{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9503569602966309, "class": 0 } ], "prob": 0.95035696, "class": 0, "models": [ { "m": "az", "prob": 0.78687125, "class": 0 }, { "m": "az/scripts", "prob": 0.95035696, "class": 0 }, { "m": "az/javascript", "prob": 0.10545129, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T18:03:13Z" }, "path": "20170303_7b7ca63d72bfadf876a1800ae472f8f3.js", "raw": { "v": "4", "fs": [ { "f": "O(Xe)H(Po)", "k": { "source.imports[0]": "Number", "source.imports[1]": "ahogre", "source.imports[2]": "akhyzidn", "source.imports[3]": "aljusfu", "source.imports[4]": "anigybap", "source.imports[5]": "anubig", "source.imports[6]": "ashih", "source.imports[7]": "askac", "source.imports[8]": "atrocez", "source.imports[9]": "avurfafm", "source.strings[0]": " /c \\\"po", "source.strings[1]": " Sys';$", "source.strings[2]": "$ahnar=", "source.strings[3]": "$aqdoci", "source.strings[4]": "$attozv", "source.strings[5]": "$enah=", "source.strings[6]": "$path=", "source.strings[7]": "$ufwanr", "source.strings[8]": "$vciqfe", "source.strings[9]": "($env:t", "source.has_imports": true, "source.imports[10]": "awixwosx", "source.imports[11]": "bkadfobhyv", "source.imports[12]": "boqmuvd", "source.imports[13]": "byrnyqk", "source.imports[14]": "cdazmywz", "source.imports[15]": "criluctixo", "source.imports[16]": "cyhy", "source.imports[17]": "dehogy", "source.imports[18]": "didqezp", "source.imports[19]": "digogj", "source.imports[20]": "dtuhdo", "source.imports[21]": "duhsude", "source.imports[22]": "dujosnu", "source.imports[23]": "efozj", "source.imports[24]": "efqyfeq", "source.imports[25]": "ekisavb", "source.imports[26]": "elcyci", "source.imports[27]": "eludehumz", "source.imports[28]": "encojyvm", "source.imports[29]": "ennyjxycs", "source.imports[30]": "epegnigj", "source.imports[31]": "epemdy", "source.imports[32]": "eqpanovw", "source.imports[33]": "eqyt", "source.imports[34]": "evqar", "source.imports[35]": "ewduhedn", "source.imports[36]": "exyzet", "source.imports[37]": "ezimyno", "source.imports[38]": "fqejebu", "source.imports[39]": "gemsyn", "source.imports[40]": "gipet", "source.imports[41]": "gkunaxna", "source.imports[42]": "growwaf", "source.imports[43]": "grupoc", "source.imports[44]": "hastab", "source.imports[45]": "hidrablo", "source.imports[46]": "hlyvwyd", "source.imports[47]": "hwaxquqekgy", "source.imports[48]": "icawa", "source.imports[49]": "idpava", "source.imports[50]": "igbyfcaqn", "source.imports[51]": "ihzulqu", "source.imports[52]": "ijyseta", "source.imports[53]": "ikugi", "source.imports[54]": "ipgivif", "source.imports[55]": "iqfofyrz", "source.imports[56]": "irecogro", "source.imports[57]": "irige", "source.imports[58]": "itmylheca", "source.imports[59]": "izqomsezq", "source.imports[60]": "jlyjite", "source.imports[61]": "jonu", "source.imports[62]": "jyntuges", "source.imports[63]": "jzotgo", "source.imports[64]": "jzygogjo", "source.imports[65]": "kotig", "source.imports[66]": "kvyscyzr", "source.imports[67]": "livuvmovku", "source.imports[68]": "lobji", "source.imports[69]": "mbeckoc", "source.imports[70]": "mgitsukvu", "source.imports[71]": "mholob", "source.imports[72]": "miro", "source.imports[73]": "mlysuru", "source.imports[74]": "mvofbug", "source.imports[75]": "mxajlikikc", "source.imports[76]": "nifwa", "source.imports[77]": "njandylsa", "source.imports[78]": "nmigzyt", "source.imports[79]": "nopxosq", "source.imports[80]": "nwenohko", "source.imports[81]": "obgorm", "source.imports[82]": "ocfox", "source.imports[83]": "ofaqqet", "source.imports[84]": "oguko", "source.imports[85]": "ohliqcep", "source.imports[86]": "ojbeshyqe", "source.imports[87]": "oldit", "source.imports[88]": "olkyqpa", "source.imports[89]": "olydxov", "source.imports[90]": "orafi", "source.imports[91]": "oredonj", "source.imports[92]": "orvoze", "source.imports[93]": "otbuxsyf", "source.imports[94]": "oxnop", "source.imports[95]": "pedo", "source.imports[96]": "ppoprigd", "source.imports[97]": "pqybme", "source.imports[98]": "pudat", "source.imports[99]": "qfujep", "source.strings[10]": "(';$gxu", "source.strings[11]": "+$gxuwh", "source.strings[12]": "+$mlemd", "source.strings[13]": "+$ufwan", "source.strings[14]": "-';$omw", "source.strings[15]": ".php?f=", "source.strings[16]": ";$ecgi", "source.strings[17]": ";$ezso", "source.strings[18]": ";$hidar", "source.strings[19]": ";$icoz", "source.strings[20]": ";$idko", "source.strings[21]": ";$isvyl", "source.strings[22]": ";$lbuvi", "source.strings[23]": ";$mlem", "source.strings[24]": ";$onvi", "source.strings[25]": ";$pune", "source.strings[26]": ";$xmoda", "source.strings[27]": "='^ S", "source.strings[28]": "='^ $pa", "source.strings[29]": "='^Scop", "source.strings[30]": "='^ect ", "source.strings[31]": "='^naql", "source.strings[32]": "='^w.fo", "source.strings[33]": "New-Obj", "source.strings[34]": "WScript.Sh", "source.strings[35]": "^.Webc", "source.strings[36]": "^Proce", "source.strings[37]": "^lexas.", "source.strings[38]": "^op/use", "source.strings[39]": "agotibem", "source.strings[40]": "ahnar+$", "source.strings[41]": "ajnidvajzoftesurvumuvqanl", "source.strings[42]": "alyblun", "source.strings[43]": "apebunrotwupem", "source.strings[44]": "aplifopxecixtuv", "source.strings[45]": "aqytkijbe", "source.strings[46]": "ass ", "source.strings[47]": "ath);';", "source.strings[48]": "awfybiqefakgikisb", "source.strings[49]": "b='^1.g", "source.strings[50]": "bbebderwyqowepgywatj", "source.strings[51]": "bgezvefdoxlelwe", "source.strings[52]": "bjyqjepwyvfaswevmajbuzmevjuq", "source.strings[53]": "bwyqudojysxibetruho", "source.strings[54]": "byhu+$u", "source.strings[55]": "c='^oli", "source.strings[56]": "cbibvedelkygmykjufimum", "source.strings[57]": "cess;';", "source.strings[58]": "cigjil", "source.strings[59]": "cju+$rf", "source.strings[60]": "cju='^ ", "source.strings[61]": "cmd.exe", "source.strings[62]": "cozv+$h", "source.strings[63]": "cwofwovr", "source.strings[64]": "cxipukmys", "source.strings[65]": "cy B", "source.strings[66]": "cycuhki", "source.strings[67]": "de='^ro", "source.strings[68]": "dnirnunexocehcadirymtex", "source.strings[69]": "e P';$", "source.strings[70]": "e+$idko", "source.strings[71]": "ebuhxokxuzsaf", "source.strings[72]": "ecgijx+", "source.strings[73]": "efgucagrifwosjasjazapv", "source.strings[74]": "eglyli", "source.strings[75]": "ehnewzelkekapeqsybryh", "source.strings[76]": "ehuvpedjor", "source.strings[77]": "ekucitugkylurywilz", "source.strings[78]": "ellowlakfawipen", "source.strings[79]": "em.Net", "source.strings[80]": "eperelytij", "source.strings[81]": "epycutyqyq", "source.strings[82]": "et-Exe", "source.strings[83]": "evryqek", "source.strings[84]": "ewolyhvurq", "source.strings[85]": "exe'');", "source.strings[86]": "exysicizyclotjibzedudfuc", "source.strings[87]": "ezipugasivvisky", "source.strings[88]": "ezsovx+", "source.strings[89]": "fninvuxa", "source.strings[90]": "fpelqifqiwvelyvhekavupidu", "source.strings[91]": "fudpohaqozwilan", "source.strings[92]": "ghimynakazijyvcihlopnysf", "source.strings[93]": "giwdaqacquzlobukjapejv", "source.strings[94]": "gokjetva", "source.strings[95]": "gurj+$q", "source.strings[96]": "haquhafu", "source.strings[97]": "hiwi='^", "source.strings[98]": "hyqosatogo", "source.strings[99]": "iboqivg", "source.functions[0]": "ahogre", "source.functions[1]": "anubig", "source.functions[2]": "ashih", "source.functions[3]": "askac", "source.functions[4]": "atrocez", "source.functions[5]": "awixwosx", "source.functions[6]": "boqmuvd", "source.functions[7]": "byrnyqk", "source.functions[8]": "cdazmywz", "source.functions[9]": "criluctixo", "source.imports[100]": "qgamdaw", "source.imports[101]": "qlotymta", "source.imports[102]": "qoppaba", "source.imports[103]": "qwibaxne", "source.imports[104]": "ramaze", "source.imports[105]": "rbekgowv", "source.imports[106]": "rimad", "source.imports[107]": "riwazn", "source.imports[108]": "rkifovtixi", "source.imports[109]": "rvohdu", "source.imports[110]": "sice", "source.imports[111]": "snyxky", "source.imports[112]": "suxil", "source.imports[113]": "tabkyjti", "source.imports[114]": "tbohjizo", "source.imports