{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.69427526, "class": 0 }, { "m": "az/scripts", "prob": 0.94210523, "class": 0 }, { "m": "az/powershell", "prob": 1.0, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-16T14:39:26Z" }, "path": "68471e98fa941e6ba4668d8f09f3cacca276d98260d8da6637e69edb6f281182.ps1", "raw": { "v": "4", "fs": [ { "f": "O(As₃)Md", "k": { "source.strings[0]": "AssemblyFileVersionAttributeAssemblyDescriptionAttribute", "source.strings[1]": "AssemblyProductAttribute", "source.strings[2]": "CodeDomProvider", "source.strings[3]": "Conpileget_MainWindowTitle", "source.strings[4]": "CreateDecryptor", "source.strings[5]": "DisposeStrReverse", "source.strings[6]": "GetManifestResourceNames", "source.strings[7]": "MemoryStream", "source.strings[8]": "Microsoft.VisualBasic", "source.strings[9]": "ServicePointManagerResolveEventHandler", "source.strings[10]": "System.Security.Cryptographyget_RequestingAssembly", "source.strings[11]": "WriteAllText", "source.strings[12]": "get_ProcessName", "source.strings[13]": "set_Encoding", "source.strings[14]": "set_GenerateExecutableFile", "source.strings[15]": "set_MainClassProcess" }, "x": 40, "id": 0, "ms": { "file": { "size": 66338.0 }, "text": { "digit_ratio": 0.1, "total_lines": 1.0, "char_entropy": 3.99, "unique_chars": 67.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 66338.0, "high_byte_ratio": 0.6, "lines_over_1000": 1.0, "max_line_length": 66338.0, "non_ascii_ratio": 0.6, "last_line_length": 66338.0, "long_token_count": 1.0, "most_common_char": "â", "most_common_ratio": 0.2 }, "strings": {}, "comments": {}, "functions": {}, "identifiers": {} }, "ss": [ [ 36608, "base64", "Microsoft.VisualBasic" ], [ 36928, "base64", "set_GenerateExecutableFile" ], [ 36984, "base64", "Conpileget_MainWindowTitle" ], [ 37112, "base64", "get_ProcessName" ], [ 37216, "base64", "DisposeStrReverse" ], [ 37420, "base64", "AssemblyFileVersionAttributeAssemblyDescriptionAttribute" ], [ 37552, "base64", "AssemblyProductAttribute" ], [ 37788, "base64", "set_Encoding" ], [ 38224, "base64", "MemoryStream" ], [ 38754, "base64", "CodeDomProvider" ], [ 38806, "base64", "ServicePointManagerResolveEventHandler" ], [ 39102, "base64", "CreateDecryptor" ], [ 39342, "base64", "GetManifestResourceNames" ], [ 39704, "base64", "set_MainClassProcess" ], [ 39998, "base64", "WriteAllText" ], [ 40060, "base64", "System.Security.Cryptographyget_RequestingAssembly" ] ], "sz": 66338, "ts": [ { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code BY token", "e": [ "↓BY↓" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-by", "l": 1, "m": "B0007.003" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 66338.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": ".NET Assembly split via concatenation", "e": [ "AssemblyFileVersionAttributeAssemblyDescriptionAttribute", "System.Security.Cryptographyget_RequestingAssembly", "AssemblyProductAttribute" ], "i": "objectives/anti-static/obfuscation/string/concat::dotnet-reflection-api-splitting-assembly", "l": 4 }, { "a": "T1027", "c": 0.6000000238418579, "d": "No comments in PowerShell script", "e": [ "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-no-comments", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 66338.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.949999988079071, "d": "Kubernetes Windows GCE support script", "e": [ "k8s" ], "i": "well-known/tool/sysadmin/kubernetes::kubernetes-windows-gce-script", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Low identifier reuse ratio", "e": [ "identifiers.reuse_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::low-identifier-reuse", "l": 2, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 66338.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.4000000059604645, "d": "Very few string literals (string obfuscation indicator)", "e": [ "strings.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.6000000238418579, "d": "No comments in code", "e": [ "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Suspicious long PowerShell line", "e": [ "text.max_line_length = 66338.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.6499999761581421, "d": "Very low comment-to-code ratio (\u003c1%)", "e": [ "comments.to_code_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-low-comment-ratio", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "text.whitespace_ratio = 0.00", "comments.to_code_ratio = 0.00", "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "\u003cbinary data\u003e \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64 → base64", "e": [ "\u003cbinary data\u003e \u003cbase64+base64\u003e" ], "i": "metadata/encoded-payload/base64-base64", "l": 3 } ], "sha": "68471e98fa941e6ba4668d8f09f3cacca276d98260d8da6637e69edb6f281182", "path": "68471e98fa941e6ba4668d8f09f3cacca276d98260d8da6637e69edb6f281182.ps1", "type": "powershell" } ], "tv": "529a0" } }