{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9998843669891357,
        "class": 2
      }
    ],
    "prob": 0.99988437,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.99617493,
        "class": 2
      },
      {
        "m": "az/scripts",
        "prob": 0.9939611,
        "class": 1
      },
      {
        "m": "az/javascript",
        "prob": 0.99988437,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-07T06:54:28Z"
  },
  "path": "20170505_e62ba581f7adf69da43e45cd295b9c07.js",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₅(As₃C₆S₆Xe₄Er)H₄(Cm₂Po₃DbF₂)Md₂(Pt)",
        "k": {
          "source.imports[0]": "WScript.CreateObject",
          "source.imports[1]": "abatae",
          "source.imports[2]": "beeraa.send",
          "source.imports[3]": "dfs",
          "source.imports[4]": "emisogh",
          "source.imports[5]": "eval",
          "source.imports[6]": "feni",
          "source.imports[7]": "fijks",
          "source.imports[8]": "fontu",
          "source.imports[9]": "fuu1.join",
          "source.strings[0]": "\u0014QE\u0014QE\u0014QE",
          "source.strings[1]": "9LD2w4G1hE3ye0yKXMxIcXYkXftV7A38QrpUAzeJlumVmWllpTZm643gDyibq14yO4t8JMIs6rNHtz1Z4vb30TEUa43hSh01dXG4uzwA6l2eyfPrfG2fTWhT2NNCywMKfifAy7vSXd6ISpa6xqE6vDbahPWOCYhyLsm8Q98hekZwTi3ZbwaTM",
          "source.strings[2]": "FFFFFFFFFFFF",
          "source.strings[3]": "MSXML2.XMLHTT",
          "source.strings[4]": "concoursdlemons.com/images",
          "source.strings[5]": "counter",
          "source.strings[6]": "demirbasetiketi.net/wp-content/uploads/2017/03/",
          "source.strings[7]": "http://",
          "source.strings[8]": "ikincielesyaevi.com/wp-admin/includes",
          "source.strings[9]": "mustafakemalerturk.com/wp-content/uploads/2017/03/",
          "source.has_imports": true,
          "source.imports[10]": "fuuu",
          "source.imports[11]": "ghyt",
          "source.imports[12]": "got",
          "source.imports[13]": "grohot",
          "source.imports[14]": "guznam",
          "source.imports[15]": "gyt",
          "source.imports[16]": "hunko.open",
          "source.imports[17]": "jista",
          "source.imports[18]": "joshua",
          "source.imports[19]": "kjg.split",
          "source.imports[20]": "muhter",
          "source.imports[21]": "nami",
          "source.imports[22]": "r.indexOf",
          "source.imports[23]": "rima",
          "source.imports[24]": "tjkh",
          "source.imports[25]": "zmei",
          "source.strings[10]": "pirogimoskva.ru/components/com_seyret",
          "source.functions[0]": "abatae",
          "source.functions[1]": "fuuu",
          "source.functions[2]": "grohot",
          "source.functions[3]": "jista",
          "source.functions[4]": "muhter"
        },
        "x": 37,
        "id": 0,
        "is": [
          "hunko.open",
          "fuu1.join",
          "kjg.split",
          "fijks",
          "dfs",
          "WScript.CreateObject",
          "joshua",
          "gyt",
          "feni",
          "ghyt",
          "tjkh",
          "nami",
          "zmei",
          "grohot",
          "abatae",
          "rima",
          "got",
          "fontu",
          "emisogh",
          "r.indexOf",
          "guznam",
          "fuuu",
          "muhter",
          "jista",
          "beeraa.send",
          "eval"
        ],
        "ms": {
          "file": {
            "size": 1431.0
          },
          "text": {
            "tab_count": 54.0,
            "digit_ratio": 0.1,
            "space_count": 93.0,
            "total_lines": 44.0,
            "char_entropy": 5.73,
            "unique_chars": 85.0,
            "import_density": 59.09,
            "lines_over_200": 2.0,
            "string_density": 1.05,
            "avg_line_length": 30.57,
            "max_line_length": 286.0,
            "empty_line_ratio": 0.05,
            "last_line_length": 33.0,
            "long_token_count": 2.0,
            "most_common_char": "a",
            "whitespace_ratio": 0.16,
            "most_common_ratio": 0.04,
            "identifier_density": 1.7,
            "line_length_stddev": 52.31,
            "encoded_string_ratio": 0.04,
            "normalized_import_count": 3.92,
            "normalized_string_count": 6.93,
            "repeated_char_sequences": 1.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.75,
            "trailing_whitespace_lines": 2.0,
            "imports_to_functions_ratio": 5.2,
            "strings_to_functions_ratio": 9.2,
            "suspicious_identifier_ratio": 0.17,