[115]": "tippyza", "source.imports[116]": "tlerpaply", "source.imports[117]": "tpomlegot", "source.imports[118]": "tsifpovewi", "source.imports[119]": "tsywihvufu", "source.imports[120]": "ubakajusn", "source.imports[121]": "udaxcap", "source.imports[122]": "ufarpinxe", "source.imports[123]": "unyqvox", "source.imports[124]": "upnizoqt", "source.imports[125]": "uqex", "source.imports[126]": "urydge", "source.imports[127]": "usrybnicbi", "source.imports[128]": "uwofe", "source.imports[129]": "uwyqut", "source.imports[130]": "uxiq", "source.imports[131]": "uxkut", "source.imports[132]": "vikoxygg", "source.imports[133]": "vokujmy", "source.imports[134]": "vovdy", "source.imports[135]": "vygakah", "source.imports[136]": "vyxzi", "source.imports[137]": "wazryfutze", "source.imports[138]": "weta", "source.imports[139]": "wfektur", "source.imports[140]": "wiwymsa", "source.imports[141]": "wminteml", "source.imports[142]": "xgygolra", "source.imports[143]": "xophagt", "source.imports[144]": "ycacv", "source.imports[145]": "ydone", "source.imports[146]": "yfiqexq", "source.imports[147]": "yfqurnym", "source.imports[148]": "ygjypp", "source.imports[149]": "yhmewjusj", "source.imports[150]": "yhzox", "source.imports[151]": "ylmelo", "source.imports[152]": "ymwax", "source.imports[153]": "ynsajnawi", "source.imports[154]": "yqmijqydre", "source.imports[155]": "yrtuje", "source.imports[156]": "yrxyt", "source.imports[157]": "yvvirc", "source.imports[158]": "yvvyq", "source.imports[159]": "yvysx", "source.imports[160]": "yxkisdotzej", "source.imports[161]": "zante", "source.imports[162]": "zdystu", "source.imports[163]": "zevejgo", "source.imports[164]": "zocen", "source.imports[165]": "zunmat", "source.imports[166]": "zykaja", "source.strings[100]": "iciplasgijymhanuq", "source.strings[101]": "idarc+$", "source.strings[102]": "idbiqbyrtutvahaw", "source.strings[103]": "idtavolyfqubbe", "source.strings[104]": "if'',';", "source.strings[105]": "igdixyljocgeboheq", "source.strings[106]": "ijdamxopetlyfnuputtyjta", "source.strings[107]": "ijuzoxoxferpu", "source.strings[108]": "imaqiv", "source.strings[109]": "imuwidinunfotajac", "source.strings[110]": "ionP';$", "source.strings[111]": "isvylji", "source.strings[112]": "ivyrry", "source.strings[113]": "iwralyjyrtovheklimape", "source.strings[114]": "izxifbajuxu", "source.strings[115]": "jafvecavocozefav", "source.strings[116]": "ji='^em", "source.strings[117]": "jutoslylosonoqcadt", "source.strings[118]": "jx='^en", "source.strings[119]": "knosdy", "source.strings[120]": "ksygvexmoko", "source.strings[121]": "kuqmipvowelarreluvo", "source.strings[122]": "kysw='^", "source.strings[123]": "l $rfy", "source.strings[124]": "lbuvi+$", "source.strings[125]": "le(''ht", "source.strings[126]": "li';$yn", "source.strings[127]": "lsiduxjyhy", "source.strings[128]": "lwiqiltippijr", "source.strings[129]": "lyqx='^", "source.strings[130]": "mnotiqu", "source.strings[131]": "mokfacfupteq", "source.strings[132]": "mpugurj", "source.strings[133]": "mtuvajyxfacpesp", "source.strings[134]": "mxygjemhypiwte", "source.strings[135]": "nah+$as", "source.strings[136]": "nbivarwy", "source.strings[137]": "nefovsobvyqbuwiruwq", "source.strings[138]": "newvuwagpixtiheno", "source.strings[139]": "nicixgovh", "source.strings[140]": "nodvysjedegtagezy", "source.strings[141]": "nvizu+$", "source.strings[142]": "nvoke-E", "source.strings[143]": "obdemiqculucqohwaxvef", "source.strings[144]": "obluksinihi", "source.strings[145]": "odab+$o", "source.strings[146]": "ogesqygvidykuqansitotac", "source.strings[147]": "ohpohuspanrixga", "source.strings[148]": "oj.';$a", "source.strings[149]": "okixodw", "source.strings[150]": "ola'; I", "source.strings[151]": "olujfocajirjencasedn", "source.strings[152]": "on ($om", "source.strings[153]": "onmihivomab", "source.strings[154]": "opydwe", "source.strings[155]": "oqpysupovkyg", "source.strings[156]": "otsamu", "source.strings[157]": "oxiq+$e", "source.strings[158]": "p+''\\\\h", "source.strings[159]": "pippupzibudigupsesviviku", "source.strings[160]": "pvelozuckismemgefe", "source.strings[161]": "pynwekiqi", "source.strings[162]": "qawyfyqubpotryrzyhujrujte", "source.strings[163]": "qhyftaqatqo", "source.strings[164]": "qnowgikixewitoqwyruzn", "source.strings[165]": "qoxiq=", "source.strings[166]": "qwezivwazaczidudv", "source.strings[167]": "qykgenjovgicysbirqowm", "source.strings[168]": "r';$irb", "source.strings[169]": "r+$ynhi", "source.strings[170]": "rbyg+$p", "source.strings[171]": "rbyg='^", "source.strings[172]": "semagdeqafubewbadwa", "source.strings[173]": "ss';$do", "source.strings[174]": "susx='^", "source.strings[175]": "sw+$mpu", "source.strings[176]": "t';$rro", "source.strings[177]": "t).Do';", "source.strings[178]": "tart-';", "source.strings[179]": "th';$at", "source.strings[180]": "thulhojacebukz", "source.strings[181]": "tlajaworriwwebkykizpahvozc", "source.strings[182]": "tosifyjnitu", "source.strings[183]": "tozv='^", "source.strings[184]": "tp://ww", "source.strings[185]": "tqylaburote", "source.strings[186]": "txinpyme", "source.strings[187]": "u+$doky", "source.strings[188]": "ucnifemsogv", "source.strings[189]": "ucvisic", "source.strings[190]": "udixazlehezlucurilwysc", "source.strings[191]": "udygadubr", "source.strings[192]": "ufutewohuxbudsysmehh", "source.strings[193]": "ufyxvymhodkan", "source.strings[194]": "ugqunqedmukxyrettawnamnusehv", "source.strings[195]": "ugtobbubwybxumguxpezm", "source.strings[196]": "uhy='^S", "source.strings[197]": "ujfasbelylofirne", "source.strings[198]": "undefined", "source.strings[199]": "une+$ir", "source.strings[200]": "uqivyzdyxjadwacaqonquvilx", "source.strings[201]": "urmowagazzetdehsidens", "source.strings[202]": "usbifyxedawybiqaqbakci", "source.strings[203]": "usx+$xm", "source.strings[204]": "utoljijonmigfoxitiwo", "source.strings[205]": "utyveknepowlomugosxi", "source.strings[206]": "uvimdy=", "source.strings[207]": "v='^cut", "source.strings[208]": "vciqfe)", "source.strings[209]": "vexhoqjypqohq", "source.strings[210]": "vimdy+$", "source.strings[211]": "vithutqanizavaxegequ", "source.strings[212]": "vjojesinpaqenudiqo", "source.strings[213]": "vogsinjiva", "source.strings[214]": "voleforacfe", "source.strings[215]": "vx='^yp", "source.strings[216]": "walxobbaby", "source.strings[217]": "wdaranad", "source.strings[218]": "wershel", "source.strings[219]": "whu='^i", "source.strings[220]": "wi+$rro", "source.strings[221]": "wnloadF", "source.strings[222]": "wpantafybvybimifyqus", "source.strings[223]": "wuhy+$i", "source.strings[224]": "wwylrekykjejagnacrebqupp", "source.strings[225]": "xpressi", "source.strings[226]": "xpuhtumcoruwwuborgiqiqega", "source.strings[227]": "xuzsykaf", "source.strings[228]": "xvohiwmuscabyqzuhute", "source.strings[229]": "yfqare", "source.strings[230]": "yhgijp", "source.strings[231]": "yhu='^t", "source.strings[232]": "ykvobmyqa", "source.strings[233]": "ylyqx+$", "source.strings[234]": "yqutxiwiqxoxje", "source.strings[235]": "ysarewjezxikxegogt", "source.strings[236]": "yvobdav", "source.strings[237]": "yzbygfosmysabfycyxcaku", "source.strings[238]": "zu='^$p", "source.functions[10]": "cyhy", "source.functions[11]": "dehogy", "source.functions[12]": "didqezp", "source.functions[13]": "digogj", "source.functions[14]": "dtuhdo", "source.functions[15]": "duhsude", "source.functions[16]": "dujosnu", "source.functions[17]": "efozj", "source.functions[18]": "efqyfeq", "source.functions[19]": "ekisavb", "source.functions[20]": "elcyci", "source.functions[21]": "encojyvm", "source.functions[22]": "ennyjxycs", "source.functions[23]": "epegnigj", "source.functions[24]": "epemdy", "source.functions[25]": "eqpanovw", "source.functions[26]": "evqar", "source.functions[27]": "ewduhedn", "source.functions[28]": "exyzet", "source.functions[29]": "fqejebu", "source.functions[30]": "gemsyn", "source.functions[31]": "gipet", "source.functions[32]": "gkunaxna", "source.functions[33]": "growwaf", "source.functions[34]": "grupoc", "source.functions[35]": "hastab", "source.functions[36]": "hidrablo", "source.functions[37]": "hlyvwyd", "source.functions[38]": "icawa", "source.functions[39]": "idpava