{
  "ml": {
    "v": "7",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.0001151065,
        "rte": "az",
        "prob": 0.0001151065
      },
      {
        "cls": 0,
        "raw": 0.000046014786,
        "rte": "az/scripts",
        "prob": 0.000046014786
      },
      {
        "cls": 0,
        "raw": 0.000009387732,
        "rte": "az/javascript",
        "prob": 0.000009387732
      }
    ],
    "prob": 0.0001151065,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00011510650074342266,
        "type": "javascript"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-14T09:28:38Z"
  },
  "path": "VirusShare_e1a572c2cc82608cc14323e008fcebca",
  "raw": {
    "v": "7",
    "tv": "c7b65",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 0,
            "b": "jzn?Ny^4",
            "l": 1
          },
          {
            "a": 7,
            "b": "jznqmwiG",
            "l": 2
          },
          {
            "a": 14,
            "b": "jz!UKvixl9Bz@*yADL#sjT9=)mP8VNnfPf^z/fVdzGF2=f/{HTqCok3xMOuniXJdgx(4s4z!\u003cSpe](7/ByYCCxj+{@xF9!cx*jy2BA?IzC%9\u0026dwO=KbzAPW2B.CuevM=B)BZYJry=%E0vScdbB3j.Yy?dTayK6?BvrliEcN7.",
            "l": 3,
            "n": [
              {
                "c": 3,
                "d": "Generates HTML tags",
                "i": "micro-behaviors/data/format/html::html-generator-tags",
                "o": 147,
                "z": 5
              },
              {
                "c": 3,
                "d": "Hardcoded suspicious TLD domain pattern",
                "i": "objectives/command-and-control/infrastructure/domain/malicious::hardcoded-domain-suspicious-pattern",
                "o": 57,
                "z": 21
              }
            ]
          },
          {
            "a": 150,
            "b": "jwwmzk{eY$r8tenqb{g*jT9Zyvp%B=a%olGpe\u003cUSr6qByz.kEcv}YA$j]",
            "l": 4
          },
          {
            "a": 196,
            "b": "jtgwVvpRL",
            "l": 5
          },
          {
            "a": 807,
            "b": "w{503BzkVhay]5aA+)dBdf",
            "l": 25
          },
          {
            "a": 825,
            "b": "DJ",
            "l": 26
          },
          {
            "a": 827,
            "b": "336Q0B-IvxB1RJMy?W#ta%FD*A+fA9A=U!udk2vNx(ksya$kO",
            "l": 27,
            "n": [
              {
                "c": 3,
                "d": "String reconstructed via split/join",
                "i": "objectives/anti-static/obfuscation/string/reconstruct::split-join-reconstruction",
                "o": 836,
                "z": 29
              }
            ]
          },
          {
            "a": 867,
            "b": "Ee",
            "l": 28
          },
          {
            "a": 869,
            "b": "",
            "l": 29
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "45be2847e973d1fba401a7913eaf134f36bbb7cf8637011d2a76dd2c8e2370b2",
        "fact": {
          "id": "javascript",
          "imp": [
            [
              "",
              "script"
            ],
            [
              "",
              "txiwy"
            ],
            [
              "",
              "txiwy"
            ],
            [
              "",
              "elvmn"
            ],
            [
              "",
              "datawindow"
            ],
            [
              "",
              "Size"
            ],
            [
              "",
              "elvmn"
            ],
            [
              "",
              "Width"
            ],
            [
              "",
              "Height"
            ],
            [
              "",
              "elvmn"
            ],
            [
              "",
              "window.location"
            ],
            [
              "",
              "deurl"
            ],
            [
              "",
              "s.split.reverse.join"
            ],
            [
              "",
              "s.split.reverse"
            ],
            [
              "",
              "s.split"
            ],
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "Results"
            ],
            [
              "",
              "Results"
            ],
            [
              "",
              "n_result"
            ],
            [
              "",
              "n_result"
            ]
          ],
          "mbr": [
            "document.body",
            "document.body.clientHeight",
            "document.body.clientWidth",
            "document.documentElement",
            "document.documentElement.clientHeight",
            "document.documentElement.clientWidth",
            "s.split",
            "s.split().reverse",
            "s.split().reverse().join",
            "top.frames",
            "top.frames.length",
            "window.innerHeight",
            "window.innerWidth",
            "window.location"
          ],
          "met": {
            "ast": {
              "op.eq": 1.0,
              "op.gt": 3.0,
              "op.lt": 5.0,
