{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.48895434,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 0.9347826,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T09:12:44Z"
  },
  "path": "7beaa9d1ef94ace7d37691c7dfbf98c200bc5a156cdca633ccb8010033d6e176.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C₂)",
        "x": 40,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 29.0,
              "call_count": 2.0,
              "node_count": 387.0,
              "identifier_count": 19.0,
              "string_literal_count": 6.0,
              "array_literal_max_length": 4.0
            },
            "file": {
              "size": 634.0,
              "entropy": 5.8,
              "size_bytes": 634.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 39.0,
              "total_lines": 12.0,
              "char_entropy": 5.8,
              "unique_chars": 73.0,
              "string_density": 0.5,
              "avg_line_length": 51.0,
              "max_line_length": 172.0,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.1,
              "most_common_ratio": 0.04,
              "identifier_density": 2.5,
              "line_length_stddev": 44.15,
              "normalized_string_count": 1.73,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 111.0,
              "normalized_unique_identifiers": 5.3
            },
            "calls": {
              "count": 2.0
            },
            "strings": {
              "total": 6.0,
              "avg_length": 7.17,
              "max_length": 28.0,
              "avg_entropy": 2.2,
              "empty_count": 1.0,
              "total_bytes": 43.0,
              "entropy_stddev": 1.39
            },
            "identifiers": {
              "count": 19.0,
              "total": 30.0,
              "avg_length": 13.89,
              "max_length": 25.0,
              "min_length": 4.0,
              "avg_entropy": 3.28,
              "reuse_ratio": 0.63,
              "unique_count": 19.0,
              "length_stddev": 6.97,
              "high_entropy_count": 8.0,
              "high_entropy_ratio": 0.42
            }
          },
          "s": [
            [
              62,
              "u8",
              ".ps1"
            ],
            [
              62,
              "u8",
              ".ps1"
            ],
            [
              216,
              "u8",
              "Global\\$KqOwjRRqdvgwPohOAMSC"
            ],
            [
              216,
              "u8",
              "Global\\$KqOwjRRqdvgwPohOAMSC"
            ],
            [
              436,
              "u8",
              "2.ps1"
            ],
            [
              436,
              "u8",
              "2.ps1"
            ],
            [
              444,
              "u8",
              "3.ps1"
            ],
            [
              444,
              "u8",
              "3.ps1"
            ],
            [
              502,
              "u8",
              "\\"
            ],
            [
              502,
              "u8",
              "\\"
            ]
          ],
          "v": {
            "file.stem": "7beaa9d1ef94ace7d37691c7dfbf98c200bc5a156cdca633ccb8010033d6e176",
            "file.basename": "7beaa9d1ef94ace7d37691c7dfbf98c200bc5a156cdca633ccb8010033d6e176.ps1",
            "source.language": "powershell",
            "source.strings[0]": "Global\\$KqOwjRRqdvgwPohOAMSC"
          },
          "ct": [
            "New-Object"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 634,
        "ts": [
          {
            "c": 0.8399999737739563,
            "d": "Hidden directory path literal",
            "e": [
              ".ps1"
            ],
            "i": "micro-behaviors/fs/path/location::hidden-dir-literal",
            "l": 1,
            "el": [
              "0x3e"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "Command"
            ],
            "i": "objectives/command-and-control/dropper/execution/fileless::curl-custom-ua-piped-powershell--rx-30",
            "l": 1
          },
          {
            "d": ".ps1 extension reference",
            "e": [
              ".ps1"
            ],
            "i": "micro-behaviors/fs/path/extension::ps1",
            "l": 2
          },
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[Threading.EventResetMode]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "Reflective assembly entry point invocation",
            "e": [
              ".EntryPoint.Invoke("
            ],
            "i": "objectives/command-and-control/backdoor/loader/managed-reflect::ps-assembly-invoke",
            "l": 4,
            "m": "B0024"
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 12.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.80"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1059.001",
            "c": 0.800000011920929,
            "d": "PS1 file written to disk",
            "e": [
              ".ps1\""
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::ps1-file-write",
            "l": 3,
            "m": "B0030"
          }
        ],
        "sha": "7beaa9d1ef94ace7d37691c7dfbf98c200bc5a156cdca633ccb8010033d6e176",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-11/7beaa9d1ef94ace7d37691c7dfbf98c200bc5a156cdca633ccb8010033d6e176.ps1",
        "type": "powershell"
      }
    ],
    "tv": "52045"
  }
}