", "source.functions[40]": "igbyfcaqn", "source.functions[41]": "ihzulqu", "source.functions[42]": "ikugi", "source.functions[43]": "ipgivif", "source.functions[44]": "iqfofyrz", "source.functions[45]": "irige", "source.functions[46]": "izqomsezq", "source.functions[47]": "jlyjite", "source.functions[48]": "jonu", "source.functions[49]": "jzygogjo", "source.functions[50]": "lobji", "source.functions[51]": "mbeckoc", "source.functions[52]": "mgitsukvu", "source.functions[53]": "mholob", "source.functions[54]": "miro", "source.functions[55]": "mvofbug", "source.functions[56]": "nifwa", "source.functions[57]": "nmigzyt", "source.functions[58]": "nwenohko", "source.functions[59]": "ocfox", "source.functions[60]": "ofaqqet", "source.functions[61]": "oguko", "source.functions[62]": "ohliqcep", "source.functions[63]": "oldit", "source.functions[64]": "olkyqpa", "source.functions[65]": "olydxov", "source.functions[66]": "oredonj", "source.functions[67]": "otbuxsyf", "source.functions[68]": "oxnop", "source.functions[69]": "pedo", "source.functions[70]": "pqybme", "source.functions[71]": "pudat", "source.functions[72]": "qfujep", "source.functions[73]": "qlotymta", "source.functions[74]": "qoppaba", "source.functions[75]": "qwibaxne", "source.functions[76]": "ramaze", "source.functions[77]": "rbekgowv", "source.functions[78]": "rimad", "source.functions[79]": "riwazn", "source.functions[80]": "rvohdu", "source.functions[81]": "sice", "source.functions[82]": "snyxky", "source.functions[83]": "suxil", "source.functions[84]": "tabkyjti", "source.functions[85]": "tbohjizo", "source.functions[86]": "tippyza", "source.functions[87]": "tlerpaply", "source.functions[88]": "udaxcap", "source.functions[89]": "unyqvox", "source.functions[90]": "upnizoqt", "source.functions[91]": "uqex", "source.functions[92]": "urydge", "source.functions[93]": "usrybnicbi", "source.functions[94]": "uwofe", "source.functions[95]": "uxiq", "source.functions[96]": "uxkut", "source.functions[97]": "vokujmy", "source.functions[98]": "vovdy", "source.functions[99]": "vyxzi", "source.functions[100]": "wazryfutze", "source.functions[101]": "weta", "source.functions[102]": "wfektur", "source.functions[103]": "wiwymsa", "source.functions[104]": "xgygolra", "source.functions[105]": "ycacv", "source.functions[106]": "ydone", "source.functions[107]": "yfiqexq", "source.functions[108]": "ygjypp", "source.functions[109]": "yhzox", "source.functions[110]": "ylmelo", "source.functions[111]": "ymwax", "source.functions[112]": "yrtuje", "source.functions[113]": "yrxyt", "source.functions[114]": "yvvirc", "source.functions[115]": "yvvyq", "source.functions[116]": "yvysx", "source.functions[117]": "zante", "source.functions[118]": "zdystu", "source.functions[119]": "zevejgo", "source.functions[120]": "zocen", "source.functions[121]": "zunmat" }, "x": 3, "id": 0, "is": [ "mxajlikikc", "nopxosq", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "vikoxygg", "tsifpovewi", "hwaxquqekgy", "aljusfu", "eqyt", "rkifovtixi", "njandylsa", "kotig", "uwyqut", "ojbeshyqe", "jzotgo", "irecogro", "yhmewjusj", "obgorm", "qoppaba", "wazryfutze", "mlysuru", "xophagt", "livuvmovku", "yxkisdotzej", "zykaja", "eludehumz", "ppoprigd", "usrybnicbi", "orafi", "wminteml", "qgamdaw", "jyntuges", "jyntuges", "bkadfobhyv", "efozj", "ynsajnawi", "kvyscyzr", "ezimyno", "ezimyno", "yfqurnym", "ufarpinxe", "orvoze", "orvoze", "ubakajusn", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "yfiqexq", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "Number", "gkunaxna", "Number", "Number", "Number", "Number", "Number", "tlerpaply", "digogj", "didqezp", "wiwymsa", "ramaze", "yvvyq", "oldit", "tbohjizo", "qfujep", "xgygolra", "otbuxsyf", "tabkyjti", "ennyjxycs", "ihzulqu", "tippyza", "gipet", "oxnop", "exyzet", "hidrablo", "izqomsezq", "efqyfeq", "miro", "yrtuje", "hastab", "pudat", "yvvirc", "uwofe", "uxiq", "rimad", "jlyjite", "irige", "upnizoqt", "boqmuvd", "growwaf", "icawa", "ipgivif", "ashih", "ewduhedn", "zevejgo", "suxil", "hlyvwyd", "snyxky", "duhsude", "dtuhdo", "askac", "wfektur", "yvysx", "ohliqcep", "cyhy", "urydge", "jzygogjo", "atrocez", "ygjypp", "udaxcap", "igbyfcaqn", "grupoc", "qlotymta", "uqex", "zante", "anubig", "epemdy", "nmigzyt", "idpava", "encojyvm", "dehogy", "evqar", "mbeckoc", "mvofbug", "gemsyn", "ocfox", "vyxzi", "uxkut", "oredonj", "olydxov", "awixwosx", "riwazn", "ahogre", "weta", "rvohdu", "epegnigj", "mgitsukvu", "ylmelo", "ofaqqet", "dujosnu", "nwenohko", "yhzox", "oguko", "eqpanovw", "jonu", "sice", "lobji", "yrxyt", "zocen", "zdystu", "qwibaxne", "ikugi", "vokujmy", "ekisavb", "ydone", "cdazmywz", "pedo", "unyqvox", "mholob", "elcyci", "vovdy", "pqybme", "nifwa", "byrnyqk", "olkyqpa", "fqejebu", "ymwax", "iqfofyrz", "rbekgowv", "ycacv", "zunmat", "avurfafm", "yqmijqydre", "akhyzidn", "vygakah", "criluctixo", "anigybap", "ijyseta", "tsywihvufu", "tsywihvufu", "tpomlegot", "itmylheca" ], "ms": { "file": { "size": 25371.0 }, "text": { "tab_count": 316.0, "digit_ratio": 0.16, "space_count": 1901.0, "total_lines": 451.0, "char_entropy": 5.3, "unique_chars": 75.0, "import_density": 44.79, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 1.13, "avg_line_length": 55.26, "lines_over_1000": 1.0, "max_line_length": 16660.0, "empty_line_ratio": 0.02, "last_line_length": 1.0, "most_common_char": "u", "whitespace_ratio": 0.11, "most_common_ratio": 0.06, "identifier_density": 3.33, "line_length_stddev": 782.89, "normalized_import_count": 9.51, "normalized_string_count": 24.01, "suspicious_string_ratio": 0.0, "max_inline_whitespace_run": 4.0, "normalized_function_count": 5.74, "imports_to_functions_ratio": 1.66, "strings_to_functions_ratio": 4.18, "normalized_unique_identifiers": 45.48, "identifiers_to_functions_ratio": 3.29 }, "imports": { "total": 202.0, "unique_modules": 167.0, "third_party_count": 202.0, "third_party_ratio": 1.0 }, "strings": { "total": 510.0, "avg_length": 10.51, "max_length": 28.0, "avg_entropy": 2.85, "total_bytes": 5359.0, "domain_count": 2.0, "entropy_stddev": 0.66, "shell_command_strings": 2.0 }, "comments": {}, "functions": { "total": 122.0, "length_stddev": 0.22, "avg_name_length": 6.42, "no_params_count": 122.0, "avg_length_lines": 3.05, "max_length_lines": 4.0, "min_length_lines": 3.0, "density_per_100_lines": 27.05, "code_in_functions_ratio": 0.82 }, "identifiers": { "total": 1503.0, "avg_length": 6.56, "max_length": 14.0, "min_length": 4.0, "avg_entropy": 2.48, "reuse_ratio": 0.27, "unique_count": 401.0, "length_stddev": 1.59, "all_lowercase_ratio": 0.99 } }, "ss": [ [ 1019, "undefined" ], [ 1020, "undefined" ], [ 3977, "55864" ], [ 3978, "55864" ], [ 3997, "WScript.Sh" ], [ 3998, "WScript.Sh" ], [ 4012, "ell" ], [ 4013, "ell" ], [ 7232, "iboqivg" ], [ 7233, "iboqivg" ], [ 7277, "81532" ], [ 7278, "81532" ], [ 7335, "nubo" ], [ 7336, "nubo" ], [ 7383, "xuzsykaf" ], [ 7384, "xuzsykaf" ], [ 7425, "walxobbaby" ], [ 7426, "walxobbaby" ], [ 7458, "yhgijp" ], [ 7459, "yhgijp" ], [ 7728, "apu" ], [ 7729, "apu" ], [ 7825, "11358" ], [ 7826, "11358" ], [ 7996, "xew" ], [ 7997, "xew" ], [ 8108, "knosdy" ], [ 8109, "knosdy" ], [ 8206, "opydwe" ], [ 8207, "opydwe" ], [ 8237, "ksygvexmoko" ], [ 8238, "ksygvexmoko" ], [ 8299, "r" ], [ 8300, "r" ], [ 8305, "u" ], [ 8306, "u" ], [ 8311, "n" ], [ 8312, "n" ], [ 8475, "ijuzoxoxferpu" ], [ 8476, "ijuzoxoxferpu" ], [ 8566, "cmd.exe" ], [ 8567, "cmd.exe" ], [ 8647, "ghimynakazijyvcihlopnysf" ], [ 8648, "ghimynakazijyvcihlopnysf" ], [ 8748, " /c \\\"po" ], [ 8749, " /c " ], [ 8755, "po" ], [ 8787, "giwdaqacquzlobukjapejv" ], [ 8788, "giwdaqacquzlobukjapejv" ], [ 8856, "wershel" ], [ 8857, "wershel" ], [ 8961, "lwiqiltippijr" ], [ 8962, "lwiqiltippijr" ], [ 9051, "l $rfy" ], [ 9052, "l $rfy" ], [ 9073, "mtuvajyxfacpesp" ], [ 9074, "mtuvajyxfacpesp" ], [ 9194, "lyqx='^" ], [ 9195, "lyqx='^" ], [ 9231, "mnotiqu" ], [ 9232, "mnotiqu" ], [ 9286, "($env:t" ], [ 9287, "($env:t" ], [ 9350, "ogesqygvidykuqansitotac" ], [ 9351, "ogesqygvidykuqansitotac" ], [ 9506, ";$pune" ], [ 9507, ";$pune" ], [ 9526, "qwezivwazaczidudv" ], [ 9527, "qwezivwazaczidudv" ], [ 9562, "='^ect " ], [ 9563, "='^ect " ], [ 9654, "vithutqanizavaxegequ" ], [ 