{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00007291635, "rte": "az", "prob": 0.00007291635 }, { "cls": 0, "raw": 0.000026673079, "rte": "az/scripts", "prob": 0.000026673079 }, { "cls": 0, "raw": 0.42161307, "rte": "az/javascript", "prob": 0.42161307 } ], "prob": 0.00007291635, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007291635120054707, "type": "javascript" } ], "version": "v18.18", "analyzed_at": "2026-06-15T05:30:27Z" }, "path": "VirusShare_e6ba228ad6fccde0674cb679a6a1eb8a", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 0, "b": "jzn?Ny^4", "l": 1, "n": [ { "c": 2, "d": "JavaScript built bundle marker", "i": "metadata/library/web-frameworks::javascript-built-bundle-marker", "o": 0, "z": 29 } ] }, { "a": 7, "b": "jznqmwiG", "l": 2 }, { "a": 14, "b": "jz!UKvixl9Bz@*yADL#sjT9=)mP8VNnfPf^z/fVdzGF2=f/{HTqCok3xMOuniXJdgx(nlhz.u6Mfly-Cfl?LYxlFILv}PHugBvi*x)j?=fEyvEC5qaWfEy{QwP.DBf^.3KCY))^fEymEzGQ1-Cwg@vv{%B)zF{\u003egB89]^b0C", "l": 3, "n": [ { "c": 3, "d": "Hardcoded suspicious TLD domain pattern", "i": "objectives/command-and-control/infrastructure/domain/malicious::hardcoded-domain-suspicious-pattern", "o": 57, "z": 18 } ] }, { "a": 149, "b": "jwwmzk{eY$r8tenqb{g*jT9Zyvp%B=a%olGpe\u003cUSr6qByz.kEcv}YA$j]", "l": 4 }, { "a": 195, "b": "jAC1Mx(FepvrlZiv\u003c2\u0026kv)8g)v}oEev}PHev}Yp!y?mG%wI4\u003eqvrua1A=0Eyfj#}Vv@=p5BAo9HzGY-nx\u003c$)\u0026e]2CPk0gGtv@=p5BuR/uxK$Q.j]", "l": 5 }, { "a": 285, "b": "jySktC%h", "l": 6 }, { "a": 292, "b": "jy\u0026eHaAITIy?k:NvQS+Zxl4{kzE+^Mw[CT!w[BbGx\u003ehs0iX-rxb%b^Kx\u003eIa3iX-rxb%9qm", "l": 7 }, { "a": 349, "b": "jyGvCA+e\u0026Cb4#7uAc15[fl.bFDtdpIA=\u003c3SwofzGB9qhtCRiGsx*jy2BA?IzC%9\u0026dwO=KbzAPW2B.CuevM=B)BZYJry=%E0vScdbB3j.YzHb/3B7]JgcsH$hjT96Lw]zNeay/taz/N#+bw7L1w[CT0k0%d2v@0i2wPzuAfj]cuBuR/uvlK", "l": 8, "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 357, "z": 8 } ] }, { "a": 492, "b": "jtgkVC0k", "l": 9 }, { "a": 499, "b": "jAC1Mx(FepBA}?pjT8N?vpy]Bg+\u0026I%gbAC$ggJs0g=m0Bv(C#YwQ5qIygho]B7ol8Ac9o/jrVpd", "l": 10 }, { "a": 910, "b": "w{503BzkVhay]5aA+)dBdf", "l": 24 }, { "a": 928, "b": "DJ", "l": 25 }, { "a": 930, "b": "336Q0B-IvxB1RJMy?W#ta%FD*A+fA9A=U!udk2vNx(ksya$kO", "l": 26, "n": [ { "c": 3, "d": "String reconstructed via split/join", "i": "objectives/anti-static/obfuscation/string/reconstruct::split-join-reconstruction", "o": 939, "z": 29 } ] }, { "a": 970, "b": "Ee", "l": 27 }, { "a": 972, "b": "", "l": 28 } ], "mol": "O₂(AsC)", "sha": "6e63d8e17a2de532014e11d50b2b7a77465b6159c4e4a5d4a0a636cc02feeccf", "fact": { "id": "javascript", "imp": [ [ "", "myWidth" ], [ "", "myHeight" ], [ "", "myWidth" ], [ "", "myHeight" ], [ "", "myWidth" ], [ "", "myHeight" ], [ "", "myWidth" ], [ "", "myHeight" ], [ "", "Results" ], [ "", "Results" ], [ "", "n_result" ], [ "", "n_result" ], [ "", "script" ], [ "", "window.