{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/scripts", "prob": 0.48895434, "class": 0 }, { "m": "az/javascript", "prob": 0.43715847, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T05:07:24Z" }, "path": "6863a3dd8ada2931e04e61c7eb15ba262e36d2088e3ad34fc532b1bc8521c012.js", "raw": { "v": "5", "fs": [ { "f": "O₂(AsC)", "x": 3, "ff": { "i": [ [ "", "0x4338b2" ], [ "", "0x20ad58" ], [ "", "0x406a9a" ], [ "", "0x4b7abd" ], [ "", "0x2c6a02" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "parseInt" ], [ "", "0x20ad58" ], [ "", "0x406a9a.push" ], [ "", "0x406a9a.shift" ], [ "", "0x406a9a.push" ], [ "", "0x406a9a.shift" ], [ "", "superString" ], [ "", "0x4338b2" ], [ "", "0x1e606f" ], [ "", "0x57b8" ], [ "", "0x1e60" ], [ "", "0x287a4c" ], [ "", "0x3bfd75" ], [ "", "0x1e60" ], [ "", "0x4f993e" ], [ "", "0x57b8" ], [ "", "0x57b8" ], [ "", "xmlDOM" ], [ "", "WSH._0x4338b2._0x4338b2" ], [ "", "WSH._0x4338b2" ], [ "", "0x4338b2" ], [ "", "0x4338b2" ], [ "", "0x4338b2" ], [ "", "0x4338b2" ], [ "", "xmlDOM._0x4338b2" ], [ "", "0x4338b2" ], [ "", "0x4338b2" ], [ "", "xmlDOM._0x4338b2" ], [ "", "0x4338b2" ], [ "", "superString.replace" ], [ "", "comObject" ], [ "", "WSH._0x4338b2" ], [ "", "0x4338b2" ], [ "", "0x4338b2" ], [ "", "comObject._0x4338b2" ], [ "", "0x4338b2" ], [ "", "comObject._0x4338b2" ], [ "", "0x4338b2" ], [ "", "comObject._0x4338b2" ], [ "", "0x4338b2" ], [ "", "0x4338b2" ], [ "", "comObject._0x4338b2" ], [ "", "0x4338b2" ], [ "", "comObject._0x4338b2" ], [ "", "0x4338b2" ], [ "", "comObject.CharSet" ], [ "", "0x4338b2" ], [ "", "eval" ], [ "", "comObject.ReadText" ] ], "m": { "ast": { "max_depth": 25.0, "bind_count": 14.0, "call_count": 54.0, "node_count": 832.0, "member_count": 5.0, "identifier_count": 22.0, "member_depth_max": 2.0, "string_literal_count": 33.0, "array_literal_max_length": 25.0, "string_concat_chain_max_length": 17.0 }, "file": { "size": 15461.0, "entropy": 5.97, "size_bytes": 15461.0 }, "text": { "digit_ratio": 0.14, "space_count": 520.0, "total_lines": 71.0, "char_entropy": 5.97, "unique_chars": 84.0, "lines_over_200": 2.0, "lines_over_500": 1.0, "string_density": 0.46, "avg_line_length": 215.79, "lines_over_1000": 1.0, "max_line_length": 13130.0, "last_line_length": 30.0, "long_token_count": 1.0, "whitespace_ratio": 0.04, "most_common_ratio": 0.04, "identifier_density": 1.31, "line_length_stddev": 1544.14, "normalized_string_count": 3.92, "repeated_char_sequences": 7.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 48.0, "normalized_unique_identifiers": 3.58 }, "binds": { "count": 14.0 }, "calls": { "count": 54.0 }, "source": { "function_count": 2.0 }, "members": { "count": 5.0 }, "strings": { "total": 33.0, "avg_length": 405.76, "max_length": 13119.0, "avg_entropy": 2.75, "total_bytes": 13390.0, "entropy_stddev": 0.89, "very_long_strings": 1.0, "high_entropy_count": 1.0 }, "functions": { "count": 2.0, "anonymous": 3.0, "avg_params": 1.2, "max_params": 2.0, "length_stddev": 10.85, "avg_name_length": 7.0, "no_params_count": 2.0, "avg_length_lines": 13.2, "max_length_lines": 33.0, "min_length_lines": 