{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.5541810393333435 } ], "prob": 0.55418104, "models": [ { "m": "az", "raw": 0.55418104, "prob": 0.55418104, "class": 0 }, { "m": "az/scripts", "raw": 0.93189573, "prob": 0.93189573, "class": 0 }, { "m": "az/batch", "raw": 0.0019753773, "prob": 0.0019753773, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T07:51:12Z" }, "path": "InstallerOfficeV13a.cmd", "raw": { "v": "6", "fs": [ { "f": "O(As)H(Db)", "x": 34, "ff": { "m": { "ast": { "max_depth": 17.0, "call_count": 228.0, "node_count": 2657.0, "identifier_count": 52.0, "string_literal_count": 112.0 }, "file": { "size": 16504.0, "entropy": 5.28, "size_bytes": 16504.0 }, "text": { "digit_ratio": 0.08, "space_count": 1539.0, "total_lines": 419.0, "char_entropy": 5.28, "unique_chars": 86.0, "escape_density": 0.25, "lines_over_200": 10.0, "string_density": 0.27, "ascii_art_lines": 4.0, "avg_line_length": 37.39, "max_line_length": 440.0, "empty_line_ratio": 0.2, "last_line_length": 9.0, "long_token_count": 10.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.08, "identifier_density": 0.73, "line_length_stddev": 57.5, "octal_escape_count": 30.0, "unicode_escape_count": 11.0, "normalized_string_count": 5.47, "repeated_char_sequences": 4.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 6.0, "trailing_whitespace_lines": 2.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 5.97 }, "calls": { "count": 228.0 }, "binary": { "overall_entropy": 5.28 }, "strings": { "total": 112.0, "avg_length": 33.9, "max_length": 125.0, "path_count": 1.0, "avg_entropy": 3.89, "total_bytes": 3797.0, "entropy_stddev": 0.65 }, "identifiers": { "count": 52.0, "total": 305.0, "avg_length": 7.27, "max_length": 16.0, "min_length": 2.0, "avg_entropy": 2.39, "reuse_ratio": 0.17, "unique_count": 52.0, "length_stddev": 3.37, "has_digit_ratio": 0.42, "all_lowercase_ratio": 0.35, "numeric_suffix_count": 9.0 } }, "s": [ [ 90, "u8", "%windir%\\system32\\reg.exe" ], [ 150, "u8", "%windir%\\system32\\find.exe" ], [ 211, "u8", "%windir%\\system32\\findstr.exe" ], [ 273, "u8", "%temp%\\*.burf" ], [ 294, "u8", "%temp%\\*.burf" ], [ 318, "u8", "%~dp0" ], [ 329, "u8", "%windir%\\system32\\reg.exe" ], [ 363, "u8", "HKU\\S-1-5-19" ], [ 915, "u8", "%windir%\\system32\\reg.exe" ], [ 949, "u8", "hklm\\software\\microsoft\\Windows NT\\currentversion" ], [ 1041, "u8", "AMD64" ], [ 1133, "u8", "%temp%\\os.txt" ], [ 1152, "u8", "%windir%\\system32\\reg.exe" ], [ 1186, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\Common\\InstallRoot" ], [ 1333, "u8", "%windir%\\system32\\reg.exe" ], [ 1367, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\14.0\\Common\\InstallRoot" ], [ 1508, "u8", "%windir%\\system32\\reg.exe" ], [ 1542, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Microsoft\\Office\\14.0\\Common\\InstallRoot" ], [ 1756, "u8", "%windir%\\system32\\reg.exe" ], [ 1790, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Wow6432Node\\Microsoft\\Office\\14.0\\Common\\InstallRoot" ], [ 2106, "u8", "%%G %%Haddins\\otkloadr_x64.dll" ], [ 2211, "u8", "%%G %%Haddins\\otkloadr.dll" ], [ 2322, "u8", "%windir%\\system32\\reg.exe" ], [ 2356, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\Common\\InstallRoot" ], [ 2503, "u8", "%windir%\\system32\\reg.exe" ], [ 2537, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Common\\InstallRoot" ], [ 2678, "u8", "%windir%\\system32\\reg.exe" ], [ 2712, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Microsoft\\Office\\15.0\\Common\\InstallRoot" ], [ 2926, "u8", "%windir%\\system32\\reg.exe" ], [ 2960, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Wow6432Node\\Microsoft\\Office\\15.0\\Common\\InstallRoot" ], [ 3272, "u8", "%%G %%Haddins\\otkloadr_x64.dll" ], [ 3377, "u8", "%%G %%Haddins\\otkloadr.dll" ], [ 3669, "u8", "%drive%%%G (x86)\\%%Haddins\\otkloadr_x64.dll" ], [ 3841, "u8", "%temp%\\offpath.burf" ], [ 3971, "u8", "%windir%\\system32\\reg.exe" ], [ 4005, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 4149, "u8", "%windir%\\system32\\reg.exe" ], [ 4183, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 4288, "u8", "%windir%\\system32\\reg.exe" ], [ 4322, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 4481, "u8", "%windir%\\system32\\reg.exe" ], [ 4515, "u8", "Microsoft\\Office\\14.