            "normalized_unique_identifiers": 6.41,
            "identifiers_to_functions_ratio": 7.0
          },
          "imports": {
            "total": 26.0,
            "unique_modules": 26.0,
            "third_party_count": 26.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 46.0,
            "url_count": 2.0,
            "avg_length": 18.96,
            "max_length": 181.0,
            "avg_entropy": 1.65,
            "hex_strings": 2.0,
            "total_bytes": 872.0,
            "entropy_stddev": 1.89,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {
            "total": 5.0,
            "one_liners": 5.0,
            "avg_name_length": 5.4,
            "no_params_count": 5.0,
            "avg_length_lines": 1.0,
            "max_length_lines": 1.0,
            "min_length_lines": 1.0,
            "density_per_100_lines": 11.36,
            "code_in_functions_ratio": 0.11
          },
          "identifiers": {
            "total": 75.0,
            "avg_length": 4.09,
            "max_length": 7.0,
            "min_length": 1.0,
            "avg_entropy": 1.75,
            "reuse_ratio": 0.47,
            "unique_count": 35.0,
            "length_stddev": 1.61,
            "has_digit_ratio": 0.14,
            "sequential_names": 6.0,
            "single_char_count": 3.0,
            "single_char_ratio": 0.09,
            "all_lowercase_ratio": 0.8,
            "numeric_suffix_count": 5.0
          }
        },
        "ss": [
          [
            177,
            "MSXML2.XMLHTT"
          ],
          [
            178,
            "MSXML2.XMLHTT"
          ],
          [
            232,
            "P"
          ],
          [
            233,
            "P"
          ],
          [
            262,
            "/"
          ],
          [
            263,
            "/"
          ],
          [
            270,
            "/"
          ],
          [
            271,
            "/"
          ],
          [
            275,
            "GET"
          ],
          [
            276,
            "GET"
          ],
          [
            287,
            "p"
          ],
          [
            288,
            "p"
          ],
          [
            296,
            "S"
          ],
          [
            297,
            "S"
          ],
          [
            301,
            "a"
          ],
          [
            302,
            "a"
          ],
          [
            306,
            "T"
          ],
          [
            307,
            "T"
          ],
          [
            315,
            "PILKU"
          ],
          [
            316,
            "PILKU"
          ],
          [
            324,
            "FFFFFFFFFFFF"
          ],
          [
            325,
            "FFFFFFFFFFFF"
          ],
          [
            340,
            "9LD2w4G1hE3ye0yKXMxIcXYkXftV7A38QrpUAzeJlumVmWllpTZm643gDyibq14yO4t8JMIs6rNHtz1Z4vb30TEUa43hSh01dXG4uzwA6l2eyfPrfG2fTWhT2NNCywMK"
          ],
          [
            341,
            "9LD2w4G1hE3ye0yKXMxIcXYkXftV7A38QrpUAzeJlumVmWllpTZm643gDyibq14yO4t8JMIs6rNHtz1Z4vb30TEUa43hSh01dXG4uzwA6l2eyfPrfG2fTWhT2NNCywMK"
          ],
          [
            536,
            "concoursdlemons.com/images"
          ],
          [
            537,
            "concoursdlemons.com/images"
          ],
          [
            565,
            "mustafakemalerturk.com/wp-content/uploads/2017/03/"
          ],
          [
            566,
            "mustafakemalerturk.com/wp-content/uploads/2017/03/"
          ],
          [
            618,
            "pirogimoskva.ru/components/com_seyret"
          ],
          [
            619,
            "pirogimoskva.ru/components/com_seyret"
          ],
          [
            658,
            "ikincielesyaevi.com/wp-admin/includes"
          ],
          [
            659,
            "ikincielesyaevi.com/wp-admin/includes"
          ],
          [
            698,
            "demirbasetiketi.net/wp-content/uploads/2017/03/"
          ],
          [
            699,
            "demirbasetiketi.net/wp-content/uploads/2017/03/"
          ],
          [
            915,
            "counter"
          ],
          [
            916,
            "counter"
          ],
          [
            940,
            "http://"
          ],
          [
            941,
            "http://"
          ],
          [
            999,
            "/"
          ],
          [
            1000,
            "/"
          ],
          [
            1008,
            "?"
          ],
          [
            1009,
            "?"