3.0, "nested_functions": 2.0, "avg_nesting_depth": 0.4, "max_nesting_depth": 1.0, "numeric_suffix_names": 1.0, "avg_param_name_length": 9.0, "density_per_100_lines": 7.04, "code_in_functions_ratio": 0.93 }, "identifiers": { "count": 22.0, "total": 93.0, "avg_length": 8.23, "max_length": 11.0, "min_length": 3.0, "avg_entropy": 2.79, "reuse_ratio": 0.24, "unique_count": 22.0, "length_stddev": 1.78, "has_digit_ratio": 0.73, "all_lowercase_ratio": 0.05, "all_uppercase_ratio": 0.05, "numeric_suffix_count": 8.0, "underscore_prefix_count": 16.0 } }, "s": [ [ 208, "16", "18" ], [ 217, "16", "1" ], [ 242, "16", "8" ], [ 250, "16", "2" ], [ 276, "16", "24" ], [ 285, "16", "3" ], [ 312, "16", "20" ], [ 321, "16", "4" ], [ 347, "16", "10" ], [ 355, "16", "5" ], [ 381, "16", "16" ], [ 390, "16", "6" ], [ 416, "16", "4" ], [ 424, "16", "7" ], [ 450, "16", "5" ], [ 458, "16", "8" ], [ 484, "16", "1" ], [ 492, "16", "9" ], [ 518, "16", "2" ], [ 526, "16", "10" ], [ 648, "u8", "push" ], [ 649, "u8", "push" ], [ 666, "u8", "shift" ], [ 667, "u8", "shift" ], [ 748, "u8", "push" ], [ 749, "u8", "push" ], [ 766, "u8", "shift" ], [ 767, "u8", "shift" ], [ 809, "16", "253793" ], [ 849, "16", "9" ], [ 1011, "16", "0" ], [ 1198, "u8", "Open" ], [ 1199, "u8", "Open" ], [ 1215, "u8", "bin.base64" ], [ 1216, "u8", "bin.base64" ], [ 1238, "u8", "8376YjPtBj" ], [ 1239, "u8", "8376YjPtBj" ], [ 1261, "u8", "Position" ], [ 1262, "u8", "Position" ], [ 1282, "u8", "291288ciTPfB" ], [ 1283, "u8", "291288ciTPfB" ], [ 1307, "u8", "microsoft.xmldom" ], [ 1308, "u8", "microsoft.xmldom" ], [ 1336, "u8", "531784wNTVtm" ], [ 1337, "u8", "531784wNTVtm" ], [ 1361, "u8", "us-ascii" ], [ 1362, "u8", "us-ascii" ], [ 1382, "u8", "mko" ], [ 1383, "u8", "mko" ], [ 1398, "u8", "Write" ], [ 1399, "u8", "Write" ], [ 1416, "u8", "3948jkAUdd" ], [ 1417, "u8", "3948jkAUdd" ], [ 1439, "u8", "adodb.stream" ], [ 1440, "u8", "adodb.stream" ], [ 1464, "u8", "4392IiAxhF" ], [ 1465, "u8", "4392IiAxhF" ], [ 1487, "u8", "3778300lBgnJR" ], [ 1488, "u8", "3778300lBgnJR" ], [ 1513, "u8", "CreateObject" ], [ 1514, "u8", "CreateObject" ], [ 1538, "u8", "1162FNaabt" ], [ 1539, "u8", "1162FNaabt" ], [ 1561, "u8", "1576yBmXAF" ], [ 1562, "u8", "1576yBmXAF" ], [ 1584, "u8", "dataType" ], [ 1585, "u8", "dataType" ], [ 1605, "u8", "createElement" ], [ 1606, "u8", "createElement" ], [ 1631, "u8", "388wJWueH" ], [ 1632, "u8", "388wJWueH" ], [ 14785, "u8", "2010415HZBBvP" ], [ 14786, "u8", "2010415HZBBvP" ], [ 14811, "u8", "nodeTypedValue" ], [ 14812, "u8", "nodeTypedValue" ], [ 14838, "u8", "text" ], [ 14839, "u8", "text" ], [ 14855, "u8", "Type" ], [ 14856, "u8", "Type" ], [ 14988, "16", "3" ], [ 15004, "16", "19" ], [ 15021, "16", "7" ], [ 15037, "16", "22" ], [ 15063, "16", "6" ], [ 15081, "16", "15" ], [ 15105, "16", "12" ], [ 15125, "u8", "replace" ], [ 15126, "u8", "replace" ], [ 15143, "u8", "m" ], [ 15144, "u8", "m" ], [ 15180, "16", "3" ], [ 15196, "16", "0" ], [ 15224, "16", "13" ], [ 15232, "16", "1" ], [ 15258, "16", "14" ], [ 15288, "16", "23" ], [ 15312, "16", "11" ], [ 15341, "16", "17" ], [ 15350, "16", "0" ], [ 