{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.9973869, "class": 1 }, { "m": "az/scripts", "prob": 0.9942857, "class": 0 }, { "m": "az/javascript", "prob": 1.0, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T16:38:31Z" }, "path": "VirusShare_e0e79ac8139ac822b9a89d54f424aed3", "raw": { "v": "4", "fs": [ { "f": "O(C)H₂(CmOs)", "k": { "source.imports[0]": "Date.now", "source.imports[1]": "escape", "source.imports[2]": "script", "source.strings[0]": "\n\u003chtml\u003e\u003chead\u003e\r\n\r\n\u003clink rel=", "source.strings[1]": "#8B8B8B", "source.strings[2]": "#B22769", "source.strings[3]": "../index.html", "source.strings[4]": "../zakaz2.htm", "source.strings[5]": "//counter.yadro.ru/hit;narodadst1?r", "source.strings[6]": "//psbatishev.narod.ru/.s/src/jquery-3.3.1.min.js", "source.strings[7]": "//s207.ucoz.net/cgi/uutils.fcg?a=uSD\u0026ca=2\u0026ug=999\u0026isp=0\u0026r=0.84564163632006\"\u003e\u003c/script\u003e\n\u003chtml\u003e\u003chead\u003e\r\n\r\n\u003clink rel=", "source.strings[8]": "/?p1CITZp4xX%5E%3BG5KM7%3Bqd%21D5cM9%21c%5E0NyPqrrXAJQ12s1ZDE7sD8Deb8PZVGHy6eZLvVZqtEgeu44%5ERcXGtHSUYt9nsWaITQ%5EMwi%3Bn2brJxXhlAgpeV%21mESful3U6rWqJHEamQ5QSwnRZUdz8Vr2KHmljRSw49suIX8Hm2yvgaI4qeZbepJqcM46WOT2Qvewwb%3B7NMhF5UFTEX3wMRCK49pT%21d9uIYKy%219%3BFuASh9NQ4h9mY6ChylBs2WYfNtxWZfS1pt4IMq4goo", "source.strings[9]": "01735.htm", "source.has_imports": true, "source.strings[10]": "01736.htm#_t34909", "source.strings[11]": "01737.htm", "source.strings[12]": "02075.htm#_t41734", "source.strings[13]": "203.js", "source.strings[14]": "\u003cscript type=\"text/javascript\" src=\"/?p1CITZp4xX^;G5KM7;qd!D5cM9!c^0NyPqrrXAJQ12s1ZDE7sD8Deb8PZVGHy6eZLvVZqtEgeu44^RcXGtHSUYt9nsWaITQ^Mwi;n2brJxXhlAgpeV!mESful3U6rWqJHEamQ5QSwnRZUdz8Vr2KHmljRSw49suIX8Hm2yvgaI4qeZbepJqcM46WOT2Qvewwb;7NMhF5UFTEX3wMRCK49pT!d9uIYKy!9;FuASh9NQ4h9mY6ChylBs2WYfNtxWZfS1pt4IMq4goo\"\u003e\u003c/script\u003e", "source.strings[15]": "JavaScript", "source.strings[16]": "JavaScript1.1", "source.strings[17]": "JavaScript1.2", "source.strings[18]": "JavaScript1.3", "source.strings[19]": "_blank", "source.strings[20]": "_t34907", "source.strings[21]": "_t34908", "source.strings[22]": "_t34909", "source.strings[23]": "_t34910", "source.strings[24]": "_t34911", "source.strings[25]": "_t34912", "source.strings[26]": "_t34913", "source.strings[27]": "_t34914", "source.strings[28]": "_t34915", "source.strings[29]": "_t34916", "source.strings[30]": "_t34917", "source.strings[31]": "_t34918", "source.strings[32]": "_t34919", "source.strings[33]": "_t34920", "source.strings[34]": "_t34921", "source.strings[35]": "_t34922", "source.strings[36]": "_t34923", "source.strings[37]": "_t34924", "source.strings[38]": "_t34925", "source.strings[39]": "_t34926", "source.strings[40]": "cntPNG=13", "source.strings[41]": "cpr.js", "source.strings[42]": "cpr2.js", "source.strings[43]": "http://counter.rambler.ru/top100.cnt?465168", "source.strings[44]": "http://top.list.ru/counter?js=na;id=570524", "source.strings[45]": "http://top100.rambler.ru/top100/", "source.strings[46]": "http://top100.vkirove.ru/cnt.php?id=1459", "source.strings[47]": "http://top100.vkirove.ru/cnt.php?id=1459\u0026amp;cntPNG=13", "source.strings[48]": "http://top100.vkirove.ru/loadcnt.php?id=1459", "source.strings[49]": "http://top100.vkirove.ru/loadcnt.php?id=1459\u0026amp;cntPNG=13", "source.strings[50]": "http://www.net.kirov.ru/catalog/rating?1459", "source.strings[51]": "im1.jpg", "source.strings[52]": "index.htm", "source.strings[53]": "javascript", "source.strings[54]": "k0354.htm", "source.strings[55]": "k0354.htm#_t34907", "source.strings[56]": "k0354.htm#_t34908", "source.strings[57]": "k0355.htm#_t34909", "source.strings[58]": "k0355.htm#_t34910", "source.strings[59]": "k0355.htm#_t34911", "source.strings[60]": "k0355.htm#_t34912", "source.strings[61]": "k0355.htm#_t34913", "source.strings[62]": "k0355.htm#_t34914", "source.strings[63]": "k0355.htm#_t34915", "source.strings[64]": "k0355.htm#_t34916", "source.strings[65]": "k0355.htm#_t34917", "source.strings[66]": "k0355.htm#_t34918", "source.strings[67]": "k0355.htm#_t34919", "source.strings[68]": "k0355.htm#_t34920", "source.strings[69]": "k0355.htm#_t34921", "source.strings[70]": "k0355.htm#_t34922", "source.strings[71]": "k0355.htm#_t34923", "source.strings[72]": "k0355.htm#_t34924", "source.strings[73]": "k0355.htm#_t34925", "source.strings[74]": "k0355.htm#_t34926", "source.strings[75]": "margin-top:0", "source.strings[76]": "nvn.js", "source.strings[77]": "prt.js", "source.strings[78]": "r5.gif", "source.strings[79]": "rel.js", "source.strings[80]": "sl.gif", "source.strings[81]": "sr.gif", "source.strings[82]": "style.css", "source.strings[83]": "text/css", "source.strings[84]": "text/javascript", "source.strings[85]": "Вятка-на-Сети: Каталог ресурсов", "source.strings[86]": "Главная страница сайта", "source.strings[87]": "Главная страница энциклопедии", "source.strings[88]": "Далее", "source.strings[89]": "На предыдущую страницу", "source.strings[90]": "На следующую страницу", "source.strings[91]": "Назад", "source.strings[92]": "Термины с буквы - Л (рус.)", "source.strings[93]": "Энциклопедический словарь", "source.strings[94]": "Энциклопедический словарь можно купить на диске...", "source.strings[95]": "Энциклопедический словарь: 75000 слов.", "source.strings[96]": "энциклопедия, толковый словарь, локарно (locarno), локарнская конференция 1925, локарнские договоры 1925, локатор, локаут (англ. lock out, буквально - запирать дверь перед кем-либо), локация звуковая, локаята (чарвака), локи, локк (locke) джон (1632-1704), локк (locke) джон (29 августа 1632, рингтон - 28 октября 1704, отс), локкарта заговор 1918 (заговор трех послов), локомобиль (франц. locomobile, от лат. locus - место и mobilis - подвижной), локомотив (франц. locomotive, от лат. loco moveo - сдвигаю с места), локомотив, локомотивная сигнализация, локомоции (от лат. locus - место и motio - движение), локоть, локрийский лад, локсодромия (локсодрома) (от греч. loxos - косой и dromos - бег, путь), локтев лев абрамович (1908-81)" }, "x": 37, "id": 0, "is": [ "script", "escape", "escape", "Date.now", "escape", "Date.now" ], "ms": { "file": { "size": 29589.0 }, "text": { "tab_count": 3.0, "digit_ratio": 0.2, "space_count": 1866.0, "total_lines": 91.0, "char_entropy": 5.03, "unique_chars": 150.0, "import_density": 6.59, "lines_over_200": 9.0, "lines_over_500": 3.0, "string_density": 3.49, "avg_line_length": 323.21, "high_byte_ratio": 0.71, "lines_over_1000": 3.0, "max_line_length": 22329.0, "non_ascii_ratio": 0.71, "empty_line_ratio": 0.16, "last_line_length": 7.0, "long_token_count": 3.0, "most_common_char": "Ð", "whitespace_ratio": 0.07, "most_common_ratio": 0.26, "identifier_density": 