__CF$cv$params" ] ], "mbr": [ "document.body", "document.body.clientHeight", "document.body.clientWidth", "document.documentElement", "document.documentElement.clientHeight", "document.documentElement.clientWidth", "window.innerHeight", "window.innerWidth" ], "met": { "ast": { "op.eq": 1.0, "op.gt": 3.0, "op.lt": 1.0, "op.lor": 4.0, "op.land": 4.0, "op.lnot": 2.0, "max_depth": 14.0, "bind_count": 11.0, "call_count": 3.0, "node_count": 818.0, "member_count": 8.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.lor": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 57.0, "member_depth_max": 3.0, "string_literal_count": 20.0, "array_literal_max_length": 2.0, "numeric_array_max_length": 2.0 }, "file": { "size": 2962.0, "entropy": 5.66, "size_bytes": 2962.0 }, "text": { "tab_count": 23.0, "digit_ratio": 0.09, "space_count": 218.0, "total_lines": 71.0, "char_entropy": 5.66, "mixed_indent": 1.0, "unique_chars": 91.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.28, "avg_line_length": 40.72, "max_line_length": 620.0, "empty_line_ratio": 0.14, "last_line_length": 7.0, "long_token_count": 3.0, "whitespace_ratio": 0.11, "most_common_ratio": 0.06, "identifier_density": 2.34, "line_length_stddev": 77.66, "encoded_string_ratio": 0.05, "normalized_string_count": 2.37, "suspicious_string_ratio": 0.1, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.12, "normalized_unique_identifiers": 9.27 }, "binds": { "count": 11.0 }, "calls": { "count": 3.0 }, "binary": { "overall_entropy": 5.66 }, "source": { "function_count": 4.0 }, "members": { "count": 8.0 }, "strings": { "total": 20.0, "url_count": 1.0, "avg_length": 41.05, "max_length": 293.0, "path_count": 2.0, "avg_entropy": 3.59, "empty_count": 1.0, "hex_strings": 1.0, "total_bytes": 821.0, "entropy_stddev": 1.13, "high_entropy_count": 1.0, "embedded_code_candidates": 2.0 }, "comments": { "chars": 68.0, "lines": 4.0, "total": 4.0, "to_code_ratio": 0.06 }, "functions": { "count": 4.0, "anonymous": 1.0, "avg_params": 0.6, "max_params": 3.0, "one_liners": 1.0, "length_stddev": 5.56, "avg_name_length": 5.5, "no_params_count": 4.0, "avg_length_lines": 7.8, "max_length_lines": 18.0, "min_length_lines": 1.0, "avg_param_name_length": 6.0, "density_per_100_lines": 7.04, "code_in_functions_ratio": 0.55 }, "identifiers": { "count": 57.0, "total": 166.0, "avg_length": 6.12, "max_length": 18.0, "min_length": 1.0, "avg_entropy": 2.11, "reuse_ratio": 0.34, "unique_count": 57.0, "length_stddev": 3.79, "sequential_names": 7.0, "single_char_count": 7.0, "single_char_ratio": 0.12, "high_entropy_count": 1.