              "op.add": 5.0,
              "op.lor": 6.0,
              "op.land": 4.0,
              "op.lnot": 2.0,
              "max_depth": 14.0,
              "bind_count": 18.0,
              "call_count": 9.0,
              "node_count": 705.0,
              "member_count": 14.0,
              "op_density.eq": 0.0,
              "op_density.gt": 0.0,
              "op_density.lt": 0.01,
              "op_density.add": 0.01,
              "op_density.lor": 0.01,
              "op_density.land": 0.01,
              "op_density.lnot": 0.0,
              "identifier_count": 45.0,
              "member_depth_max": 4.0,
              "string_literal_count": 10.0,
              "array_literal_max_length": 2.0,
              "string_concat_chain_max_length": 6.0
            },
            "file": {
              "size": 2247.0,
              "entropy": 5.31,
              "size_bytes": 2247.0
            },
            "text": {
              "tab_count": 23.0,
              "digit_ratio": 0.04,
              "space_count": 212.0,
              "total_lines": 73.0,
              "char_entropy": 5.31,
              "mixed_indent": 1.0,
              "unique_chars": 80.0,
              "string_density": 0.14,
              "avg_line_length": 29.78,
              "max_line_length": 155.0,
              "empty_line_ratio": 0.16,
              "last_line_length": 7.0,
              "long_token_count": 2.0,
              "whitespace_ratio": 0.14,
              "most_common_ratio": 0.07,
              "identifier_density": 2.01,
              "line_length_stddev": 34.61,
              "normalized_string_count": 1.17,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0,
              "suspicious_identifier_ratio": 0.04,
              "normalized_unique_identifiers": 7.27
            },
            "binds": {
              "count": 18.0
            },
            "calls": {
              "count": 9.0
            },
            "binary": {
              "overall_entropy": 5.31
            },
            "source": {
              "function_count": 5.0
            },
            "members": {
              "count": 14.0
            },
            "strings": {
              "total": 10.0,
              "avg_length": 14.7,
              "max_length": 57.0,
              "avg_entropy": 3.28,
              "empty_count": 2.0,
              "total_bytes": 147.0,
              "entropy_stddev": 0.81
            },
            "comments": {
              "chars": 68.0,
              "lines": 4.0,
              "total": 4.0,
              "to_code_ratio": 0.06
            },
            "functions": {
              "count": 5.0,
              "avg_params": 0.8,
              "max_params": 3.0,
              "length_stddev": 4.92,
              "avg_name_length": 5.4,
              "no_params_count": 3.0,
              "avg_length_lines": 8.4,
              "max_length_lines": 18.0,
              "min_length_lines": 4.0,
              "single_char_params": 1.0,
              "avg_param_name_length": 4.75,
              "density_per_100_lines": 6.85,
              "code_in_functions_ratio": 0.58
            },
            "identifiers": {
              "count": 45.0,
              "total": 147.0,
              "avg_length": 6.2,
              "max_length": 15.0,
              "min_length": 1.0,
              "avg_entropy": 2.31,
              "reuse_ratio": 0.31,
              "unique_count": 45.0,
              "length_stddev": 2.83,
              "sequential_names": 2.0,
              "single_char_count": 2.0,
              "single_char_ratio": 0.04,
              "all_lowercase_ratio": 0.73
            }
          },
          "str": [
            [
              31,
              "u8",
              "REFRESH"
            ],
            [
              32,
              "u8",
              "REFRESH"
            ],
            [
              50,
              "u8",
              "1; URL='http://wildtokyo.ru/tds/gfkmh.cgi?3"
            ],
            [
              100,
              "10",
              "0"
            ],
            [
              108,
              "10",
              "0"
            ],
            [
              116,
              "10",
              "1"
            ],
            [
              124,
              "10",
              "0"
            ],
            [
              147,
              "u8",
              "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n\u003cdiv style=\"background:#ffffff;width:100%;height:100%;\"\u003e\n\u003ca href="
            ],
            [
              320,
              "10",
              "0"
            ],
            [
              328,
              "10",
              "0"
            ],
            [
              336,
              "10",
              "1"
            ],
            [
              344,
              "10",
              "0"
            ],
            [
              366,
              "u8",
              "\u003e\u003cfont color="
            ],