2.85, "line_length_stddev": 2326.57, "encoded_string_ratio": 0.01, "normalized_import_count": 0.63, "normalized_string_count": 33.34, "suspicious_comment_ratio": 0.67, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 3.0, "suspicious_identifier_ratio": 0.16, "normalized_unique_identifiers": 4.76 }, "imports": { "total": 6.0, "unique_modules": 3.0, "third_party_count": 6.0, "third_party_ratio": 1.0 }, "strings": { "total": 318.0, "url_count": 12.0, "avg_length": 22.39, "max_length": 1169.0, "path_count": 6.0, "avg_entropy": 2.58, "total_bytes": 7120.0, "entropy_stddev": 1.26, "very_long_strings": 2.0, "high_entropy_count": 3.0, "url_encoded_strings": 2.0 }, "comments": { "chars": 194.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.03, "base64_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": {}, "identifiers": { "total": 259.0, "avg_length": 3.68, "max_length": 8.0, "min_length": 1.0, "avg_entropy": 1.61, "reuse_ratio": 0.12, "unique_count": 31.0, "length_stddev": 1.94, "has_digit_ratio": 0.03, "sequential_names": 5.0, "single_char_count": 4.0, "single_char_ratio": 0.13, "all_lowercase_ratio": 0.74, "all_uppercase_ratio": 0.16, "numeric_suffix_count": 1.0 } }, "ss": [ [ 13, "text/javascript" ], [ 14, "text/javascript" ], [ 35, "/?p1CITZp4xX%5E%3BG5KM7%3Bqd%21D5cM9%21c%5E0NyPqrrXAJQ12s1ZDE7sD8Deb8PZVGHy6eZLvVZqtEgeu44%5ERcXGtHSUYt9nsWaITQ%5EMwi%3Bn2brJxXh" ], [ 36, "/?p1CITZp4xX%5E%3BG5KM7%3Bqd%21D5cM9%21c%5E0NyPqrrXAJQ12s1ZDE7sD8Deb8PZVGHy6eZLvVZqtEgeu44%5ERcXGtHSUYt9nsWaITQ%5EMwi%3Bn2brJxXh" ], [ 360, "text/javascript" ], [ 361, "text/javascript" ], [ 396, "//counter.yadro.ru/hit;narodadst1?r" ], [ 397, "//counter.yadro.ru/hit;narodadst1?r" ], [ 469, ";s" ], [ 470, ";s" ], [ 487, "*" ], [ 488, "*" ], [ 505, "*" ], [ 506, "*" ], [ 549, ";u" ], [ 550, ";u" ], [ 575, ";" ], [ 576, ";" ], [ 614, "text/javascript" ], [ 615, "text/javascript" ], [ 729, ";s" ], [ 730, ";s" ], [ 747, "*" ], [ 748, "*" ], [ 765, "*" ], [ 766, "*" ], [ 809, ";u" ], [ 810, ";u" ], [ 835, ";" ], [ 836, ";" ], [ 872, "text/javascript" ], [ 873, "text/javascript" ], [ 894, "//psbatishev.narod.ru/.s/src/jquery-3.3.1.min.js" ], [ 895, "//psbatishev.narod.ru/.s/src/jquery-3.3.1.min.js" ], [ 967, "text/javascript" ], [ 968, "text/javascript" ], [ 989, "//s207.ucoz.net/cgi/uutils.fcg?a=uSD\u0026ca=2\u0026ug=999\u0026isp=0\u0026r=0.84564163632006\"\u003e\u003c/script\u003e\n\u003chtml\u003e\u003chead\u003e\r\n\r\n\u003clink rel=" ], [ 1074, "\n\u003chtml\u003e\u003chead\u003e\r\n\r\n\u003clink rel=" ], [ 1119, "text/css" ], [ 1120, "text/css" ], [ 1135, "style.css" ], [ 1136, "style.css" ], [ 2308, "энциклопедия, толковый словарь, локарно (locarno), локарнская конференция" ], [ 2309, "энциклопедия, толковый словарь, локарно (locarno), локарнская конференция" ], [ 3513, "Энциклопедический словарь: 75000 слов." ], [ 3514, "Энциклопедический словарь: 75000 слов." ], [ 3609, "_top" ], [ 3610, "_top" ], [ 3639, "JavaScript" ], [ 3640, "JavaScript" ], [ 3656, "prt.js" ], [ 3657, "prt.js" ], [ 3690, "0" ], [ 3691, "0" ], [ 3700, "100%" ], [ 3701, "100%" ], [ 3719, "0" ], [ 3720, "0" ], [ 3735, "0" ], [ 3736, "0" ], [ 3747, "#8B8B8B" ], [ 3748, "#8B8B8B" ], [ 3773, "303" ], [ 3774, "303" ], [ 3796, "index.htm" ], [ 3797, "index.htm" ], [ 3817, "Энциклопедический словарь" ], [ 3818, "Энциклопедический словарь" ], [ 3876, "0" ], [ 3877, "0" ], [ 