          ],
          [
            1269,
            "a"
          ],
          [
            1270,
            "a"
          ],
          [
            239,
            "base64",
            "\u0014QE\u0014QE\u0014QE"
          ]
        ],
        "sz": 1431,
        "ts": [
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "Hardcoded .ru domain",
            "e": [
              "\"pirogimoskva.ru/"
            ],
            "i": "objectives/command-and-control/infrastructure/domain/heuristic::hardcoded-domain-ru",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "crip"
            ],
            "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "content"
            ],
            "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-2",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "join() function wrapper",
            "e": [
              "return fuu1.join(fuu2);"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-join-wrapper",
            "l": 4
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "send"
            ],
            "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "split() function wrapper",
            "e": [
              "return kjg.split(lki);"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-split-wrapper",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "indexOf"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::management-id-comparison--rx-8",
            "l": 1
          },
          {
            "a": "T1110.001",
            "c": 0.20000000298023224,
            "d": "admin keyword",
            "e": [
              "admin"
            ],
            "i": "micro-behaviors/data/text/keywords/username::admin-keyword",
            "l": 2,
            "m": "B0028"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "split"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "ADODB.Stream Open method call",
            "e": [
              ".open("
            ],
            "i": "micro-behaviors/fs/write/stream::adodb-open",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "Decoded property function alias",
            "e": [
              "var feni = joshua[12]"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "demirbasetiketi.net/wp-content/uploads/2017/03/",
              "mustafakemalerturk.com/wp-content/uploads/2017/03/"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.9300000071525574,
            "d": "Token-array MSXML2 XML fragment",
            "e": [
              "MSXML2.XML"
            ],
            "i": "objectives/command-and-control/dropper/execution/string-reconstruct::token-array-msxml-xml-fragment",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Regex component marker",
            "e": [
              "ghyt = false;"
            ],
            "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "20170505_e62ba581f7adf69da43e45cd295b9c07.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "a": "T1036.008",
            "c": 0.949999988079071,
            "d": "Filename has .js extension",
            "e": [
              "20170505_e62ba581f7adf69da43e45cd295b9c07.js"
            ],
            "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name",
            "l": 1,
            "m": "F0008"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              "split"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "eval/Function call inside flatted-shaped file",
            "e": [
              "eval("
            ],
            "i": "well-known/lib/flatted::flatted-tamper-eval",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              "split"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 44.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "JScript file type (WScript host)",
            "e": [
              "WScript"
            ],
            "i": "micro-behaviors/process/interpreter/jscript::is-jscript",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "WebSocket sends data to peer",
            "e": [
              ".send("
            ],
            "i": "micro-behaviors/communications/websocket/server::websocket-send",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTP protocol prefix",
            "e": [
              "http://"
            ],
            "i": "micro-behaviors/communications/http/protocol::http-prefix",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "a": "T1059.005",
            "c": 0.800000011920929,
            "d": "WScript.CreateObject call",
            "e": [
              "WScript.CreateObject("
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-createobject-dup",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "URL path fragment 'unte' (part of /counter/)",
            "e": [
              "counter"
            ],
            "i": "objectives/command-and-control/channel/http/uri::uri-fragment-counter-path-unte",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 6.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "ClickFix copy-paste action word",
            "e": [
              "open"
            ],
            "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 1.0,
            "d": "Infinite loop structure (e.g. for(;;) or while(1))",
            "e": [
              "while(true)"
            ],
            "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Variable-based split with token delimiter",
            "e": [
              ".split(lki)"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-var-split-marker",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "JavaScript includes method",
            "e": [
              "includes"
            ],
            "i": "metadata/lang/scripted::includes-method",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Tiny XMLHTTP fragment (variant 2)",
            "e": [
              ".XMLHT"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Top-level try/catch empty handler",
            "e": [
              "catch(e)\r\n\t{\r\n\t}"
            ],
            "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty",
            "l": 1,
            "m": "B0024"
          },
          {
            "a": "T1195.002",
            "c": 0.9700000286102295,
            "d": "Empty catch hides loader errors",
            "e": [
              "catch(e)\r\n\t{\r\n\t}"
            ],
            "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "eval on decoded variable",
            "e": [
              "eval(rasp)"
            ],
            "i": "objectives/execution/interpreter/eval/dynamic::array-eval-variable",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.7200000286102295,
            "d": "Mixed hexadecimal and decimal operations",
            "e": [
              "10",
              "450",
              "50+450",
              "10 * 50",
              "1",
              "1+1",
              "50"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/hex::mixed-hex-decimal",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Access to HTTP response body (.responseText)",
            "e": [
              ".responseText"
            ],
            "i": "micro-behaviors/communications/http/client/response-body::response-text",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "eval() function call (raw)",
            "e": [
              "eval"
            ],
            "i": "micro-behaviors/process/interpreter/eval::js-eval-raw",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.73"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 0.75,
            "d": "eval() with dynamic argument",
            "e": [
              "eval"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::eval-function-call-arg",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "Small file under 5KB",
            "e": [
              "20170505_e62ba581f7adf69da43e45cd295b9c07.js"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "WScript.Shell string fragment (WScrip/WScr)",
            "e": [
              "WScr"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Tiny WScript.Shell fragment (variant 2a)",
            "e": [
              "WScri"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Variable split and join concealment",
            "e": [
              ".split(lki)",
              "return fuu1.join(fuu2);"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-variable-split-join-concealment",
            "l": 2
          }
        ],
        "sha": "51bd008a8b1f637c71c3bd36e09273557f419c21116337c3883a0cba58bfa60b",
        "path": "20170505_e62ba581f7adf69da43e45cd295b9c07.js",
        "type": "javascript"
      }
    ],
    "tv": "7f26a"
  }
}