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 4704, "u8", "%windir%\\system32\\reg.exe" ], [ 4738, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 4902, "u8", "%windir%\\system32\\reg.exe" ], [ 4936, "u8", "SOFTWARE\\Microsoft\\Office\\14.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Wow6432Node\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 5329, "u8", "%windir%\\system32\\reg.exe" ], [ 5363, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 5507, "u8", "%windir%\\system32\\reg.exe" ], [ 5541, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 5646, "u8", "%windir%\\system32\\reg.exe" ], [ 5680, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 5839, "u8", "%windir%\\system32\\reg.exe" ], [ 5873, "u8", "Microsoft\\Office\\15.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 6062, "u8", "%windir%\\system32\\reg.exe" ], [ 6096, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 6260, "u8", "%windir%\\system32\\reg.exe" ], [ 6294, "u8", "SOFTWARE\\Microsoft\\Office\\15.0\\ClickToRun\\REGISTRY\\MACHINE\\Software\\Wow6432Node\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 6600, "u8", "%loc%" ], [ 6613, "u8", "%temp%\\prodver.burf" ], [ 7122, "u8", "%windir%\\system32\\findstr.exe" ], [ 7160, "u8", "kb2687455" ], [ 7172, "u8", "%temp%\\update1.burf" ], [ 7219, "u8", "%windir%\\system32\\findstr.exe" ], [ 7257, "u8", "superseded" ], [ 7270, "u8", "%temp%\\update1a.burf" ], [ 7508, "u8", "%windir%\\system32\\findstr.exe" ], [ 7546, "u8", "kb2817430" ], [ 7558, "u8", "%temp%\\update2.burf" ], [ 7605, "u8", "%windir%\\system32\\findstr.exe" ], [ 7643, "u8", "superseded" ], [ 7656, "u8", "%temp%\\update2a.burf" ], [ 8030, "u8", "%windir%\\system32\\reg.exe" ], [ 8064, "u8", "hklm\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products" ], [ 8153, "u8", "(KB" ], [ 8191, "u8", "%windir%\\system32\\find.exe" ], [ 8223, "u8", "Update" ], [ 8232, "u8", "%temp%\\installed.burf" ], [ 8283, "u8", "%windir%\\system32\\find.exe" ], [ 8315, "u8", "Hotfix" ], [ 8324, "u8", "%temp%\\installed.burf" ], [ 8501, "u8", "%temp%\\installed3.burf" ], [ 8568, "u8", "%windir%\\system32\\findstr.exe" ], [ 8609, "u8", "%temp%\\installed3.burf" ], [ 8634, "u8", "%temp%\\filelist1.burf" ], [ 8709, "u8", "%windir%\\system32\\findstr.exe" ], [ 8750, "u8", "%temp%\\installed3.burf" ], [ 8775, "u8", "%temp%\\filelist2.burf" ], [ 8880, "u8", "%temp%\\filelist1.burf" ], [ 8913, "u8", "%temp%\\filelist1.burf" ], [ 8937, "u8", "%temp%\\installer1.burf" ], [ 8978, "u8", "%temp%\\filelist2.burf" ], [ 9011, "u8", "%temp%\\filelist2.burf" ], [ 9035, "u8", "%temp%\\installer2.burf" ], [ 9081, "u8", "%temp%\\installer1.burf" ], [ 9187, "u8", "%temp%\\installer2.burf" ], [ 9333, "u8", "%temp%\\installer1.burf" ], [ 9410, "u8", "%temp%\\installer2.burf" ], [ 9550, "u8", "%temp%\\installer1.burf" ], [ 9694, "u8", "%temp%\\installer2.burf" ], [ 10138, "u8", "%installer%" ], [ 10953, "u8", "Please enter your selection\u003e " ], [ 11171, "u8", "%temp%\\*.burf" ], [ 11191, "u8", "%temp%\\*.burf" ], [ 11893, "u8", "Please enter your selection\u003e " ], [ 13595, "u8", "%windir%\\system32\\findstr.exe" ], [ 13630, "u8", "kb2687455" ], [ 13642, "u8", "%temp%\\update1.burf" ], [ 13775, "u8", "%windir%\\system32\\findstr.exe" ], [ 