{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.8186332, "rte": "az", "prob": 0.8186332 }, { "cls": 0, "raw": 0.97451097, "rte": "az/scripts", "prob": 0.97451097 }, { "cls": 0, "raw": 0.95880497, "rte": "az/javascript", "prob": 0.95880497 } ], "prob": 0.8186332, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8186331987380981, "type": "javascript" } ], "version": "v18.18", "analyzed_at": "2026-06-14T15:38:20Z" }, "path": "20170401_6488b5fc036553fdad166bc1f6ab2b77.js", "raw": { "v": "7", "tv": "c7b65", "files": [ { "id": 0, "ctx": [ { "a": 0, "b": "By/GlvivYQfGPZ", "l": 1, "n": [ { "c": 3, "d": "Binary op with identical operands (5-5, x===x)", "i": "objectives/anti-static/obfuscation/syntax::js-useless-arithmetic", "o": 0, "z": 29 } ] }, { "a": 12, "b": "Cw7YbwHIUiA=UUijrMvjdsleFA=UUtd)5d*", "l": 2 }, { "a": 41, "b": "C42zlvq67\u003eauZ\u0026+wP]m.A=LPlc){U}egkJ!efWOMr3A\u003eqiWca5A3)g:xEttUqZTazvj9PIr3A\u003evcN?a^", "l": 3 }, { "a": 106, "b": "C42zlD37k)at#p\u003c", "l": 4 }, { "a": 119, "b": "C42zlwGTbUs5SQHx(FeDlVM:DBy!lSygQ)%c)zwfd}9a1BxZBHD39yyb3l3tb27-^e)7?wnk@Ljas!NyxKM0!g+gm=e{82iAbYxelT+4Ec[cPb4f", "l": 5, "n": [ { "c": 3, "d": "Array access with arithmetic index expressions", "i": "objectives/anti-static/obfuscation/syntax::js-array-arithmetic-index", "o": 182, "z": 9 }, { "c": 3, "d": "WScript.CreateObject call", "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-createobject-dup", "o": 127, "z": 21 } ] }, { "a": 209, "b": "4f", "l": 6 }, { "a": 211, "b": "C42zlCPYc(toXnEB73XhxD!#Kyghg4zEEB8xM4^lzfo]lv\u003eInfz6yIPvSb!5yisf4y?W^1v}Yp!y?mG%wIdFhz6yIPx(^%0v@Di#zF9A!v@0Ybz/3WHb4+U1Ab](owPz)ry*?Juv@Didt@@F", "l": 7 }, { "a": 327, "b": "C42zlz6g$:a$$Y8fFCgnib}VrgC%qNyi-SAni]^mgeI1*gJk=%s:rCUl$fj\u0026vn6\u003ccv}!n1B7EmuB#st1x?-RAhB*CUt0UCYA^g5GhFcL!n)$K}gIeTJv}WURt5WbinKt\u003c1ADK3HrzC}RuV{fUy!!FyeK@Pty!^Aji9p5)fD@N/", "l": 8 }, { "a": 464, "b": "C42zlxl!OwjS(Bu4f", "l": 9 }, { "a": 478, "b": "Cw7YbwHIUvB.90h", "l": 10, "n": [ { "c": 2, "d": "Infinite loop structure (e.g. for(;;) or while(1))", "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "o": 478, "z": 11 } ] }, { "a": 491, "b": "DKP", "l": 11 }, { "a": 494, "b": "32a01xl!O.j:nO}wO#d5xEKw", "l": 12 }, { "a": 772, "b": "2)\u003eiLy\u0026:epi$h", "l": 24 }, { "a": 783, "b": "2)\u003ee}B7Gl1c[dj!", "l": 25 }, { "a": 796, "b": "2)\u003e=-AV/xBjS[q*A+frhz/fScraQq@i$h", "l": 26, "n": [ { "c": 3, "d": "Access to HTTP response body (.responseText)", "i": "micro-behaviors/communications/http/client/response-body::response-text", "o": 807, "z": 13 } ] }, { "a": 823, "b": "2)\u003e=-AV/Wwx(a$Qat\u003e\u0026bi$h", "l": 27 }, { "a": 842, "b": "2)\u003e=-AV/1kBrAZ?h83Kqh83LbxLzrB4f", "l": 28 }, { "a": 868, "b": "2)\u003erTasFTUe]k9pxlm/feG!XABsws@ats]+clNsYx(mD)CU.{1z7cO\u003easH(vBsP6$f!+ppdjCY", "l": 29, "n": [ { "c": 2, "d": "JavaScript substring search call", "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "o": 900, "z": 8 } ] }, { "a": 928, "b": "2)\u003e}/", "l": 30 }, { "a": 933, "b": "2)*]Yvr9Gax(mM$auZ\u0026:i$h", "l": 31 }, { "a": 952, "b": "2)*]Yvr9G6xMLvWaAx8QAbolgc#iKmxk5!R4f", "l": 32, "n": [ { "c": 2, "d": "JavaScript split with variable delimiter", "i": "micro-behaviors/data/string/split::js-var-split-marker", "o": 966, "z": 13 } ] }, { "a": 982, "b": "2)*]Yvr9G9x(dZ5auZ\u0026WxML\u003ewz!T8qvq67\u003etq]?rcNQu84f", "l": 33 }, { "a": 1020, "b": "2)*]Lw/@GRau.