{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8383554220199585, "class": 0 } ], "prob": 0.8383554, "class": 0, "models": [ { "m": "az", "prob": 0.8383554, "class": 0 }, { "m": "az/scripts", "prob": 0.19900933, "class": 0 }, { "m": "az/javascript", "prob": 0.57859534, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T20:09:01Z" }, "path": "20170318_3170ec01a7c33215b9b942e6679208b0.js", "raw": { "v": "5", "fs": [ { "f": "O₃(AsSXe₂)H₂(CmPo)", "x": 5, "ff": { "i": [ [ "", "zx" ], [ "", "amn" ], [ "", "WScript.CreateObject" ], [ "", "ih" ], [ "", "tjkh" ], [ "", "zn" ], [ "", "kt" ], [ "", "e.open" ], [ "", "e.send" ], [ "", "mip" ], [ "", "r.indexOf" ], [ "", "ikagdh" ], [ "", "r.split.join" ], [ "", "r.split" ], [ "", "eval" ] ], "m": { "ast": { "max_depth": 26.0, "bind_count": 13.0, "call_count": 8.0, "node_count": 369.0, "target_count": 7.0, "member_depth_max": 3.0, "string_bind_count": 5.0, "string_literal_count": 22.0, "string_concat_chain_max_length": 18.0 }, "file": { "size": 808.0, "entropy": 5.62, "size_bytes": 808.0 }, "text": { "tab_count": 45.0, "digit_ratio": 0.09, "space_count": 53.0, "total_lines": 34.0, "char_entropy": 5.62, "unique_chars": 84.0, "string_density": 0.65, "avg_line_length": 21.82, "max_line_length": 139.0, "empty_line_ratio": 0.12, "last_line_length": 2.0, "long_token_count": 1.0, "whitespace_ratio": 0.2, "most_common_ratio": 0.04, "identifier_density": 1.53, "line_length_stddev": 32.03, "normalized_string_count": 3.77, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 3.0, "most_common_char_codepoint": 34.0, "suspicious_identifier_ratio": 0.22, "normalized_unique_identifiers": 4.52 }, "strings": { "total": 22.0, "avg_length": 12.05, "max_length": 117.0, "avg_entropy": 0.92, "empty_count": 5.0, "total_bytes": 265.0, "entropy_stddev": 1.74, "high_entropy_count": 1.0 }, "identifiers": { "total": 52.0, "avg_length": 4.09, "max_length": 12.0, "min_length": 1.0, "avg_entropy": 1.58, "reuse_ratio": 0.44, "unique_count": 23.0, "length_stddev": 3.08, "sequential_names": 5.0, "single_char_count": 5.0, "single_char_ratio": 0.22, "all_lowercase_ratio": 0.83 } }, "s": [ [ 10, "u8", "yst.orlyreznik.com palmspringsevents.net steelglossary.com haveniconnect.com beautifulreflections.purepointdesign.com" ], [ 11, "u8", "yst.orlyreznik.com palmspringsevents.net steelglossary.com haveniconnect.com beautifulreflections.purepointdesign.com" ], [ 136, "u8", " " ], [ 137, "u8", " " ], [ 151, "u8", "0000001DXLHkdSCS58A5mM2BLdw6qY11awCXB5PvrWsE9pDQhl3oXM2EbbN7Gbi455btxEyEwYyWKA4UmxvZDCPQS4LmFR_XtZZWu3A-_bHkd8Yn2fw" ], [ 152, "u8", "0000001DXLHkdSCS58A5mM2BLdw6qY11awCXB5PvrWsE9pDQhl3oXM2EbbN7Gbi455btxEyEwYyWKA4UmxvZDCPQS4LmFR_XtZZWu3A-_bHkd8Yn2fw" ], [ 280, "u8", "p" ], [ 281, "u8", "p" ], [ 296, "u8", "h" ], [ 297, "u8", "h" ], [ 368, "u8", "M" ], [ 369, "u8", "M" ], [ 372, "u8", "SXML2.XMLHTTP" ], [ 373, "u8", "SXML2.XMLHTTP" ], [ 412, "u8", "G" ], [ 413, "u8", "G" ], [ 416, "u8", "E" ], [ 417, "u8", "E" ], [ 420, "u8", "T" ], [ 421, "u8", "T" ], [ 457, "u8", "/" ], [ 458, "u8", "/" ], [ 474, "u8", "t" ], [ 475, "u8", "t" ], [ 504, "u8", "t" ], [ 505, "u8", "t" ], [ 538, "u8", "counter" ], [ 539, "u8", "counter" ], [ 557, "u8", "?" ], [ 558, "u8", "?" ], [ 738, "u8", "a" ], [ 739, "u8", "a" ] ], "v": { "source.language": "javascript", "source.imports[0]": "WScript.CreateObject", "source.imports[1]": "amn", "source.imports[2]": "e.open", "source.imports[3]": "e.send", "source.imports[4]": "eval", "source.imports[5]": "ih", "source.imports[6]": "ikagdh", "source.imports[7]": "kt", "source.imports[8]": "mip", "source.imports[9]": "r.indexOf", "source.strings[0]": "0000001DXLHkdSCS58A5mM2BLdw6qY11awCXB5PvrWsE9pDQhl3oXM2EbbN7Gbi455btxEyEwYyWKA4UmxvZDCPQS4LmFR_XtZZWu3A-_bHkd8Yn2fw", "source.strings[1]": "SXML2.XMLHTTP", "source.strings[2]": "counter", "source.strings[3]": "yst.orlyreznik.com palmspringsevents.net steelglossary.com haveniconnect.com beautifulreflections.purepointdesign.com", "source.has_imports": true, "source.imports[10]": "r.split", "source.imports[11]": "r.split.join", "source.imports[12]": "tjkh", "source.imports[13]": "zn", "source.imports[14]": "zx" }, "ca": [ [ "WScript.CreateObject", "M" ], [ "WScript.CreateObject", "SXML2.XMLHTTP" ], [ "e.open", "" ], [ "e.open", ":" ], [ "e.open", "?" ], [ "e.open", "counter" ], [ "e.open", "t" ], [ "r.split().join", "a" ] ], "ct": [ "WScript.CreateObject", "e.open", "e.send", "eval", "r.indexOf", "r.split", "r.split().join" ], "id": "javascript", "mc": [ "WScript.CreateObject", "e.open", "e.responseText", "e.send", "r.indexOf", "r.length", "r.split", "r.split().join", "x.length" ] }, "id": 