{ "llm": { "conf": 0.99665, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 25, "prob": 0.995, "class": "hostile" }, "outcome": "hostile", "interpretation": "WMI hidden process, obfuscated payload" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": 12, "conf": 93, "mods": [ { "cls": 1, "raw": 0.9993891, "rte": "az", "prob": 0.9993891 } ], "prob": 0.995, "files": [ { "id": 0, "lvl": 12, "conf": 93, "prob": 0.9950000047683716, "type": "rar" }, { "id": 1, "lvl": 25, "conf": 92, "prob": 0.9950000047683716, "type": "javascript" } ], "version": "v18.18", "analyzed_at": "2026-09-27T17:57:36Z" }, "path": "virussign.com_13fd4fe2eaf4b64d46722777db277ff0.vir", "raw": { "files": [ { "id": 0, "mol": "O₆(PXeAs₃CErI)H₄(Os₃Po₆Db₃F₅)Md₂(Pa)", "sha": "45aaa9fa16af00ae8e40435dfeb7e4840196feb6f2ac528d352250f50bf1802e", "path": "virussign.com_13fd4fe2eaf4b64d46722777db277ff0.vir", "risk": 370, "size": 123962, "type": "rar", "facts": { "metrics": { "rar": { "solid": 0, "locked": 0, "volume": 0, "recovery": 0, "acl_count": 0, "quick_open": 1, "end_present": 1, "split_count": 0, "blake2_count": 0, "quick_open_size": 78, "encrypted_header": 0, "ntfs_stream_count": 0, "child_header_count": 0, "file_version_count": 0, "unknown_extra_count": 0, "service_header_count": 1, "unknown_header_count": 0, "v1_compression_count": 0, "mapped_unix_name_count": 0, "header_crc_mismatch_count": 0 }, "file": { "size": 123962, "entropy": 7.92 }, "binary": { "peak_region_bytes": 122880, "peak_region_entropy": 7.8 }, "archive": { "file_count": 1, "member_count": 1, "prefix_bytes": 0, "script_count": 1, "trailing_bytes": 0, "zip_bomb_ratio": 43.25, "compressed_size": 123764, "directory_count": 0, "executable_count": 0, "extra_field_size": 18, "noise_file_count": 0, "compression.ratio": 0.02, "hidden_file_count": 0, "uncompressed_size": 5352390, "max_filename_length": 29, "rtlo_filename_count": 0, "nested_archive_count": 0, "path_traversal_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 1, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 1, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.rar-normal": 1 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.archive_as_unknown": 1 } } }, "traits": [ { "id": "micro-behaviors/fs/file/copy::fso-copyfile", "conf": 0.9, "crit": 3, "desc": "Copy file via FileSystemObject", "from": [ { "file": 1 } ], "uses": [ 15, 51, 54 ] }, { "id": "micro-behaviors/os/com/automation::wscript-shell-literal", "conf": 0.8, "crit": 3, "desc": "References the WScript.Shell COM object", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/read/self::script-fullname-reference", "conf": 0.95, "crit": 3, "desc": "References the current WSH script path", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/com/automation::wscript-shell-activex-constructor", "conf": 0.94, "crit": 3, "desc": "ActiveXObject instantiates WScript.Shell", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/read::wsh-environment-object", "conf": 0.95, "crit": 3, "desc": "WSH Environment object retrieval", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/steganography/unicode::js-unicode-delimited-base64-fragment", "mbc": "B0032", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited Base64 decoder fragment", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/infect/script::wsh-fso-file-exists-guard", "atk": "T1080", "conf": 0.85, "crit": 3, "desc": "WSH FileSystemObject checks target existence", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/check::fso-file-exists", "conf": 0.92, "crit": 3, "desc": "FileSystemObject checks whether a path exists", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/location::wsh-startup-folder-lookup", "conf": 0.92, "crit": 3, "desc": "WSH resolves the Startup folder", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/read::wsh-environment-method-text", "conf": 0.9, "crit": 3, "desc": "Calls the WSH Environment method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-command", "atk": "T1059.001", "conf": 