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.72, "all_uppercase_ratio": 0.02 } }, "str": [ [ 31, "u8", "REFRESH" ], [ 32, "u8", "REFRESH" ], [ 50, "u8", "1; URL='http://winzio.ru/tds/xsvgvx.cgi?3" ], [ 98, "10", "0" ], [ 106, "10", "0" ], [ 114, "10", "1" ], [ 122, "10", "0" ], [ 145, "u8", "\"\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=" ], [ 146, "u8", "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=" ], [ 303, "u8", "background:#ffffff;width:100%;height:100%;" ], [ 304, "u8", "background:#ffffff;width:100%;height:100%;" ], [ 357, "u8", "https://winzio.ru/tds/xsvgvx.cgi?3\u0026txiwy=0\u0026elvmn=0\u0026uheub=1\u0026uaxvl=0\u0026bonus=winzcasino\u0026ask=" ], [ 358, "u8", "https://winzio.ru/tds/xsvgvx.cgi?3" ], [ 399, "10", "0" ], [ 407, "10", "0" ], [ 415, "10", "1" ], [ 423, "10", "0" ], [ 460, "u8", "#ffffff" ], [ 461, "u8", "#ffffff" ], [ 512, "u8", "0bab0141d323d42c914515c7-text/javascript" ], [ 513, "u8", "0bab0141d323d42c914515c7-text/javascript" ], [ 667, "10", "301" ], [ 685, "10", "1" ], [ 690, "10", "201" ], [ 702, "10", "1" ], [ 719, "10", "301" ], [ 737, "10", "201" ], [ 749, "10", "1" ], [ 778, "u8", "3?igc.xvgvsx/sdt/ur.oizniw//:ptth" ], [ 779, "u8", "3?igc.xvgvsx/sdt/ur.oizniw//:ptth" ], [ 823, "u8", "+txiwy+" ], [ 824, "u8", "+txiwy+" ], [ 839, "u8", "+elvmn+" ], [ 840, "u8", "+elvmn+" ], [ 855, "10", "1018004577" ], [ 869, "10", "1" ], [ 906, "u8", ";\n\nfunction deurl(s)\n{\n\treturn s.split(" ], [ 907, "u8", ";\n\nfunction deurl(s)\n{\n\treturn s.split(" ], [ 947, "u8", ").reverse().join(" ], [ 948, "u8", ").reverse().join(" ], [ 967, "u8", ");" ], [ 1007, "10", "0" ], [ 1021, "10", "0" ], [ 1061, "u8", "number" ], [ 1062, "u8", "number" ], [ 1748, "10", "0" ], [ 1819, "10", "0" ], [ 1868, "10", "0" ], [ 1958, "10", "0" ], [ 2030, "10", "0" ], [ 2080, "10", "0" ], [ 2163, "10", "0" ], [ 2345, "u8", "/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js" ], [ 2346, "u8", "/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js" ], [ 2429, "u8", "0bab0141d323d42c914515c7-|49" ], [ 2430, "u8", "0bab0141d323d42c914515c7-|49" ], [ 2491, "u8", "text/javascript" ], [ 2492, "u8", "text/javascript" ], [ 2528, "u8", "__CF$cv$params" ], [ 2529, "u8", "__CF$cv$params" ], [ 2549, "u8", "6ad497cece6bec82" ], [ 2550, "u8", "6ad497cece6bec82" ], [ 2570, "u8", "EvqrmPpS0o3BxDleGXkZ3rKqJn8NgsYFn4lh63viPv8-1636770782-0-ATXkM5XNi06KDualzN6YSrrngFuhiHisF+sumpUgg92oFx/D+K1zlazhuIwKhD/Q5F80vth" ], [ 2571, "u8", "EvqrmPpS0o3BxDleGXkZ3rKqJn8NgsYFn4lh63viPv8-1636770782-0-ATXkM5XNi06KDualzN6YSrrngFuhiHisF+sumpUgg92oFx/D+K1zlazhuIwKhD/Q5F80vth" ], [ 2869, "16", "17843510140" ], [ 2882, "16", "588045994257" ], [ 2898, "u8", "/cdn-cgi/challenge-platform/h/g" ], [ 2899, "u8", "/cdn-cgi/challenge-platform/h/g" ] ], "tgt": [ "Results" ], "val": { "file.stem": "VirusShare_e6ba228ad6fccde0674cb679a6a1eb8a", "file.basename": "VirusShare_e6ba228ad6fccde0674cb679a6a1eb8a", "source.language": "javascript", "source.imports[0]": "Results", "source.imports[1]": "myHeight", "source.imports[2]": "myWidth", "source.imports[3]": "n_result", "source.imports[4]": "script", "source.imports[5]": "window.