\u003egf!0L", "l": 34 }, { "a": 1036, "b": "2)*]+2)*[A4f", "l": 35 }, { "a": 1046, "b": "2)*[AwP?G#c#9EkzegmAayO}(BxZ+hdlv$", "l": 36, "n": [ { "c": 3, "d": "eval() function call (raw)", "i": "micro-behaviors/process/interpreter/eval::js-eval-raw", "o": 1050, "z": 4 } ] }, { "a": 1074, "b": "2)*]^4f", "l": 37 }, { "a": 1080, "b": "2)*]EA+eV{i$h", "l": 38 } ], "mol": "O₂(AsXe)H₂(CmPo)", "sha": "4fa91904eb518fddfdb14b9f144c2ec0e551212876cf4c67253301e5313661b3", "fact": { "id": "javascript", "imp": [ [ "", "tersa" ], [ "", "ahat" ], [ "", "yu" ], [ "", "WScript.CreateObject" ], [ "", "gyt" ], [ "", "wecv" ], [ "", "tjkh" ], [ "", "ghaqio" ], [ "", "e.open" ], [ "", "e.send" ], [ "", "zhim" ], [ "", "got" ], [ "", "r.indexOf" ], [ "", "kingi" ], [ "", "ght" ], [ "", "r.split" ], [ "", "jimmk" ], [ "", "ght.join" ], [ "", "eval" ] ], "mbr": [ "WScript.CreateObject", "e.open", "e.responseText", "e.send", "ght.join", "r.indexOf", "r.length", "r.split", "x.length" ], "met": { "ast": { "op.eq": 1.0, "op.ge": 1.0, "op.gt": 2.0, "op.lt": 1.0, "op.add": 29.0, "op.sub": 7.0, "op.land": 1.0, "max_depth": 26.0, "bind_count": 16.0, "call_count": 9.0, "node_count": 574.0, "member_count": 9.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.add": 0.05, "op_density.sub": 0.01, "op_density.land": 0.0, "identifier_count": 28.0, "member_depth_max": 2.0, "self_compare_count": 3.0, "infinite_loop_count": 1.0, "string_literal_count": 25.0, "array_literal_max_length": 5.0, "string_concat_chain_max_length": 17.0 }, "file": { "size": 1132.0, "entropy": 5.63, "size_bytes": 1132.0 }, "text": { "tab_count": 77.0, "digit_ratio": 0.11, "space_count": 68.0, "total_lines": 45.0, "char_entropy": 5.63, "unique_chars": 86.0, "string_density": 0.56, "avg_line_length": 23.2, "max_line_length": 135.0, "empty_line_ratio": 0.02, "last_line_length": 2.0, "long_token_count": 3.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.06, "identifier_density": 1.6, "line_length_stddev": 31.6, "normalized_string_count": 3.73, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 6.0, "most_common_char_codepoint": 97.0, "suspicious_identifier_ratio": 0.14, "normalized_unique_identifiers": 5.1 }, "binds": { "count": 16.0 }, "calls": { "count": 9.0 }, "binary": { "overall_entropy": 5.63 }, "members": { "count": 9.0 }, "strings": { "total": 25.0, "avg_length": 9.76, "max_length": 124.0, "avg_entropy": 1.5, "empty_count": 5.0, "total_bytes": 244.0, "domain_count": 4.0, "entropy_stddev": 1.8, "high_entropy_count": 1.0 }, "identifiers": { "count": 28.0, "total": 72.0, "avg_length": 4.75, "max_length": 12.0, "min_length": 1.0, "avg_entropy": 1.84, "reuse_ratio": 0.39, "unique_count": 28.0, "length_stddev": 2.9, "sequential_names": 4.0, "single_char_count": 4.0, "single_char_ratio": 0.14, "all_lowercase_ratio": 0.79 } }, "str": [ [ 8, "10", "0" ], [ 26, "10", "10" ], [ 62, "u8", "/" ], [ 63, "u8", "/" ], [ 66, "u8", "t" ], [ 67, "u8", "t" ], [ 70, "u8", "GET" ], [ 71, "u8", "GET" ], [ 80, "u8", "p" ], [ 81, "u8", "p" ], [ 84, "u8", "h" ], [ 85, "u8", "h" ], [ 88, "u8", "S" ], [ 89, "u8", "S" ], [ 92, "u8", "a" ], [ 93, "u8", "a" ], [ 96, "u8", "T" ], [ 97, "u8", "T" ], [ 115, "10", "6" ], [ 148, "u8", "M" ], [ 149, "u8", "M" ], [ 157, "10", "0" ], [ 163, "u8", "X" ], [ 164, "u8", "X" ], [ 167, "u8", "ML2.XMLHTT" ], [ 168, "u8", "ML2.XMLHTT" ], [ 187, "10", "4" ], [ 189, "10", "0" ], [ 220, "u8", "w3sa.ch" ], [ 221, "u8", "w3sa.ch" ], [ 230, "u8", "jasonanthonymusic.com" ], [ 231, "u8", "jasonanthonymusic.com" ], [ 254, "u8", "bodyjugglingchallenge.com" ], [ 255, "u8", "bodyjugglingchallenge.com" ], [ 282, "u8", "ishecomingback.com" ], [ 283, "u8", "ishecomingback.com" ], [ 303, "u8", "flapropertylaw.com" ], [ 304, "u8", "flapropertylaw.com" ], [ 