0.96, "crit": 3, "desc": "Unicode-delimited PowerShell command", "from": [ { "off": 4980988, "file": 1, "line": 88 } ], "uses": [ 13, 17, 33 ] }, { "id": "objectives/execution/wmi::process-startup-create-variable", "atk": "T1047", "mbc": "E1043", "conf": 0.9, "crit": 3, "desc": "WMI startup object creates a process", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-tail", "atk": "T1059.001", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited PowerShell ell fragment", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/com/automation::filesystemobject-constructor", "conf": 0.94, "crit": 3, "desc": "WSH instantiates FileSystemObject", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/com/automation::filesystemobject-progid", "conf": 0.85, "crit": 3, "desc": "FileSystemObject ProgID string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/flags::show-window-hidden-assignment", "conf": 0.88, "crit": 3, "desc": "Assigns hidden ShowWindow value", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-suffix", "atk": "T1059.001", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited PowerShell she fragment", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/steganography/unicode::js-unicode-delimited-appdomain-fragment", "mbc": "B0032", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited AppDomain token fragment", "from": [ { "file": 1 } ] }, { "id": "metadata/file/data-blob::high-byte-script-text", "conf": 0.88, "crit": 3, "desc": "High-byte script text (\u003e=12%)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/wmi/query::wmi-process-startup-instance", "atk": "T1047", "conf": 0.94, "crit": 3, "desc": "WMI process-startup object instance", "from": [ { "file": 1 } ] }, { "id": "metadata/build/minifier::js-large-minified-bundle", "conf": 0.92, "crit": 2, "desc": "Large minified JavaScript bundle", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/steganography/unicode::unicode-delimited-managed-loader-tokens", "atk": "T1027.002,T1140,T1620", "mbc": "B0032", "conf": 0.98, "crit": 4, "desc": "Unicode delimiters split managed payload-loader API tokens", "from": [ { "off": 7042717, "file": 1, "line": 141 } ], "uses": [ 5, 18, 19 ] }, { "id": "objectives/execution/wmi::js-spawninstance-hidden-window", "atk": "T1047", "mbc": "E1043", "conf": 0.96, "crit": 3, "desc": "WMI SpawnInstance followed by hidden window", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/infect/script::wsh-script-full-name", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "WSH script references its own full path", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/wsh::wsh-run-hidden-window-text", "atk": "T1564.003", "conf": 0.94, "crit": 3, "desc": "WSH Run call uses hidden-window arguments", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/wmi/query::wmi-hidden-process-startup", "atk": "T1564.003,T1047", "conf": 0.96, "crit": 4, "desc": "WMI process startup instance hides its window", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/delivery/hidden-stage::hta-wmi-hidden-process-stage", "atk": "T1047,T1564.003", "mbc": "E1043", "conf": 0.97, "crit": 3, "desc": "HTA creates a hidden WMI process", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/wsh::hidden-window-run", "conf": 0.92, "crit": 3, "desc": "WSH launches process with hidden window", "from": [ { "file": 1 } ] }, { "id": "objectives/persistence/login/startup/folder::js-fso-self-copy-startup-folder", "atk": "T1547.001", "conf": 0.98, "crit": 5, "desc": "JavaScript self-copies to Startup", "from": [ { "off": 260, "file": 1, "line": 6 } ], "uses": [ 0, 9, 40 ] }, { "id": "objectives/execution/wmi::wmi-hidden-four-argument-process-create", "atk": "T1047,T1564.003", "mbc": "E1043", "conf": 0.98, "crit": 4, "desc": "WMI creates a hidden process with startup configuration", "from": [ { "file": 1 } ], "uses": [ 39, 46, 52 ] }, { "id": "objectives/evasion/self-delete/file/script::js-filesystem-file-check", "conf": 0.88, "crit": 3, "desc": "FileSystemObject