3884, "im1.jpg" ], [ 3885, "im1.jpg" ], [ 3900, "309" ], [ 3901, "309" ], [ 3913, "80" ], [ 3914, "80" ], [ 3946, "30" ], [ 3947, "30" ], [ 3988, "JavaScript" ], [ 3989, "JavaScript" ], [ 4005, "k.js" ], [ 4006, "k.js" ], [ 4051, "JavaScript" ], [ 4052, "JavaScript" ], [ 4068, "m3.js" ], [ 4069, "m3.js" ], [ 4102, "JavaScript1.1" ], [ 4103, "JavaScript1.1" ], [ 4194, "JavaScript1.2" ], [ 4195, "JavaScript1.2" ], [ 4214, "m2.js" ], [ 4215, "m2.js" ], [ 4248, "JavaScript1.3" ], [ 4249, "JavaScript1.3" ], [ 4306, "JavaScript" ], [ 4307, "JavaScript" ], [ 4323, "m.js" ], [ 4324, "m.js" ], [ 4359, "http://top.list.ru/counter?js=na;id=570524" ], [ 4360, "http://top.list.ru/counter?js=na;id=570524" ], [ 4457, "JavaScript" ], [ 4458, "JavaScript" ], [ 4528, "http://top100.rambler.ru/top100/" ], [ 4529, "http://top100.rambler.ru/top100/" ], [ 4574, "http://counter.rambler.ru/top100.cnt?465168" ], [ 4575, "http://counter.rambler.ru/top100.cnt?465168" ], [ 4709, "100%" ], [ 4710, "100%" ], [ 4728, "0" ], [ 4729, "0" ], [ 4744, "0" ], [ 4745, "0" ], [ 4756, "#B22769" ], [ 4757, "#B22769" ], [ 4782, "9" ], [ 4783, "9" ], [ 4835, "sm" ], [ 4836, "sm" ], [ 4874, "n.js" ], [ 4875, "n.js" ], [ 4941, "ya.js" ], [ 4942, "ya.js" ], [ 4970, "9" ], [ 4971, "9" ], [ 5053, "100%" ], [ 5054, "100%" ], [ 5124, "12%" ], [ 5125, "12%" ], [ 5154, "k0354.htm" ], [ 5155, "k0354.htm" ], [ 5183, "Термины с буквы - Л (рус.)" ], [ 5184, "Термины с буквы - Л (рус.)" ], [ 5266, "margin-top:0" ], [ 5267, "margin-top:0" ], [ 5290, "Назад" ], [ 5291, "Назад" ], [ 5308, "01735.htm" ], [ 5309, "01735.htm" ], [ 5332, "0" ], [ 5333, "0" ], [ 5340, "sl.gif" ], [ 5341, "sl.gif" ], [ 5363, "Далее" ], [ 5364, "Далее" ], [ 5381, "01737.htm" ], [ 5382, "01737.htm" ], [ 5405, "0" ], [ 5406, "0" ], [ 5413, "sr.gif" ], [ 5414, "sr.gif" ], [ 5479, "JavaScript" ], [ 5480, "JavaScript" ], [ 5496, "1.js" ], [ 5497, "1.js" ], [ 5541, "JavaScript" ], [ 5542, "JavaScript" ], [ 5558, "2.js" ], [ 5559, "2.js" ], [ 5615, "71%" ], [ 5616, "71%" ], [ 5643, "Главная страница сайта" ], [ 5644, "Главная страница сайта" ], [ 5693, "../index.html" ], [ 5694, "../index.html" ], [ 5744, "Главная страница энциклопедии" ], [ 5745, "Главная страница энциклопедии" ], [ 5808, "index.htm" ], [ 5809, "index.htm" ], [ 5864, "k0354.htm" ], [ 5865, "k0354.htm" ], [ 5882, "Термины с буквы - Л (рус.)" ], [ 5883, "Термины с буквы - Л (рус.)" ], [ 6007, "JavaScript" ], [ 6008, "JavaScript" ], [ 6024, "203.js" ], [ 6025, "203.js" ], [ 6054, "k0354.htm#_t34907" ], [ 6055, "k0354.htm#_t34907" ], [ 6079, "_t34907" ], [ 6080, "_t34907" ], [ 6592, "k0354.htm#_t34908" ], [ 6593, "k0354.htm#_t34908" ], [ 6617, "_t34908" ], [ 6618, "_t34908" ], [ 6707, "01736.htm#_t34909" ], [ 6708, "01736.htm#_t34909" ], [ 6786, "k0355.htm#_t34909" ], [ 6787, "k0355.htm#_t34909" ], [ 6811, "_t34909" ], [ 6812, "_t34909" ], [ 8042, "../zakaz2.htm" ], [ 8043, "../zakaz2.htm" ], [ 8067, "r5.gif" ], [ 8068, "r5.gif" ], [ 8082, "468" ], [ 8083, "468" ], [ 8095, "60" ], [ 8096, "60" ], [ 8104, "Энциклопедический словарь можно купить на диске..." ], [ 8105, "Энциклопедический словарь можно купить на диске..." ], [ 8223, "k0355.htm#_t34910" ], [ 8224, "k0355.htm#_t34910" ], [ 8248, "_t34910" ], [ 8249, "_t34910" ], [ 8602, "k0355.htm#_t34911" ], [ 8603, "k0355.htm#_t34911" ], [ 8627, "_t34911" ], [ 8628, "_t34911" ], [ 