            [
              367,
              "u8",
              "\u003e\u003cfont color="
            ],
            [
              433,
              "u8",
              "text/javascript"
            ],
            [
              434,
              "u8",
              "text/javascript"
            ],
            [
              469,
              "10",
              "0"
            ],
            [
              504,
              "10",
              "1"
            ],
            [
              521,
              "10",
              "0"
            ],
            [
              558,
              "10",
              "0"
            ],
            [
              563,
              "10",
              "301"
            ],
            [
              581,
              "10",
              "1"
            ],
            [
              586,
              "10",
              "201"
            ],
            [
              598,
              "10",
              "1"
            ],
            [
              615,
              "10",
              "301"
            ],
            [
              633,
              "10",
              "201"
            ],
            [
              645,
              "10",
              "1"
            ],
            [
              674,
              "u8",
              "3?igc.hmkfg/sdt/ur.oykotdliw//:ptth"
            ],
            [
              675,
              "u8",
              "3?igc.hmkfg/sdt/ur.oykotdliw//:ptth"
            ],
            [
              713,
              "u8",
              "\u0026txiwy="
            ],
            [
              714,
              "u8",
              "\u0026txiwy="
            ],
            [
              729,
              "u8",
              "\u0026elvmn="
            ],
            [
              730,
              "u8",
              "\u0026elvmn="
            ],
            [
              745,
              "u8",
              "\u0026uaxvl=2339430918\u0026ur=1\u0026HTTP_REFERER=\u0026bonus=wildtokyo\u0026ask="
            ],
            [
              746,
              "u8",
              "\u0026uaxvl=2339430918\u0026ur=1\u0026HTTP_REFERER=\u0026bonus=wildtokyo\u0026ask="
            ],
            [
              904,
              "10",
              "0"
            ],
            [
              918,
              "10",
              "0"
            ],
            [
              958,
              "u8",
              "number"
            ],
            [
              959,
              "u8",
              "number"
            ],
            [
              1645,
              "10",
              "0"
            ],
            [
              1716,
              "10",
              "0"
            ],
            [
              1765,
              "10",
              "0"
            ],
            [
              1855,
              "10",
              "0"
            ],
            [
              1927,
              "10",
              "0"
            ],
            [
              1977,
              "10",
              "0"
            ],
            [
              2060,
              "10",
              "0"
            ]
          ],
          "tgt": [
            "Height",
            "Results",
            "Size",
            "Width",
            "deurl",
            "s.split",
            "s.split().reverse",
            "s.split().reverse().join"
          ],
          "val": {
            "file.stem": "VirusShare_e1a572c2cc82608cc14323e008fcebca",
            "file.basename": "VirusShare_e1a572c2cc82608cc14323e008fcebca",
            "source.language": "javascript",
            "source.imports[0]": "Height",
            "source.imports[1]": "Results",
            "source.imports[2]": "Size",
            "source.imports[3]": "Width",
            "source.imports[4]": "datawindow",
            "source.imports[5]": "deurl",
            "source.imports[6]": "elvmn",
            "source.imports[7]": "myHeight",
            "source.imports[8]": "myWidth",
            "source.imports[9]": "n_result",
            "source.strings[0]": "\u0026elvmn=",
            "source.strings[1]": "\u0026txiwy=",
            "source.strings[2]": "\u0026uaxvl=2339430918\u0026ur=1\u0026HTTP_REFERER=\u0026bonus=wildtokyo\u0026ask=",
            "source.strings[3]": "1; URL='http://wildtokyo.ru/tds/gfkmh.cgi?3",
            "source.strings[4]": "3?igc.hmkfg/sdt/ur.oykotdliw//:ptth",
            "source.strings[5]": "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n\u003cdiv style=\"background:#ffffff;width:100%;height:100%;\"\u003e\n\u003ca href=\"https://wildtokyo.ru/tds/gfkmh.cgi?3",
            "source.strings[6]": "\u003e\u003cfont color=",
            "source.strings[7]": "REFRESH",
            "source.strings[8]": "number",
            "source.strings[9]": "text/javascript",
            "source.has_imports": true,
            "source.imports[10]": "s.split",
            "source.imports[11]": "s.split.reverse",