checks file existence", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/wmi::wmi-hidden-variable-process-create", "atk": "T1047, T1564.003", "mbc": "E1043", "conf": 0.95, "crit": 4, "desc": "WMI hidden variable process create", "from": [ { "file": 1 } ], "uses": [ 12, 46, 52 ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-prefix", "atk": "T1059.001", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited PowerShell pow fragment", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/script/wsh::wsh-getobject-directory-moniker", "conf": 1.0, "crit": 4, "desc": "WSH GetObject directory moniker", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/wmi::win32-process-query", "atk": "T1047", "mbc": "E1043", "conf": 0.75, "crit": 3, "desc": "Win32_Process WMI class reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/jscript::activex-object", "conf": 1.0, "crit": 3, "desc": "ActiveXObject constructor reference", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/name-mangling/unicode::mostly-non-ascii-source", "conf": 0.9, "crit": 3, "desc": "Source text is mostly non-ASCII", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/script/wsh::activexobject-marker", "conf": 0.8, "crit": 3, "desc": "ActiveXObject marker", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/wmi::process-create-four-argument-call", "atk": "T1047", "mbc": "E1043", "conf": 0.94, "crit": 3, "desc": "Four-argument Create call with null second arg", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/selfpath::wscript-scriptfullname", "conf": 0.5, "crit": 3, "desc": "WScript.ScriptFullName self-path read", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/device/kernel::windows-kernel-device-path", "conf": 0.85, "crit": 3, "desc": "References a Windows kernel device path", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/infect/script::wsh-fso-copyfile-call", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "WSH FileSystemObject CopyFile call", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/wmi::js-hidden-process-create-sequence", "atk": "T1047", "mbc": "E1043", "conf": 0.97, "crit": 3, "desc": "Obfuscated WMI hidden process sequence", "from": [ { "off": 7076274, "file": 1, "line": 147 } ], "uses": [ 23, 55 ] }, { "id": "objectives/execution/wmi::process-startup-config", "atk": "T1047", "mbc": "E1043", "conf": 0.75, "crit": 3, "desc": "Win32_ProcessStartup config", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/script/wsh::wscript-marker", "conf": 0.8, "crit": 3, "desc": "WScript marker", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/wmi::wmi-showwindow-hidden-property", "atk": "T1564.003", "mbc": "E1003", "conf": 0.88, "crit": 3, "desc": "WMI ShowWindow hidden property", "from": [ { "file": 1 } ], "uses": [ 16 ] }, { "id": "objectives/execution/wmi::wsh-unicode-padded-hidden-wmi-reflective-loader", "atk": "T1027.002,T1047,T1059.007,T1140,T1564.003,T1620", "mbc": "E1043", "conf": 0.995, "crit": 5, "desc": "Unicode-padded WSH loader launches a reflective payload through hidden WMI", "from": [ { "off": 7076222, "file": 1, "line": 146 } ], "uses": [ 3, 22, 30 ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-near-zero-whitespace", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JavaScript near-zero whitespace", "from": [ { "file": 1 } ] }, { "id": "metadata/file/invisible-unicode::high-non-ascii-ratio", "atk": "T1027", "conf": 0.8, "crit": 2, "desc": "High non-ASCII ratio in source", "from": [ { "file": 1 } ] }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/copy::fso-copyfile-case-variant", "conf": 0.82, "crit": 1, "desc": "Case-variant FileSystemObject CopyFile call text", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/wmi::process-startup-spawninstance-text", "atk": "T1047", "mbc": "E1043", "conf": 0.88, "crit": 3, "desc": "WMI startup SpawnInstance text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/wmi/query::wmi-moniker-string", "conf": 0.8, "crit": 3, "desc": "WMI moniker string reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/copy::fso-copyfile-text", "conf": 0.84, "crit": 3, "desc": "FileSystemObject CopyFile call text", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/wmi::js-hidden-window-process-create", "atk": "T1047", "mbc": "E1043", "conf": 0.96, "crit": 3, "desc": "Hidden window followed by WMI Create", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/jscript::is-jscript", "conf": 0.8, "crit": 3, "desc": "WScript object reference", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/archive-member::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" }, { "id": "micro-behaviors/data/archive/rar::js-script-member-extension", "conf": 0.9, "crit": 3, "desc": "RAR archive names JS/JSE script member" } ] }, { "ctx": [ { "b": "arR^HarR^HarR^HarR^HarR^HarR^H4gjj2arR^HarR^HarR^HarR^HarR^HarRa2arR^HarR^HarR^HarR^HarR^HarR^HC42zlB7G5}xK@qHaz$+mavfHVx)a5\u0026pHX6Iv@%ayq!6\u0026ZAcb/ixd=U/y?lK\u003cB97#gpHX6Iv@@[zi$hKuvr9G8B8ko4x(!wsjS[SNCoxgYBzk]fswJyvwN/*gb3dYMA+PGme(MB{y?$pAi$hKuvr9GhD30.px\u003e5nGaxIGKA+PGme(Mn2x(Fe-B.\u003e\u003e?vqPNq4gmn!AV/swz//A8Aa\u0026%axLzu}auZ\u0026YB8ko4x(!wGq/DqTx\u003c\u003e*Ez!@@}A=SSMq/(C*BAIKDdlv$CC42zlxM4:aAa\u003cf0wPF$SaAhvtByx39xLzH2x(mG8d\u003cc3vtP$pvaAIadv}YBam}D^ix(4uQvqPN7A^q+uze0Gei$hKhw/@HxD30.px\u003e5=qz+L7[wPydDB7D:Gar-)haztXgz/xxdvR6QkBz\u003c\u0026\u003eCv+!Zvrl0ddjDx^4gjj2arUxgasFyOwOCT/wIcC^y?l4Wx(!xqc$)Koz/xxdvR6QfdiJ%D3lQDlarR^HaAIadv}YBalVl{?mRMWIc#%PPxL?D[efFRAzeTxbz^)p0dlv$CarR^HEglKi4giKK4gjj2arR^HarR^HarR^HarR^HarR^HarU\u0026oAV!!by\u0026sxpwPzG{auZ\u0026+wP]m.v@#BdwMR-qygQ)%c)z.\u003ev@=p5Bs{H9wO=fbdlv$CarR^HarR^HarR^HarR^HarR^HarR^HC42zlzEE0\u003cz!0M9jS[fHy\u0026sxpwPzG{e\u003e6V3x(XcfzdNQbc)zVjwPw$zi$hJa3lQDlarR^HarR^HarR^HarR^HarR^HaA?glaA}:xvRGy=x\u003equdjS\u003e}F\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:br]H0\u003c\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ=B3RZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMkl\u003cSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBV\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:ble!=Q\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ.OGhZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMjWVSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBV\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:ble!=Q\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJZqT5Z2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMj*ZSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBV\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnSS", "ln": 0, "col": 1, "line": 1 }, { "b": "Pou[DHMjWVSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBV\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:ble!=Q\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ=r%QZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMlujSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiC5\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bg#UyD\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ^6DXZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMjWVSj?b*LIRL.Zn{k", "ln": 2632611, "col": 28224, "line": 55 }, { "b": "QOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:ble!=Q\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ=TfTZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMlVsSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiB\u003c\u0026I:DFSGVh6\u0026L8wLQOV$zFY0#", "ln": 2752143, "col": 7014, "line": 57 }, { "b": "\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiB.\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bBk:7h\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ.5ccZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMk%8Sj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiCg\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bBM6gi\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-SY", "ln": 4196948, "col": 44419, "line": 77 }, { "b": "\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBX\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bp#Ov^\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ.!SjZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMlPqSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBZ\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:ble!