9655, "vithutqanizavaxegequ" ], [ 9708, " Sys';$" ], [ 9709, " Sys';$" ], [ 9788, "ellowlakfawipen" ], [ 9789, "ellowlakfawipen" ], [ 9836, "uvimdy=" ], [ 9837, "uvimdy=" ], [ 9901, "ehuvpedjor" ], [ 9902, "ehuvpedjor" ], [ 9974, "^.Webc" ], [ 9975, "^.Webc" ], [ 10011, "ehnewzelkekapeqsybryh" ], [ 10012, "ehnewzelkekapeqsybryh" ], [ 10096, "li';$yn" ], [ 10097, "li';$yn" ], [ 10176, "nefovsobvyqbuwiruwq" ], [ 10177, "nefovsobvyqbuwiruwq" ], [ 10256, "hiwi='^" ], [ 10257, "hiwi='^" ], [ 10307, "ekucitugkylurywilz" ], [ 10308, "ekucitugkylurywilz" ], [ 10387, "exe'');" ], [ 10388, "exe'');" ], [ 10483, "ewolyhvurq" ], [ 10484, "ewolyhvurq" ], [ 10570, "(';$gxu" ], [ 10571, "(';$gxu" ], [ 10620, "lsiduxjyhy" ], [ 10621, "lsiduxjyhy" ], [ 10749, "whu='^i" ], [ 10750, "whu='^i" ], [ 10786, "okixodw" ], [ 10787, "okixodw" ], [ 10828, "le(''ht" ], [ 10829, "le(''ht" ], [ 10891, "cbibvedelkygmykjufimum" ], [ 10892, "cbibvedelkygmykjufimum" ], [ 10974, ";$mlem" ], [ 10975, ";$mlem" ], [ 11037, "jafvecavocozefav" ], [ 11038, "jafvecavocozefav" ], [ 11086, "de='^ro" ], [ 11087, "de='^ro" ], [ 11192, "qnowgikixewitoqwyruzn" ], [ 11193, "qnowgikixewitoqwyruzn" ], [ 11317, "cess;';" ], [ 11318, "cess;';" ], [ 11340, "ebuhxokxuzsaf" ], [ 11341, "ebuhxokxuzsaf" ], [ 11445, "$ahnar=" ], [ 11446, "$ahnar=" ], [ 11513, "ezipugasivvisky" ], [ 11514, "ezipugasivvisky" ], [ 11619, "^Proce" ], [ 11620, "^Proce" ], [ 11641, "awfybiqefakgikisb" ], [ 11642, "awfybiqefakgikisb" ], [ 11735, "ss';$do" ], [ 11736, "ss';$do" ], [ 11768, "alyblun" ], [ 11769, "alyblun" ], [ 11850, "kysw='^" ], [ 11851, "kysw='^" ], [ 11914, "gokjetva" ], [ 11915, "gokjetva" ], [ 11969, "tp://ww" ], [ 11970, "tp://ww" ], [ 12049, "ajnidvajzoftesurvumuvqanl" ], [ 12050, "ajnidvajzoftesurvumuvqanl" ], [ 12164, ";$icoz" ], [ 12165, ";$icoz" ], [ 12198, "onmihivomab" ], [ 12199, "onmihivomab" ], [ 12271, "v='^cut" ], [ 12272, "v='^cut" ], [ 12365, "vjojesinpaqenudiqo" ], [ 12366, "vjojesinpaqenudiqo" ], [ 12487, "ionP';$" ], [ 12488, "ionP';$" ], [ 12521, "idtavolyfqubbe" ], [ 12522, "idtavolyfqubbe" ], [ 12584, "qoxiq=" ], [ 12585, "qoxiq=" ], [ 12646, "tqylaburote" ], [ 12647, "tqylaburote" ], [ 12720, "^lexas." ], [ 12721, "^lexas." ], [ 12798, "cycuhki" ], [ 12799, "cycuhki" ], [ 12853, "t';$rro" ], [ 12854, "t';$rro" ], [ 12947, "wpantafybvybimifyqus" ], [ 12948, "wpantafybvybimifyqus" ], [ 12987, "rbyg='^" ], [ 12988, "rbyg='^" ], [ 13092, "txinpyme" ], [ 13093, "txinpyme" ], [ 13163, "New-Obj" ], [ 13164, "New-Obj" ], [ 13214, "wopes" ], [ 13215, "wopes" ], [ 13351, ";$ecgi" ], [ 13352, ";$ecgi" ], [ 13373, "qykgenjovgicysbirqowm" ], [ 13374, "qykgenjovgicysbirqowm" ], [ 13441, "jx='^en" ], [ 13442, "jx='^en" ], [ 13535, "tosifyjnitu" ], [ 13536, "tosifyjnitu" ], [ 13665, "t).Do';" ], [ 13666, "t).Do';" ], [ 13685, "ijdamxopetlyfnuputtyjta" ], [ 13686, "ijdamxopetlyfnuputtyjta" ], [ 13756, "$vciqfe" ], [ 13757, "$vciqfe" ], [ 13806, "yqutxiwiqxoxje" ], [ 13807, "yqutxiwiqxoxje" ], [ 13897, "='^ $pa" ], [ 13898, "='^ $pa" ], [ 13932, "bjyqjepwyvfaswevmajbuzmevjuq" ], [ 13933, "bjyqjepwyvfaswevmajbuzmevjuq" ], [ 14007, "th';$at" ], [ 14008, "th';$at" ], [ 14074, "aplifopxecixtuv" ], [ 14075, "aplifopxecixtuv" ], [ 14180, "tozv='^" ], [ 14181, "tozv='^" ], [ 14202, "izxifbajuxu" ], [ 14203, "izxifbajuxu" ], [ 14303, "wnloadF" ], [ 14304, "wnloadF" ], [ 14366, "urmowagazzetdehsidens" ], [ 14367, "urmowagazzetdehsidens" ], [ 14407, ";$idko" ], [ 14408, ";$idko" ], [ 14544, "cwofwovr" ], [ 14545, "cwofwovr" ], [ 14630, "cju='^ " ], [ 14631, "cju='^ " ], [ 14651, "obluksinihi" ], [ 14652, "obluksinihi" ], [ 14781, "$path=" ], [ 14782, "$path=" ], [ 14803, "imaqiv" ], [ 14804, "imaqiv" ], [ 14887, ";$isvyl" ], [ 14888, ";$isvyl" ], [ 14937, "nicixgovh" ], [ 14938, "nicixgovh" ], [ 15051, "ji='^em" ], [ 15052, "ji='^em" ], [ 15071, "newvuwagpixtiheno" ], [ 15072, "newvuwagpixtiheno" ], [ 15165, "p+''\\\\h" ], [ 15166, "p+" ], [ 15172, "h" ], [ 15216, "thulhojacebukz" ], [ 15217, "thulhojacebukz" ], [ 15235, ";$hidar" ], [ 15236, ";$hidar" ], [ 15369, "yzbygfosmysabfycyxcaku" ], [ 