13810, "u8", "kb2883095" ], [ 13822, "u8", "%temp%\\update2.burf" ], [ 15106, "u8", "%installer%" ] ], "v": { "file.stem": "InstallerOfficeV13a", "file.basename": "InstallerOfficeV13a.cmd", "source.language": "batch" }, "id": "batch" }, "id": 0, "sz": 16504, "ts": [ { "c": 0.7200000286102295, "d": "LLM instruction context", "e": [ "prompt" ], "i": "micro-behaviors/data/text/llm/override::llm-instruction-context", "l": 1 }, { "c": 0.6000000238418579, "d": "Echo off", "e": [ "@echo off" ], "i": "objectives/command-and-control/dropper/execution/batch::echo-off", "l": 1 }, { "c": 0.699999988079071, "d": "Redirect output to null", "e": [ "\u003enul" ], "i": "objectives/command-and-control/dropper/execution/batch::redirect-null", "l": 1 }, { "a": "T1105", "c": 0.7799999713897705, "d": "Loader key argument hint", "e": [ " location\r" ], "i": "objectives/command-and-control/dropper/execution/batch::rc4-key-argument-hint", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 419.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.550000011920929, "d": "Stdout redirected to NUL", "e": [ "\u003enul" ], "i": "micro-behaviors/os/console/io::windows-stdout-to-nul", "l": 2 }, { "c": 1.0, "d": "echo off batch command", "e": [ "@echo off" ], "i": "objectives/command-and-control/dropper/builder::echo-off-batch", "l": 1 }, { "c": 1.0, "d": "echo percent batch pattern", "e": [ "echo %installer%" ], "i": "objectives/command-and-control/dropper/builder::echo-percent", "l": 1 }, { "a": "T1547.001", "c": 0.6000000238418579, "d": "Run value name string", "e": [ "Run" ], "i": "objectives/persistence/login/startup/registry::run-value-name", "l": 1 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Batch has long encoded token", "e": [ "text.long_token_count = 10.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token", "l": 1 }, { "c": 0.4000000059604645, "d": "Call local batch label", "e": [ "call :title" ], "i": "objectives/command-and-control/dropper/execution/batch::call-label", "l": 1 }, { "c": 0.8199999928474426, "d": "Batch multiple file gates", "e": [ "if exist \"%temp%\\*.burf\" (" ], "i": "micro-behaviors/fs/path/check::batch-multiple-if-exist-gates", "l": 1 }, { "c": 1.0, "d": "Windows command script extension", "e": [ "InstallerOfficeV13a.cmd" ], "i": "metadata/file/extension::cmd", "l": 2 }, { "c": 0.800000011920929, "d": "Batch start label", "e": [ ":start" ], "i": "micro-behaviors/data/control-flow/loop::batch-label-start", "l": 3 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.6000000238418579, "d": "Clipboard keyword", "e": [ "clipboard" ], "i": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "l": 1 }, { "c": 1.0, "d": "Contains %TEMP% environment variable string", "e": [ "%TEMP%" ], "i": "micro-behaviors/os/env/vars/access::temp-env-var", "l": 2 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "start" ], "i": "objectives/command-and-control/dropper/execution/batch::keyed-temp-payload-launch--rx-1", "l": 1 }, { "c": 0.8799999952316284, "d": "msiexec unattended install switch", "e": [ "/quiet" ], "i": "objectives/execution/lolbin/os::msiexec-unattended-switch", "l": 1 }, { "c": 0.699999988079071, "d": "Windows %TEMP% or %TMP% environment reference", "e": [ "%temp%" ], "i": "micro-behaviors/fs/path/temp::win-temp-env", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "clipboard keyword (doc-context)", "e": [ "clipboard" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11763", "l": 1 }, { "c": 0.800000011920929, "d": "Numeric infix obfuscation (e.g. com0715press)", "e": [ "office2010arch" ], "i": "objectives/anti-static/obfuscation/name-mangling/variables::numeric-infix", "l": 4 } ], "sha": "59edb5521dbd89788b010db850595b6f4ea7e5c19e6f26ccb36a274e81fc1d71", "path": "InstallerOfficeV13a.cmd", "type": "batch" } ], "tv": "8e9ac" } }