,
            "Set ZmOObvpxervhpQQ=OULwtZK"
          ],
          [
            808,
            "Set aHHFFBEk=hFolXaT"
          ],
          [
            830,
            "Set cinvoBHwlOZFLqUjok=kWfiuvJ"
          ],
          [
            862,
            "Set wsyqDI=QmPrGjM"
          ],
          [
            882,
            "Set dcmbXidVzMCBpq=VHRNByD"
          ],
          [
            910,
            "Set kDCqGORnWQRzoAdsj=xncIgse"
          ],
          [
            941,
            "Set JYfKKqrbqqHgnuOIH=YSCdAzq"
          ],
          [
            972,
            "Set nNBQLpPKGipVVUTNgSI=bEp"
          ],
          [
            1001,
            "%kDCqGORnWQRzoAdsj:~2,1%%wsyqDI:~6,1%%JYfKKqrbqqHgnuOIH:~3,1%.%kDCqGORnWQRzoAdsj:~6,1%%aHHFFBEk:~4,1%%nNBQLpPKGipVVUTNgSI:~1,1% "
          ],
          [
            4144,
            "exit"
          ],
          [
            4149,
            "DQokYkJKb3ZvVXEgPSAiSDRzSUFBQUFBQUFFQU15OVMzUGJXck1sT08rSS9nOFZIVDNqZ0xjUFpSRWE5RUFTTFJJdmtiWmNkU1hOU0ZnRUFab2dDWmlReUYvZnlNeVZH"
          ]
        ],
        "sz": 406825,
        "ts": [
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8600000143051147,
            "d": "Batch has near-zero whitespace",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-near-zero-whitespace",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive download tool marker",
            "e": [
              "IwR"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Batch path stashed in env",
            "e": [
              "set \"TlWHi=%~f0\""
            ],
            "i": "objectives/command-and-control/dropper/execution/script::batch-self-path-env-stash",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 402676.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Batch unusually low whitespace density",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density",
            "l": 4
          },
          {
            "c": 1.0,
            "d": "echo off batch command",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/builder::echo-off-batch",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 402676.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "Echo off",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::echo-off",
            "l": 1
          },
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8999999761581421,
            "d": "Batch has long encoded token",
            "e": [
              "text.long_token_count = 6.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Batch contains VBScript Set assignment",
            "e": [
              "Set WmGVOJjmIYHhkhTi="
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::batch-vbscript-set-literal",
            "l": 4
          },
          {
            "c": 0.949999988079071,
            "d": "Batch extreme line-length bloat",
            "e": [
              "text.avg_line_length = 17686.22"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-extreme-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.77"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          }
        ],
        "sha": "3865914c1eeb6da9fcbb4f99edfa64bdddbe859f6cc40edfb7f1b77cd6660bbd",
        "path": "3865914c1eeb6da9fcbb4f99edfa64bdddbe859f6cc40edfb7f1b77cd6660bbd.bat",
        "type": "batch"
      }
    ],
    "tv": "529a0"
  }
}