=Q\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-SY", "ln": 4980924, "col": 54325, "line": 88 }, { "b": "\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBV\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bw-oP3\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ+)WMZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMlifSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiCq\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bvD1e#\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-SY", "ln": 6161734, "col": 38845, "line": 105 }, { "b": "Cw?zex\u003ep)\u003cwPGFBAbolgc)ESGZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMiMce]2rszyuXMdlv$CarR^HarR^HarR^HarR^HarR^HarR^HC42zlv{%m+wO=f]AX5tQzGoq%B8L@8vR*rvazttdwPzZ5wQ4T2wPxsAv@Dj6vpKy[w[+*!efF[FvqY!2xGDUgarR^HarR^HarR^HarR^HarR^HarR^HB-8khvrlv8ve", "ln": 7037593, "col": 38, "line": 120 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR!Cy*?i}B7=WVar\u00260\u003e4giKKarR^HarR^HarR^HarR^HarR^HarR^Hw]zYjc$uX6v}xE)wPw[Ratt(1v{%m+wO=f]AV^E!Cw?zex\u003ep)\u003cwPGFuwO#d5xGEtDvqYN^y\u00260W6as/O$B-8khvrlv8vpB4#diJ%D3lQDlarR^HarR^HarR^HarR^HarR^HarR^HazttdwPzZ5wQ4T2wPw[RazttdwPzZ5wQ4T2wPw[zatC}!3lQDlarR^HarR^HarR^HarR^HarR^HarR^Hay/tbAa9l#x\u003ez6\u003cwfs2Tb2xD", "ln": 7037853, "col": 2, "line": 124 }, { "b": "arR!Ivr9G0zeTDlxM53mauZ?\u003e\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bAn^+e\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ=i)PZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMlPqSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiC8\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bA]A$g\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ=TfTZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMl6bSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiC8\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:by#Ita\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ+)WMZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMP", "ln": 7038697, "col": 22, "line": 141 }, { "b": "Pou[DHMjBOSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiBO\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:bm=yqV\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ=K9SZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMlriSj?b*LIRL.Zn{m*Rq!h1.\u003c]U\u003cNbKpf\u0026/.1kXU!w\u0026LhJWG[sL(S\u0026FiCg\u0026I:DFSGVh6\u0026L8wLQOV$zFY12oVy6QnS]xhP\u0026jk-AUAE?IT)?%CZ2s:blGa(R\u0026hI{%L\u0026ouS\u0026?JvfP[gaK\u0026iF:eL=A-aZ2lC#\u0026\u0026!K6V-S.?Ld/?fJ:Z[BZ2k(N?JW0kTkY[J\u0026?p}vOzZYu\u0026GQw4Ld/!:RSa!x\u0026iPMPPou[DHMlDmSj?b*LIRL.Zn{k", "ln": 7042621, "col": 3946, "line": 141 }, { "b": "\u0026FiBqdk2vNx(ksya$kO.3jNs+arR^HarR^HarR^HarR^HarR^HarR!GA^n^O4gjj2arR^HarR^HarR^HarR^HarR^HarR^HarU\u0026oAV!}rz/fceA:-^2C{2l)m}D^rvRPE:BsntSx(m^2zff?WtWgJse)IU4z/o-5tW}F+B$$l\u003ci$hJtarR^HarR^HarR^HarR^HarR^HarR^HarR!Ivr9FSvpBw1auZ\u0026UCYdFhB-H]by\u003cvT6wPPsAs7#Ldgg9\u003c#z!0v1B5Nf?A==Cya$kcyAa9%dnP5P\u003evqYN^uNNu+4gjj2arR^HarR^HarR^HarR^HarR^HarR^HarT0VvS=Yzq!Q8[s7#L.z*9r!att(14gjj2arR^HarR^HarR^HarR^HarR^HarR^HarRa2arR^HarR^HarR^HarR^HarR^HarR^HarR^HC42zll2pdEwGTbUwQ5chwP-34y\u00261wHm}D=\u003cb3eF@gCSrlA=kD0B8@JOi$hJtarR^HarR^HarR^HarR^HarR^HarR^HarR^)y?vx)e\u003c\u003cU\u003cvru6evqP}6Aa\u003cfjB1wCKB.