15376, "16", "13" ], [ 15384, "16", "2" ], [ 15400, "u8", "CharSet" ], [ 15401, "u8", "CharSet" ], [ 15423, "16", "21" ], [ 15446, "u8", "ReadText" ], [ 15447, "u8", "ReadText" ] ], "v": { "file.stem": "6863a3dd8ada2931e04e61c7eb15ba262e36d2088e3ad34fc532b1bc8521c012", "file.basename": "6863a3dd8ada2931e04e61c7eb15ba262e36d2088e3ad34fc532b1bc8521c012.js", "source.language": "javascript", "source.imports[0]": "0x1e60", "source.imports[1]": "0x1e606f", "source.imports[2]": "0x20ad58", "source.imports[3]": "0x287a4c", "source.imports[4]": "0x2c6a02", "source.imports[5]": "0x3bfd75", "source.imports[6]": "0x406a9a", "source.imports[7]": "0x406a9a.push", "source.imports[8]": "0x406a9a.shift", "source.imports[9]": "0x4338b2", "source.strings[0]": "1162FNaabt", "source.strings[1]": "1576yBmXAF", "source.strings[2]": "2010415HZBBvP", "source.strings[3]": "253793", "source.strings[4]": "291288ciTPfB", "source.strings[5]": "3778300lBgnJR", "source.strings[6]": "388wJWueH", "source.strings[7]": "3948jkAUdd", "source.strings[8]": "4392IiAxhF", "source.strings[9]": "531784wNTVtm", "source.has_imports": true, "source.imports[10]": "0x4b7abd", "source.imports[11]": "0x4f993e", "source.imports[12]": "0x57b8", "source.imports[13]": "WSH._0x4338b2", "source.imports[14]": "WSH._0x4338b2._0x4338b2", "source.imports[15]": "comObject", "source.imports[16]": "comObject.CharSet", "source.imports[17]": "comObject.ReadText", "source.imports[18]": "comObject._0x4338b2", "source.imports[19]": "eval", "source.imports[20]": "parseInt", "source.imports[21]": "superString", "source.imports[22]": "superString.replace", "source.imports[23]": "xmlDOM", "source.imports[24]": "xmlDOM._0x4338b2", "source.strings[10]": "8376YjPtBj", "source.strings[11]": "CharSet", "source.strings[12]": "CreateObject", "source.strings[13]": "Position", "source.strings[14]": "ReadText", "source.strings[15]": "adodb.stream", "source.strings[16]": "bin.base64", "source.strings[17]": "createElement", "source.strings[18]": "dataType", "source.strings[19]": "microsoft.xmldom", "source.strings[20]": "nodeTypedValue", "source.strings[21]": "replace", "source.strings[22]": "us-ascii", "source.functions[0]": "_0x1e60", "source.functions[1]": "_0x57b8", "source.functions[2]": "anonymous" }, "ct": [ "_0x1e60", "_0x20ad58", "_0x406a9a.push", "_0x406a9a.shift", "_0x4338b2", "_0x4b7abd", "_0x57b8", "comObject.ReadText", "eval", "parseInt", "superString.replace" ], "id": "javascript", "mc": [ "_0x406a9a.push", "_0x406a9a.shift", "comObject.CharSet", "comObject.ReadText", "superString.replace" ] }, "id": 0, "sz": 15461, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 13130.