0, "sz": 808, "ts": [ { "c": 0.800000011920929, "d": "WScript marker", "e": [ "WScript" ], "i": "micro-behaviors/process/create/script/wsh::wscript-marker", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "ADODB.Stream Open method call", "e": [ ".open(" ], "i": "micro-behaviors/fs/write/stream::adodb-open", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "XMLHTTP/WinHTTP COM ProgID reference", "e": [ "XMLHTTP" ], "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-com-progid-text", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "join(" ], "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "JavaScript static key string assignment", "e": [ "= \"yst.orlyreznik.com palmspringsevents.net steelglossary.com haveniconnect.com beautifulreflections.purepointdesign.com\"" ], "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Decoded property function alias", "e": [ "var tjkh = x[i]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "a": "T1059.005", "c": 0.800000011920929, "d": "WScript.CreateObject call", "e": [ "WScript.CreateObject(" ], "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-createobject-dup", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12", "l": 1, "m": "B0032" }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for (var i=0; i\u003cx.length; i++)\r\n{\t\r\n\tvar e = WScript.CreateObject(\"M\"+\"SXML2.XMLHTTP\");\r\n\ttry\r\n\t{\r\n\t..." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 0.800000011920929, "d": "URL path fragment 'unte' (part of /counter/)", "e": [ "counter" ], "i": "objectives/command-and-control/channel/http/uri::uri-fragment-counter-path-unte", "l": 1 }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ "\nfor (" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "c": 0.8199999928474426, "d": "JavaScript substring search call", "e": [ "indexOf(" ], "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "l": 2 }, { "c": 0.949999988079071, "d": "eval/new Function call (flatted tamper fragment)", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 34.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.949999988079071, "d": "JavaScript or TypeScript basename", "e": [ "20170318_3170ec01a7c33215b9b942e6679208b0.js" ], "i": "metadata/lang/source::js-ts-source-basename", "l": 2 }, { "c": 0.699999988079071, "d": "Single character string concatenation pattern", "e": [ "\"+\"E\"+" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::single-char-concat-pattern", "l": 3 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170318_3170ec01a7c33215b9b942e6679208b0.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.800000011920929, "d": "Variable-based split with token delimiter", "e": [ ".split(m)" ], "i": "objectives/anti-static/obfuscation/string/conceal::js-var-split-marker", "l": 2 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "send" ], "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "eval() function call (raw)", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::js-eval-raw", "l": 3 }, { "c": 1.0, "d": "Tiny XMLHTTP fragment (variant 2)", "e": [ ".XMLHT" ], "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2", "l": 1 }, { "c": 0.699999988079071, "d": "JavaScript file under 5KB", "e": [ "20170318_3170ec01a7c33215b9b942e6679208b0.js" ], "i": "metadata/file/text/metrics::javascript-small-file-5k", "l": 1 }, { "a": "T1195.002", "c": 0.75, "d": "eval() with dynamic argument", "e": [ "eval" ], "i": "objectives/supply-chain/hidden-payload/staging::eval-function-call-arg", "l": 3 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "eval on decoded variable", "e": [ "eval(ikagdh)" ], "i": "objectives/execution/interpreter/eval/dynamic::array-eval-variable", "l": 3 }, { "c": 0.699999988079071, "d": "Access to HTTP response body (.responseText)", "e": [ ".responseText" ], "i": "micro-behaviors/communications/http/client/response-body::response-text", "l": 3 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(e)\r\n\t{\r\n\t}" ], "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors", "l": 1 }, { "c": 0.8999999761581421, "d": "String split to array assignment", "e": [ "split" ], "i": "micro-behaviors/data/string/split::js-split-string-array", "l": 2 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(e)\r\n\t{\r\n\t}" ], "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "l": 1, "m": "B0024" } ], "sha": "4e2ce14ae29e8aec4d9e2eaed28c00c384c847e492fb248f9e26ebf9e935683f", "path": "20170318_3170ec01a7c33215b9b942e6679208b0.js", "type": "javascript" } ], "tv": "cf883" } }