__CF$cv$params", "source.strings[0]": "\"\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=", "source.strings[1]": "#ffffff", "source.strings[2]": ").reverse().join(", "source.strings[3]": "+elvmn+", "source.strings[4]": "+txiwy+", "source.strings[5]": "/cdn-cgi/challenge-platform/h/g", "source.strings[6]": "/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js", "source.strings[7]": "0bab0141d323d42c914515c7-text/javascript", "source.strings[8]": "0bab0141d323d42c914515c7-|49", "source.strings[9]": "1018004577", "source.has_imports": true, "source.strings[10]": "17843510140", "source.strings[11]": "1; URL='http://winzio.ru/tds/xsvgvx.cgi?3", "source.strings[12]": "3?igc.xvgvsx/sdt/ur.oizniw//:ptth", "source.strings[13]": "588045994257", "source.strings[14]": "6ad497cece6bec82", "source.strings[15]": ";\n\nfunction deurl(s)\n{\n\treturn s.split(", "source.strings[16]": "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=", "source.strings[17]": "EvqrmPpS0o3BxDleGXkZ3rKqJn8NgsYFn4lh63viPv8-1636770782-0-ATXkM5XNi06KDualzN6YSrrngFuhiHisF+sumpUgg92oFx/D+K1zlazhuIwKhD/Q5F80vthPE54KxG9svxcIuPaIwg/MeRmyy2FRwUM+35+3EtN2H24RZNd716ZYF/r0Yra2NDdv+zgj53QBkj/gYIPK2Hk6nYSKuq+d2xH9P3rmiHmrjiBETGlhW59IW3QFjS5Fi7bISBY3C9OD6A9hjyud7Rw2x8euXgn5QKlDzhAg", "source.strings[18]": "REFRESH", "source.strings[19]": "__CF$cv$params", "source.strings[20]": "background:#ffffff;width:100%;height:100%;", "source.strings[21]": "https://winzio.ru/tds/xsvgvx.cgi?3", "source.strings[22]": "https://winzio.ru/tds/xsvgvx.cgi?3\u0026txiwy=0\u0026elvmn=0\u0026uheub=1\u0026uaxvl=0\u0026bonus=winzcasino\u0026ask=", "source.strings[23]": "number", "source.strings[24]": "text/javascript", "source.functions[0]": "Height", "source.functions[1]": "Results", "source.functions[2]": "Size", "source.functions[3]": "Width", "source.functions[4]": "anonymous" } }, "find": [ { "id": "metadata/file/text/metrics::single-long-line", "conf": 0.8999999761581421, "crit": 1, "desc": "Very long line" }, { "id": "objectives/anti-static/obfuscation/string/reconstruct::split-join-reconstruction", "conf": 0.800000011920929, "crit": 3, "desc": "String reconstructed via split/join" }, { "id": "objectives/command-and-control/infrastructure/domain/tld::hardcoded-domain-ru", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6000000238418579, "crit": 2, "desc": "Hardcoded .ru country-TLD domain" }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::hardcoded-domain-suspicious-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Hardcoded suspicious TLD domain pattern" }, { "id": "metadata/library/web-frameworks::javascript-built-bundle-marker", "conf": 0.8999999761581421, "crit": 2, "desc": "JavaScript built bundle marker" } ], "path": "VirusShare_e6ba228ad6fccde0674cb679a6a1eb8a", "risk": 2, "size": 2962, "type": "javascript" } ] } }