{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.69427526,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9285714,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-15T16:24:42Z"
  },
  "path": "559d56cb5e008237ab26c5c62240e6c50ae8c0fe5e3e243f9aa2bd87d70be5a9.ps1",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(As₂C)",
        "x": 73,
        "id": 0,
        "ms": {
          "file": {
            "size": 11536461.0
          },
          "text": {
            "digit_ratio": 1.0,
            "space_count": 27.0,
            "total_lines": 15411.0,
            "char_entropy": 3.37,
            "unique_chars": 80.0,
            "lines_over_200": 15408.0,
            "lines_over_500": 15389.0,
            "avg_line_length": 747.59,
            "max_line_length": 814.0,
            "last_line_length": 499.0,
            "long_token_count": 15409.0,
            "most_common_char": ",",
            "whitespace_ratio": 0.0,
            "most_common_ratio": 0.17,
            "line_length_stddev": 22.29,
            "max_inline_whitespace_run": 1.0
          }
        },
        "sz": 11536461,
        "ts": [
          {
            "d": "AST parsing skipped: file size (11266 KB) exceeds the 2-MB safety limit for tree-sitter external scanner serialization",
            "e": [
              "file_size_bytes=11536461 limit_bytes=2097152 tree_sitter_serialization_buffer_bytes=1024"
            ],
            "i": "metadata/analysis/ast-file-too-large",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 814.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "Reflective assembly method invoke",
            "e": [
              ".GetMethod(\"UHBbADLNVDIoRwbs\").Invoke("
            ],
            "i": "objectives/command-and-control/backdoor/loader/managed-reflect::ps-assembly-method-invoke",
            "l": 4,
            "m": "B0024"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 15411.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[math]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Valid PowerShell code",
            "e": [
              "param("
            ],
            "i": "metadata/lang/scripted::ps-valid",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Many long opaque tokens present",
            "e": [
              "text.long_token_count = 15409.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::many-long-tokens",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 747.59"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          }
        ],
        "sha": "559d56cb5e008237ab26c5c62240e6c50ae8c0fe5e3e243f9aa2bd87d70be5a9",
        "path": "559d56cb5e008237ab26c5c62240e6c50ae8c0fe5e3e243f9aa2bd87d70be5a9.ps1",
        "type": "powershell"
      }
    ],
    "tv": "08128"
  }
}