335, "u8", "00000018qMy35uSjyPEHAHD2PVm3pEiYyEuDbWJaLZYciBGse6dv5s7iMrP6GLnZAA_rxFN6ffAJaPT3f9Zch36ZpKQIBE0qu2gUNDM_vjMlNcY-GOYlNEh8XnM0" ], [ 336, "u8", "00000018qMy35uSjyPEHAHD2PVm3pEiYyEuDbWJaLZYciBGse6dv5s7iMrP6GLnZAA_rxFN6ffAJaPT3f9Zch36ZpKQIBE0qu2gUNDM_vjMlNcY-GOYlNEh8XnM0" ], [ 474, "10", "0" ], [ 561, "u8", "counter" ], [ 562, "u8", "counter" ], [ 592, "10", "0" ], [ 619, "10", "2" ], [ 621, "10", "1" ], [ 644, "10", "1" ], [ 646, "10", "1" ], [ 662, "10", "1" ], [ 670, "10", "9" ], [ 678, "10", "11" ], [ 681, "10", "10" ], [ 703, "10", "6" ], [ 705, "10", "2" ], [ 713, "10", "3" ], [ 721, "10", "9" ], [ 723, "10", "9" ], [ 731, "10", "0" ], [ 744, "10", "0" ], [ 760, "10", "0" ], [ 763, "u8", "?" ], [ 764, "u8", "?" ], [ 836, "10", "500" ], [ 854, "10", "50" ], [ 857, "10", "450" ], [ 893, "10", "0" ], [ 918, "10", "1" ], [ 920, "10", "1002" ], [ 1011, "10", "7" ], [ 1027, "10", "1" ], [ 1032, "10", "1" ], [ 1068, "10", "9" ] ], "tgt": [ "Array", "WScript.CreateObject", "e.open", "e.send", "eval", "ght.join", "r.indexOf", "r.split" ], "val": { "file.stem": "20170401_6488b5fc036553fdad166bc1f6ab2b77", "file.basename": "20170401_6488b5fc036553fdad166bc1f6ab2b77.js", "source.language": "javascript", "source.imports[0]": "WScript.CreateObject", "source.imports[1]": "ahat", "source.imports[2]": "e.open", "source.imports[3]": "e.send", "source.imports[4]": "eval", "source.imports[5]": "ghaqio", "source.imports[6]": "ght", "source.imports[7]": "ght.join", "source.imports[8]": "got", "source.imports[9]": "gyt", "source.strings[0]": "00000018qMy35uSjyPEHAHD2PVm3pEiYyEuDbWJaLZYciBGse6dv5s7iMrP6GLnZAA_rxFN6ffAJaPT3f9Zch36ZpKQIBE0qu2gUNDM_vjMlNcY-GOYlNEh8XnM0", "source.strings[1]": "ML2.XMLHTT", "source.strings[2]": "bodyjugglingchallenge.com", "source.strings[3]": "counter", "source.strings[4]": "flapropertylaw.com", "source.strings[5]": "ishecomingback.com", "source.strings[6]": "jasonanthonymusic.com", "source.strings[7]": "w3sa.ch", "source.has_imports": true, "source.imports[10]": "jimmk", "source.imports[11]": "kingi", "source.imports[12]": "r.indexOf", "source.imports[13]": "r.split", "source.imports[14]": "tersa", "source.imports[15]": "tjkh", "source.imports[16]": "wecv", "source.imports[17]": "yu", "source.imports[18]": "zhim" } }, "find": [ { "id": "metadata/lang/scripted::length-prop", "conf": 1.0, "crit": 1, "desc": "JavaScript length property" }, { "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4", "atk": "T1027", "mbc": "B0032", "conf": 0.9300000071525574, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/data/string/search::js-includes-indexof-call", "conf": 0.8199999928474426, "crit": 2, "desc": "JavaScript substring search call" }, { "id": "metadata/file/text/format::vocab-array", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary array" }, { "id": "metadata/lang/scripted::plain-js-identifier-assignment", "conf": 1.0, "crit": 1, "desc": "Plain JavaScript identifier assignment" }, { "id": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "conf": 1.0, "crit": 2, "desc": "Infinite loop structure (e.g. for(;;) or while(1))" }, { "id": "micro-behaviors/fs/write/stream::adodb-open", "conf": 1.0, "crit": 1, "desc": "ADODB.Stream Open method call" }, { "id": "objectives/command-and-control/channel/http/uri::uri-fragment-counter-path-unte", "conf": 0.800000011920929, "crit": 1, "desc": "URL path fragment 'unte' (part of /counter/)" }, { "id": "objectives/command-and-control/dropper/execution/string-reconstruct::token-array-response-text-fragment", "atk": "T1059.007", "conf": 