\u003e\u003eBavoHCB-G2QzGP=idlv$CarR^HarR^HarR^HarR^HarR^HarR^HEir3dByO#bc$K?IDKQr8arR^HarR^HarR^HarR^HarR^HarR^HarR!ny\u002613hBy/Gbv\u003eHV4zyw}gz/P/gz/{aLattt?BAhIndlv$CarR^HarR^HarR^HarR^HarR^HarR^HEglI", "ln": 7076003, "col": 95, "line": 142 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 7076602, "entropy": 4.82 }, "text": { "lines": 153, "top_char": 226, "max_ws_run": 1, "digit_ratio": 0.07, "space_count": 1239, "char_entropy": 4.82, "unique_chars": 120, "top_char_null": 0, "lines_over_200": 101, "lines_over_500": 101, "top_char_ratio": 0.09, "avg_line_length": 46250.3, "lines_over_1000": 101, "max_line_length": 70394, "non_ascii_ratio": 0.98, "empty_line_ratio": 0.08, "last_line_length": 25, "long_token_count": 107, "whitespace_ratio": 0, "line_length_stddev": 33260.12, "repeated_char_sequences": 35, "trailing_whitespace_lines": 4 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 6144, "peak_region_entropy": 5.42 }, "source": { "ast_unavailable": 1, "ast_unavailable.tree_sitter_guard": 1 } } }, "id": 1, "mol": "O₆(PXeAs₃CErI)H₄(Os₃Po₆Db₂F₅)Md", "path": "virussign.com_13fd4fe2eaf4b64d46722777db277ff0.vir!!FedEx Shipment Doc - 84665.js", "pid": 0, "risk": 368, "sha": "c2f8a4cbc3d40260b45ea7afdf5f89732cf54e55c7fd8ef20b4580ac73b2caa3", "size": 7076602, "traits": [ { "id": "metadata/file/invisible-unicode::high-non-ascii-ratio", "atk": "T1027", "conf": 0.8, "crit": 2, "desc": "High non-ASCII ratio in source" }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "spans": [ [ 7037917, 63 ] ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "spans": [ [ 7037657, 9 ] ] }, { "id": "micro-behaviors/fs/path/check::fso-file-exists", "conf": 0.92, "crit": 3, "desc": "FileSystemObject checks whether a path exists", "spans": [ [ 427, 18 ] ] }, { "id": "micro-behaviors/fs/path/device/kernel::windows-kernel-device-path", "conf": 0.85, "crit": 3, "desc": "References a Windows kernel device path", "spans": [ [ 7076121, 11 ] ] }, { "id": "micro-behaviors/fs/path/location::wsh-startup-folder-lookup", "conf": 0.92, "crit": 3, "desc": "WSH resolves the Startup folder", "spans": [ [ 260, 25 ] ] }, { "id": "micro-behaviors/fs/read/self::script-fullname-reference", "conf": 0.95, "crit": 3, "desc": "References the current WSH script path", "spans": [ [ 205, 22 ] ] }, { "id": "micro-behaviors/os/com/automation::filesystemobject-constructor", "conf": 0.94, "crit": 3, "desc": "WSH instantiates FileSystemObject", "spans": [ [ 93, 43 ] ] }, { "id": "micro-behaviors/os/com/automation::filesystemobject-progid", "conf": 0.85, "crit": 3, "desc": "FileSystemObject ProgID string", "spans": [ [ 108, 26 ] ] }, { "id": "micro-behaviors/os/com/automation::wscript-shell-activex-constructor", "conf": 0.94, "crit": 3, "desc": "ActiveXObject instantiates WScript.Shell", "spans": [ [ 158, 28 ] ] }, { "id": "micro-behaviors/os/com/automation::wscript-shell-literal", "conf": 0.8, "crit": 3, "desc": "References the WScript.Shell COM object", "spans": [ [ 173, 13 ] ] }, { "id": "micro-behaviors/os/env/read::wsh-environment-method-text", "conf": 0.9, "crit": 3, "desc": "Calls the WSH Environment method", "spans": [ [ 638, 29 ] ] }, { "id": "micro-behaviors/os/env/read::wsh-environment-object", "conf": 0.95, "crit": 3, "desc": "WSH Environment object retrieval", "spans": [ [ 638, 30 ] ] }, { "id": "micro-behaviors/os/wmi/query::wmi-hidden-process-startup", "atk": "T1564.003,T1047", "conf": 0.96, "crit": 4, "desc": "WMI process startup instance hides its window", "spans": [ [ 7076222, 67 ] ] }, { "id": "micro-behaviors/os/wmi/query::wmi-moniker-string", "conf": 0.8, "crit": 3, "desc": "WMI moniker string reference", "spans": [ [ 7076110, 9 ] ] }, { "id": "micro-behaviors/os/wmi/query::wmi-process-startup-instance", "atk": "T1047", "conf": 0.94, "crit": 3, "desc": "WMI process-startup object instance", "spans": [ [ 7076222, 16 ] ] }, { "id": "micro-behaviors/process/create/flags::show-window-hidden-assignment", "conf": 0.88, "crit": 3, "desc": "Assigns hidden ShowWindow value", "spans": [ [ 7076275, 14 ] ] }, { "id": "micro-behaviors/process/create/script/wsh::activexobject-marker", "conf": 0.8, "crit": 3, "desc": "ActiveXObject marker", "spans": [ [ 93, 13 ] ] }, { "id": "micro-behaviors/process/create/script/wsh::wscript-marker", "conf": 0.8, "crit": 3, "desc": "WScript marker", "spans": [ [ 173, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-prefix", "atk": "T1059.001", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited PowerShell pow fragment", "spans": [ [ 4980988, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-suffix", "atk": "T1059.001", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited PowerShell she fragment", "spans": [ [ 7038986, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-tail", "atk": "T1059.001", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited PowerShell ell fragment", "spans": [ [ 6161798, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/wsh::hidden-window-run", "conf": 0.92, "crit": 3, "desc": "WSH launches process with hidden window", "spans": [ [ 7076548, 17 ] ] }, { "id": "micro-behaviors/process/create/shell/wsh::wsh-run-hidden-window-text", "atk": "T1564.003", "conf": 0.94, "crit": 3, "desc": "WSH Run call uses hidden-window arguments", "spans": [ [ 7076548, 24 ] ] }, { "id": "micro-behaviors/process/info/selfpath::wscript-scriptfullname", "conf": 0.5, "crit": 3, "desc": "WScript.ScriptFullName self-path read", "spans": [ [ 205, 22 ] ] }, { "id": "micro-behaviors/process/interpreter/jscript::is-jscript", "conf": 0.8, "crit": 3, "desc": "WScript object reference", "spans": [ [ 173, 8 ] ] }, { "id": "objectives/anti-static/obfuscation/name-mangling/unicode::mostly-non-ascii-source", "conf": 0.9, "crit": 3, "desc": "Source text is mostly non-ASCII" }, { "id": "objectives/anti-static/obfuscation/steganography/unicode::js-unicode-delimited-appdomain-fragment", "mbc": "B0032", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited AppDomain token fragment", "spans": [ [ 2632707, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/steganography/unicode::js-unicode-delimited-base64-fragment", "mbc": "B0032", "conf": 0.94, "crit": 1, "desc": "Unicode-delimited Base64 decoder fragment", "spans": [ [ 7042717, 0 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/hidden-stage::hta-wmi-hidden-process-stage", "atk": "T1047,T1564.003", "mbc": "E1043", "conf": 0.97, "crit": 3, "desc": "HTA creates a hidden WMI process", "spans": [ [ 7076222, 217 ] ] }, { "id": "objectives/execution/wmi::js-hidden-window-process-create", "atk": "T1047", "mbc": "E1043", "conf": 0.96, "crit": 3, "desc": "Hidden window followed by WMI Create", "spans": [ [ 7076274, 165 ] ] }, { "id": "objectives/execution/wmi::js-spawninstance-hidden-window", "atk": "T1047", "mbc": "E1043", "conf": 0.96, "crit": 3, "desc": "WMI SpawnInstance followed by hidden window", "spans": [ [ 7076222, 67 ] ] }, { "id": "objectives/execution/wmi::process-create-four-argument-call", "atk": "T1047", "mbc": "E1043", "conf": 0.94, "crit": 3, "desc": "Four-argument Create call with null second arg", "spans": [ [ 7076431, 37 ] ] }, { "id": "objectives/execution/wmi::process-startup-config", "atk": "T1047", "mbc": "E1043", "conf": 0.75, "crit": 3, "desc": "Win32_ProcessStartup config", "spans": [ [ 7076199, 20 ] ] }, { "id": "objectives/execution/wmi::process-startup-create-variable", "atk": "T1047", "mbc": "E1043", "conf": 0.9, "crit": 3, "desc": "WMI startup object creates a process", "spans": [ [ 7076222, 217 ] ] }, { "id": "objectives/execution/wmi::process-startup-spawninstance-text", "atk": "T1047", "mbc": "E1043", "conf": 0.88, "crit": 3, "desc": "WMI startup SpawnInstance text", "spans": [ [ 7076222, 14 ] ] }, { "id": "objectives/execution/wmi::win32-process-query", "atk": "T1047", "mbc": "E1043", "conf": 0.75, "crit": 3, "desc": "Win32_Process WMI class reference", "spans": [ [ 7076380, 13 ] ] }, { "id": "objectives/impact/infect/script::wsh-fso-copyfile-call", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "WSH FileSystemObject CopyFile call", "spans": [ [ 476, 8 ] ] }, { "id": "objectives/impact/infect/script::wsh-fso-file-exists-guard", "atk": "T1080", "conf": 0.85, "crit": 3, "desc": "WSH FileSystemObject checks target existence", "spans": [ [ 434, 10 ] ] }, { "id": "objectives/impact/infect/script::wsh-script-full-name", "atk": "T1080", "conf": 0.9, "crit": 3, "desc": "WSH script