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Hex-prefixed variable names (_0x pattern)", "e": [ "var _0x4338b2 =" ], "i": "objectives/anti-static/obfuscation/tools/js-obfuscator::hex-variable-names", "l": 3, "m": "B0032" }, { "c": 0.949999988079071, "d": "JavaScript or TypeScript basename", "e": [ "6863a3dd8ada2931e04e61c7eb15ba262e36d2088e3ad34fc532b1bc8521c012.js" ], "i": "metadata/lang/source::js-ts-source-basename", "l": 2 }, { "a": "T1027", "c": 0.6000000238418579, "d": "shift keyword in string-table decoder context", "e": [ "shift" ], "i": "objectives/anti-static/obfuscation/tools/js-obfuscator::shift-keyword", "l": 1, "m": "B0032", "el": [ "0x29a" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.6000000238418579, "d": "push keyword in string-table decoder context", "e": [ "push" ], "i": "objectives/anti-static/obfuscation/tools/js-obfuscator::push-keyword", "l": 1, "m": "B0032", "el": [ "0x288" ] }, { "c": 0.8999999761581421, "d": "Low string density in source", "e": [ "text.string_density = 0.46" ], "i": "metadata/file/text/metrics::low-string-density-large-file", "l": 1 }, { "c": 0.949999988079071, "d": "eval/new Function call (flatted tamper fragment)", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Hex-prefixed function names (_0x pattern)", "e": [ "function _0x1e60(" ], "i": "objectives/anti-static/obfuscation/tools/js-obfuscator::hex-function-names", "l": 3, "m": "B0032" }, { "a": "T1204.002", "c": 0.8600000143051147, "d": "ShellLink local base path offset", "e": [ "0x14" ], "i": "objectives/command-and-control/dropper/lnk/source-builder::shelllink-local-base-offset-constant", "l": 1, "m": "F0012" }, { "c": 1.0, "d": "Plain JavaScript identifier assignment", "e": [ "_0x4338b2 = _0x1e60;" ], "i": "metadata/lang/scripted::plain-js-identifier-assignment", "l": 1 }, { "c": 1.0, "d": "Obfuscated String method call (String[...])", "e": [ "String[" ], "i": "micro-behaviors/data/source/syntax/keyword::js-obfuscated-string-method", "l": 2 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "6863a3dd8ada2931e04e61c7eb15ba262e36d2088e3ad34fc532b1bc8521c012.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 71.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "DOM createElement string literal", "e": [ "createElement" ], "i": "micro-behaviors/process/create/load/remote-code::js-dom-createelement-literal", "l": 1, "el": [ "0x645" ] }, { "c": 1.0, "d": "Detects retry loop wrapping try-catch (while loop)", "e": [ "while (!![]) {\r\n try {" ], "i": "objectives/anti-static/obfuscation/control-flow/retry::retry-loop-while", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "base64" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-benign-text--rx-8", "l": 1, "m": "B0032" }, { "a": "T1555", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "base64" ], "i": "objectives/credential-access/wallet/solana::solana-secretkey-serialization--rx-6", "l": 1 }, { "a": "T1027", "d": "Decoded property function alias", "e": [ "var _0x3bfd75 = _0x1e606f[_0x287a4c]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Embedded string exceeds 3000 chars", "e": [ "strings.max_length = 13119.00" ], "i": "objectives/command-and-control/dropper/execution/script-dropper::js-max-string-over-3000", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.97" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" } ], "sha": "6863a3dd8ada2931e04e61c7eb15ba262e36d2088e3ad34fc532b1bc8521c012", "path": "6863a3dd8ada2931e04e61c7eb15ba262e36d2088e3ad34fc532b1bc8521c012.js", "type": "javascript" } ], "tv": "52045" } }