15370, "yzbygfosmysabfycyxcaku" ], [ 15424, "c='^oli" ], [ 15425, "c='^oli" ], [ 15505, "usbifyxedawybiqaqbakci" ], [ 15506, "usbifyxedawybiqaqbakci" ], [ 15575, "cy B" ], [ 15576, "cy B" ], [ 15637, "idbiqbyrtutvahaw" ], [ 15638, "idbiqbyrtutvahaw" ], [ 15673, ";$onvi" ], [ 15674, ";$onvi" ], [ 15796, "pynwekiqi" ], [ 15797, "pynwekiqi" ], [ 15839, "zu='^$p" ], [ 15840, "zu='^$p" ], [ 15904, "tlajaworriwwebkykizpahvozc" ], [ 15905, "tlajaworriwwebkykizpahvozc" ], [ 16005, "ath);';" ], [ 16006, "ath);';" ], [ 16027, "xpuhtumcoruwwuborgiqiqega" ], [ 16028, "xpuhtumcoruwwuborgiqiqega" ], [ 16057, "$enah=" ], [ 16058, "$enah=" ] ], "sz": 25371, "ts": [ { "c": 0.949999988079071, "d": "Network primitive in flatted-shaped file", "e": [ "XMLHttpRequest" ], "i": "well-known/lib/flatted::flatted-tamper-network", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 451.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 16660.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 167.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "a": "T1059", "c": 0.75, "d": "Regex component marker", "e": [ "10." ], "i": "objectives/command-and-control/reverse-shell/socket::rfc1918-host-string--rx-1", "l": 1 }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170303_7b7ca63d72bfadf876a1800ae472f8f3.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 1.0, "d": "cmd command name", "e": [ "cmd" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-name", "l": 2 }, { "a": "T1497.001", "c": 0.75, "d": "Compares value against undefined string", "e": [ "== 'undefined'" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-undefined-compare", "l": 1, "m": "B0003" }, { "c": 1.0, "d": "Regex component marker", "e": [ "mxajlikikc = undefined;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 167.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "a": "T1059", "c": 0.75, "d": "cmd.exe shell string", "e": [ "cmd.exe" ], "i": "objectives/command-and-control/reverse-shell/socket::cmd-exe-string", "l": 1 }, { "c": 1.0, "d": "JavaScript undefined literal", "e": [ "undefined" ], "i": "metadata/lang/scripted::undefined-literal", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170303_7b7ca63d72bfadf876a1800ae472f8f3.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "a": "T1105", "c": 0.8500000238418579, "d": "macOS shell interpreter", "e": [ "Sh" ], "i": "objectives/command-and-control/dropper/execution/browser::macos-shell-interpreter", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "c": 1.0, "d": "JavaScript many imported modules", "e": [ "imports.unique_modules = 167.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::js-many-import-modules", "l": 1 }, { "c": 0.9200000166893005, "d": "\"crip\" fragment of split WScript.Shell", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.9200000166893005, "d": "\"t.Sh\" fragment of split WScript.Shell", "e": [ "t.Sh" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-3", "l": 1 }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".php" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 122.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "XMLHttpRequest" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 27.05" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Excessive parameterless functions (dead code padding)", "e": [ "functions.no_params_count = 122.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/source::excessive-parameterless-functions", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2b)", "e": [ "ipt.S" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2b", "l": 1 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "a": "T1027", "c": 0.6000000238418579, "d": "No comments in code", "e": [ "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "References cmd.exe file path", "e": [ ".exe", "cmd" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-file-path", "l": 2 } ], "sha": "5a7f1c8e1bdd858406ffae662d40ed54ca2fd0f36cc8476fe37691031081d3bb", "path": "20170303_7b7ca63d72bfadf876a1800ae472f8f3.js", "type": "javascript" } ], "tv": "46790" } }