references its own full path", "spans": [ [ 213, 14 ] ] }, { "id": "metadata/build/minifier::js-large-minified-bundle", "conf": 0.92, "crit": 2, "desc": "Large minified JavaScript bundle", "spans": [ [ 673, 70394 ] ] }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "spans": [ [ 673, 70394 ] ] }, { "id": "metadata/file/data-blob::high-byte-script-text", "conf": 0.88, "crit": 3, "desc": "High-byte script text (\u003e=12%)" }, { "id": "micro-behaviors/fs/file/copy::fso-copyfile-case-variant", "conf": 0.82, "crit": 1, "desc": "Case-variant FileSystemObject CopyFile call text", "spans": [ [ 475, 0 ] ] }, { "id": "micro-behaviors/fs/file/copy::fso-copyfile-text", "conf": 0.84, "crit": 3, "desc": "FileSystemObject CopyFile call text", "spans": [ [ 475, 9 ] ] }, { "id": "micro-behaviors/process/interpreter/jscript::activex-object", "conf": 1.0, "crit": 3, "desc": "ActiveXObject constructor reference", "spans": [ [ 89, 18 ] ] }, { "id": "micro-behaviors/process/script/wsh::wsh-getobject-directory-moniker", "conf": 1.0, "crit": 4, "desc": "WSH GetObject directory moniker", "spans": [ [ 7076099, 20 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-near-zero-whitespace", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JavaScript near-zero whitespace" }, { "id": "objectives/evasion/self-delete/file/script::js-filesystem-file-check", "conf": 0.88, "crit": 3, "desc": "FileSystemObject checks file existence", "spans": [ [ 427, 18 ] ] }, { "id": "micro-behaviors/fs/file/copy::fso-copyfile", "conf": 0.9, "crit": 3, "desc": "Copy file via FileSystemObject", "uses": [ 8, 43, 44 ], "spans": [ [ 108, 26 ], [ 475, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/encoded::unicode-delimited-powershell-command", "atk": "T1059.001", "conf": 0.96, "crit": 3, "desc": "Unicode-delimited PowerShell command", "uses": [ 19, 20, 21 ], "spans": [ [ 7038761, 91 ], [ 7038986, 91 ], [ 7039076, 91 ] ] }, { "id": "objectives/anti-static/obfuscation/steganography/unicode::unicode-delimited-managed-loader-tokens", "atk": "T1027.002,T1140,T1620", "mbc": "B0032", "conf": 0.98, "crit": 4, "desc": "Unicode delimiters split managed payload-loader API tokens", "uses": [ 27, 28, 42 ], "spans": [ [ 2632707, 91 ], [ 7042717, 91 ] ] }, { "id": "objectives/execution/wmi::js-hidden-process-create-sequence", "atk": "T1047", "mbc": "E1043", "conf": 0.97, "crit": 3, "desc": "Obfuscated WMI hidden process sequence", "uses": [ 30, 31 ], "spans": [ [ 7076222, 67 ], [ 7076274, 165 ] ] }, { "id": "objectives/persistence/login/startup/folder::js-fso-self-copy-startup-folder", "atk": "T1547.001", "conf": 0.98, "crit": 5, "desc": "JavaScript self-copies to Startup", "uses": [ 5, 24, 49 ], "spans": [ [ 108, 26 ], [ 205, 22 ], [ 260, 25 ], [ 475, 9 ] ] }, { "id": "objectives/execution/wmi::wmi-showwindow-hidden-property", "atk": "T1564.003", "mbc": "E1003", "conf": 0.88, "crit": 3, "desc": "WMI ShowWindow hidden property", "uses": [ 16 ], "spans": [ [ 7076275, 14 ] ] }, { "id": "objectives/execution/wmi::wmi-hidden-four-argument-process-create", "atk": "T1047,T1564.003", "mbc": "E1043", "conf": 0.98, "crit": 4, "desc": "WMI creates a hidden process with startup configuration", "uses": [ 32, 35, 54 ], "spans": [ [ 7076222, 14 ], [ 7076275, 14 ], [ 7076431, 37 ] ] }, { "id": "objectives/execution/wmi::wmi-hidden-variable-process-create", "atk": "T1047, T1564.003", "mbc": "E1043", "conf": 0.95, "crit": 4, "desc": "WMI hidden variable process create", "uses": [ 34, 35, 54 ], "spans": [ [ 7076222, 217 ], [ 7076275, 14 ] ] }, { "id": "objectives/execution/wmi::wsh-unicode-padded-hidden-wmi-reflective-loader", "atk": "T1027.002,T1047,T1059.007,T1140,T1564.003,T1620", "mbc": "E1043", "conf": 0.995, "crit": 5, "desc": "Unicode-padded WSH loader launches a reflective payload through hidden WMI", "uses": [ 9, 51, 55 ], "spans": [ [ 158, 28 ], [ 2632707, 91 ], [ 7042717, 91 ], [ 7076222, 14 ], [ 7076275, 14 ], [ 7076431, 37 ] ] } ], "type": "javascript" } ], "rev": "c1ea9", "v": "8" } }