0.9399999976158142, "crit": 1, "desc": "Token-array XMLHTTP responseText fragment" }, { "id": "objectives/execution/interpreter/vbscript/interpreter::wscript-createobject-dup", "atk": "T1059.005", "conf": 0.800000011920929, "crit": 3, "desc": "WScript.CreateObject call" }, { "id": "micro-behaviors/process/create/script/wsh::wscript-marker", "conf": 0.800000011920929, "crit": 1, "desc": "WScript marker" }, { "id": "metadata/file/text/metrics::js-readable-source-context", "conf": 0.8999999761581421, "crit": 1, "desc": "Readable JavaScript source context" }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.949999988079071, "crit": 2, "desc": "JavaScript or TypeScript basename" }, { "id": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4", "conf": 0.8399999737739563, "crit": 1, "desc": "path join marker for package.json load composite" }, { "id": "micro-behaviors/process/interpreter/jscript::is-jscript", "conf": 0.800000011920929, "crit": 1, "desc": "JScript file type (WScript host)" }, { "id": "metadata/file/extension::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)" }, { "id": "metadata/file/text/metrics::file-has-30-plus-lines", "conf": 0.8999999761581421, "crit": 1, "desc": "File has 30 or more lines" }, { "id": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "conf": 1.0, "crit": 1, "desc": "JavaScript file basename" }, { "id": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9", "atk": "T1027", "mbc": "B0032", "conf": 0.9300000071525574, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/obfuscation/syntax::js-array-arithmetic-index", "conf": 0.699999988079071, "crit": 3, "desc": "Array access with arithmetic index expressions" }, { "id": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2", "conf": 1.0, "crit": 1, "desc": "Tiny XMLHTTP fragment (variant 2)" }, { "id": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "conf": 1.0, "crit": 1, "desc": "Tiny WScript.Shell fragment (variant 2a)" }, { "id": "micro-behaviors/communications/http/client/response-body::response-text", "conf": 0.699999988079071, "crit": 3, "desc": "Access to HTTP response body (.responseText)" }, { "id": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors", "atk": "T1195.002", "conf": 0.9700000286102295, "crit": 1, "desc": "Empty catch hides loader errors" }, { "id": "micro-behaviors/data/string/split::js-var-split-marker", "conf": 0.800000011920929, "crit": 2, "desc": "JavaScript split with variable delimiter" }, { "id": "objectives/anti-static/obfuscation/syntax::js-useless-arithmetic", "conf": 0.800000011920929, "crit": 3, "desc": "Binary op with identical operands (5-5, x===x)" }, { "id": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "conf": 0.800000011920929, "crit": 1, "desc": "WScript.Shell string fragment (WScrip/WScr)" }, { "id": "micro-behaviors/process/interpreter/eval::js-eval-raw", "conf": 0.699999988079071, "crit": 3, "desc": "eval() function call (raw)" }, { "id": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "atk": "T1195.002", "mbc": "B0024", "conf": 0.699999988079071, "crit": 1, "desc": "Top-level try/catch empty handler" }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.800000011920929, "crit": 1, "desc": "JavaScript split() method call" }, { "id": "metadata/file/text/metrics::javascript-small-file-5k", "conf": 0.699999988079071, "crit": 1, "desc": "JavaScript file under 5KB" } ], "path": "/data/samples/bad/datasets/javascript/javascript-malware-collection/2017/20170401/20170401_6488b5fc036553fdad166bc1f6ab2b77.js", "risk": 4, "size": 1132, "type": "javascript" } ] } }