9028, "k0355.htm#_t34912" ], [ 9029, "k0355.htm#_t34912" ], [ 9053, "_t34912" ], [ 9054, "_t34912" ], [ 9523, "k0355.htm#_t34913" ], [ 9524, "k0355.htm#_t34913" ], [ 9548, "_t34913" ], [ 9549, "_t34913" ], [ 10385, "k0355.htm#_t34914" ], [ 10386, "k0355.htm#_t34914" ], [ 10410, "_t34914" ], [ 10411, "_t34914" ], [ 10938, "k0355.htm#_t34915" ], [ 10939, "k0355.htm#_t34915" ], [ 10963, "_t34915" ], [ 10964, "_t34915" ], [ 11999, "k0355.htm#_t34916" ], [ 12000, "k0355.htm#_t34916" ], [ 12024, "_t34916" ], [ 12025, "_t34916" ], [ 23330, "k0355.htm#_t34917" ], [ 23331, "k0355.htm#_t34917" ], [ 23355, "_t34917" ], [ 23356, "_t34917" ], [ 23920, "k0355.htm#_t34918" ], [ 23921, "k0355.htm#_t34918" ], [ 23945, "_t34918" ], [ 23946, "_t34918" ], [ 24438, "k0355.htm#_t34919" ], [ 24439, "k0355.htm#_t34919" ], [ 24463, "_t34919" ], [ 24464, "_t34919" ], [ 25033, "k0355.htm#_t34920" ], [ 25034, "k0355.htm#_t34920" ], [ 25058, "_t34920" ], [ 25059, "_t34920" ], [ 25501, "k0355.htm#_t34921" ], [ 25502, "k0355.htm#_t34921" ], [ 25526, "_t34921" ], [ 25527, "_t34921" ], [ 26056, "k0355.htm#_t34922" ], [ 26057, "k0355.htm#_t34922" ], [ 26081, "_t34922" ], [ 26082, "_t34922" ], [ 26656, "k0355.htm#_t34923" ], [ 26657, "k0355.htm#_t34923" ], [ 26681, "_t34923" ], [ 26682, "_t34923" ] ], "sz": 29589, "ts": [ { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://top100.vkirove.ru/loadcnt.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 1.0, "d": "DOM or CSS size property", "e": [ "width" ], "i": "micro-behaviors/ui/window/manage/dom::size-prop", "l": 1 }, { "c": 1.0, "d": "Regex component marker", "e": [ "\u003ctitle\u003e" ], "i": "well-known/malware/stealer/needle::needle-panel-marker--rx-5", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 91.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.800000011920929, "d": "URL path fragment 'unte' (part of /counter/)", "e": [ "/counter?" ], "i": "objectives/command-and-control/channel/http/uri::uri-fragment-counter-path-unte", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "URL targets .php endpoint", "e": [ "http://top100.vkirove.ru/loadcnt.php?", "http://top100.vkirove.ru/cnt.php?" ], "i": "micro-behaviors/communications/http/url/php-endpoint::url-php-endpoint-script", "l": 3, "m": "C0002" }, { "a": "T1528", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "html" ], "i": "objectives/credential-access/cloud/token::oauth-redirect-with-target-email--rx-10", "l": 1 }, { "a": "T1082", "c": 0.75, "d": "Reads browser screen dimensions", "e": [ "screen.height" ], "i": "micro-behaviors/os/sysinfo/platform/browser::browser-screen-dimensions-read", "l": 3 }, { "a": "T1027", "d": "International script character obfuscation", "e": [ "Д", "Г", "э", "Э", "Т", "Н" ], "i": "objectives/anti-static/obfuscation/steganography/unicode::international-script-obfuscation", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 22329.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1204.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "enable" ], "i": "objectives/execution/lure/video-meeting::meeting-device-permission-lure--rx-5", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cscript type=\"text/javascript\" src=\"/?p1CITZp4xX^;G5KM7;qd!D5cM9!c^0NyPqrrXAJQ12s1ZDE7sD8Deb8PZVGHy6..." ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 1.0, "d": "\u003cident\u003e = \u003cident\u003e; plain JS/TS assignment (suppressor)", "e": [ "js=na;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "URL targets .php with query", "e": [ "http://top100.vkirove.ru/cnt.php?", "http://top100.vkirove.ru/loadcnt.php?" ], "i": "micro-behaviors/communications/http/url/php-endpoint::url-php-query-script", "l": 4, "m": "C0002" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "Hardcoded .ru domain", "e": [ "\"http://top.list.ru/" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::hardcoded-domain-ru", "l": 3, "m": "C0002" }, { "c": 0.8399999737739563, "d": "Hidden directory path literal", "e": [ "/.s/" ], "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "l": 1 }, { "c": 1.0, "d": "Known JavaScript library source", "e": [ "jquery" ], "i": "objectives/anti-static/obfuscation/string/encoding::mathjax-or-jquery", "l": 1 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Date.now" ], "i": "objectives/anti-analysis/timing/jitter::js-date-diff-jitter-pattern--rx-2", "l": 1 }, { "a": "T1059", "c": 0.75, "d": "Regex component marker", "e": [ "10." ], "i": "objectives/command-and-control/reverse-shell/socket::rfc1918-host-string--rx-1", "l": 1 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Kiro IDE config directory (.kiro)", "e": [ ".kiro" ], "i": "objectives/supply-chain/trojanized/app/config-injection::kiro-dir", "l": 1 }, { "c": 1.0, "d": "Regex component marker", "e": [ "\u003c/title\u003e" ], "i": "well-known/malware/stealer/needle::needle-panel-marker--rx-4", "l": 1 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 3.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Low identifier reuse ratio", "e": [ "identifiers.reuse_ratio = 0.12" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::low-identifier-reuse", "l": 2, "m": "B0032" }, { "c": 0.6000000238418579, "d": "High non-ASCII character ratio (junk padding)", "e": [ "text.non_ascii_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/code-metrics/source::high-non-ascii-ratio", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 20k character line", "e": [ "text.max_line_length = 22329.00" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::max-line-length-20000", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Single-line packed JavaScript loader profile", "e": [ "text.max_line_length = 22329.00" ], "i": "objectives/supply-chain/hidden-payload/trojan::single-line-packed-loader-metrics", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Dense Cyrillic character strings in non-Cyrillic context", "e": [ "Далее", "Назад", "энциклопедия", "Главная", "Термины", "Энциклопедический" ], "i": "objectives/anti-static/obfuscation/string/junking::dense-cyrillic-literals", "l": 3 }, { "a": "T1027", "c": 0.6000000238418579, "d": "Junk arithmetic producing small integers (pattern 1)", "e": [ "(1632-1704)" ], "i": "objectives/anti-static/obfuscation/string/conceal::js-junk-math-1", "l": 3, "m": "B0032" }, { "a": "T1071", "c": 0.75, "d": "URL ending in PHP endpoint", "e": [ "http://top100.vkirove.ru/loadcnt.php?" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::php-url", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.07" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" } ], "sha": "3ab76025ebfec2390b2c360c63803e8750d01985689a17a99f4dd8d771dbbd99", "path": "VirusShare_e0e79ac8139ac822b9a89d54f424aed3", "type": "javascript" } ], "tv": "85efb" } }