            "source.imports[12]": "s.split.reverse.join",
            "source.imports[13]": "script",
            "source.imports[14]": "txiwy",
            "source.imports[15]": "window.location",
            "source.functions[0]": "Height",
            "source.functions[1]": "Results",
            "source.functions[2]": "Size",
            "source.functions[3]": "Width",
            "source.functions[4]": "deurl"
          }
        },
        "find": [
          {
            "id": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast",
            "conf": 0.8199999928474426,
            "crit": 1,
            "desc": "Array literal joined with empty string"
          },
          {
            "id": "metadata/file/text/metrics::file-has-30-plus-lines",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "File has 30 or more lines"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-2",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9300000071525574,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9300000071525574,
            "crit": 1,
            "desc": "join marker for decode reverse"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9300000071525574,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/encoding::js-array-join-symbol",
            "crit": 1,
            "desc": "Join using empty string delimiter"
          },
          {
            "id": "metadata/lang/scripted::plain-js-identifier-assignment",
            "conf": 1.0,
            "crit": 1,
            "desc": "Plain JavaScript identifier assignment"
          },
          {
            "id": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "conf": 0.8399999737739563,
            "crit": 1,
            "desc": "path join marker for package.json load composite"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9300000071525574,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9300000071525574,
            "crit": 1,
            "desc": "join marker for reverse decode"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-11",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "micro-behaviors/ui/window/manage/dom::size-prop",
            "conf": 1.0,
            "crit": 1,
            "desc": "DOM or CSS size property"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-7",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9300000071525574,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "metadata/file/text/metrics::few-comment-lines",
            "crit": 1,
            "desc": "Five or fewer comment lines in file"
          },
          {
            "id": "metadata/lang/scripted::length-prop",
            "conf": 1.0,
            "crit": 1,
            "desc": "JavaScript length property"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "join marker for reverse/eval obfuscation composite"
          },
          {
            "id": "metadata/file/text/format::vocab-number",
            "conf": 0.9700000286102295,
            "crit": 1,
            "desc": "Validation vocabulary number"
          },
          {
            "id": "objectives/supply-chain/hidden-payload/staging::node-empty-join-call",
            "atk": "T1195.002",
            "conf": 0.7200000286102295,
            "crit": 1,
            "desc": "Node empty join call"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/encoding::js-string-split",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Split to empty-delimiter char array"
          },
          {
            "id": "micro-behaviors/process/create/load/remote-code::js-dom-script-literal",
            "atk": "T1105",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "DOM script element literal"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "objectives/command-and-control/infrastructure/domain/tld::hardcoded-domain-ru",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "Hardcoded .ru country-TLD domain"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/reconstruct::split-join-reconstruction",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "String reconstructed via split/join"
          },
          {
            "id": "micro-behaviors/data/string/split::js-split-call",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "JavaScript split() method call"
          },
          {
            "id": "metadata/file/text/metrics::javascript-small-file-5k",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "JavaScript file under 5KB"
          },
          {
            "id": "micro-behaviors/data/format/html::html-generator-tags",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Generates HTML tags"
          },
          {
            "id": "objectives/command-and-control/infrastructure/domain/malicious::hardcoded-domain-suspicious-pattern",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "Hardcoded suspicious TLD domain pattern"
          }
        ],
        "path": "VirusShare_e1a572c2cc82608cc14323e008fcebca",
        "risk": 3,
        "size": 2247,
        "type": "javascript"
      }
    ]
  }
}