{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999439716339111, "class": 2 } ], "prob": 0.999944, "class": 2, "models": [ { "m": "az", "prob": 0.99365366, "class": 2 }, { "m": "az/scripts", "prob": 0.99884254, "class": 1 }, { "m": "az/javascript", "prob": 0.999944, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T15:29:26Z" }, "path": "20170123_db7e7a9524bdabece0cfdda191406c5e.js", "raw": { "v": "4", "fs": [ { "f": "KO₇(Al₂As₅Xe₂C₂CoErS₂)H₃(CrDbPo)Md(Pa₂)", "k": { "source.imports[0]": "afdimorr6", "source.imports[1]": "ewucburry3", "source.imports[2]": "iniqzohs6", "source.imports[3]": "irisbe5", "source.imports[4]": "lwikuzxa6", "source.imports[5]": "okazycku8", "source.imports[6]": "opivdo1", "source.imports[7]": "unoja7", "source.imports[8]": "wsevhiza3", "source.imports[9]": "xxavuko7", "source.strings[0]": "abmykex", "source.strings[1]": "abogsypc", "source.strings[2]": "acekmoj", "source.strings[3]": "afbyfl", "source.strings[4]": "afjywvu", "source.strings[5]": "afsavid", "source.strings[6]": "agjybekv", "source.strings[7]": "ahxogu", "source.strings[8]": "ajwonwo", "source.strings[9]": "akbughytc", "source.has_imports": true, "source.imports[10]": "yzbokoj6", "source.strings[10]": "akfesi", "source.strings[11]": "akzaga", "source.strings[12]": "amdera", "source.strings[13]": "amvalr", "source.strings[14]": "anerwyqp", "source.strings[15]": "anvale", "source.strings[16]": "apdusg", "source.strings[17]": "apiqixj", "source.strings[18]": "aqeczo", "source.strings[19]": "aqofquqs", "source.strings[20]": "astorhu", "source.strings[21]": "atbolven", "source.strings[22]": "awdyrj", "source.strings[23]": "azhocy", "source.strings[24]": "azmabde", "source.strings[25]": "bacbymr", "source.strings[26]": "bamokn", "source.strings[27]": "bgozjebbo", "source.strings[28]": "bhinez", "source.strings[29]": "bmiguzje", "source.strings[30]": "bnuxvafby", "source.strings[31]": "boneqm", "source.strings[32]": "bopwosky", "source.strings[33]": "bxyjbopk", "source.strings[34]": "cikupm", "source.strings[35]": "cneqgocg", "source.strings[36]": "cnynkuqge", "source.strings[37]": "cozniq", "source.strings[38]": "cqorufbu", "source.strings[39]": "crykide", "source.strings[40]": "cuwnalba", "source.strings[41]": "dcitjoj", "source.strings[42]": "ddogzagk", "source.strings[43]": "dejxarwy", "source.strings[44]": "dlehalo", "source.strings[45]": "dogixr", "source.strings[46]": "dqyqihfi", "source.strings[47]": "dtiszu", "source.strings[48]": "dyqvugi", "source.strings[49]": "ebfyvim", "source.strings[50]": "eckipi", "source.strings[51]": "edxosy", "source.strings[52]": "efuwqis", "source.strings[53]": "efvufi", "source.strings[54]": "egfizha", "source.strings[55]": "ejduci", "source.strings[56]": "ekjizcit", "source.strings[57]": "ekpuzhybb", "source.strings[58]": "ekufekr", "source.strings[59]": "elfunx", "source.strings[60]": "epgezd", "source.strings[61]": "eqbeclu", "source.strings[62]": "esotot", "source.strings[63]": "etaksitt", "source.strings[64]": "etwelt", "source.strings[65]": "etymib", "source.strings[66]": "evxamwy", "source.strings[67]": "exmoldi", "source.strings[68]": "ezycitf", "source.strings[69]": "faboxdy", "source.strings[70]": "facfyqp", "source.strings[71]": "fjyddaly", "source.strings[72]": "flijipi", "source.strings[73]": "fluwcy", "source.strings[74]": "fodisv", "source.strings[75]": "fqojve", "source.strings[76]": "fzufar", "source.strings[77]": "gamugu", "source.strings[78]": "gasansi", "source.strings[79]": "gcortunzy", "source.strings[80]": "ghulvexk", "source.strings[81]": "gwuxynmu", "source.strings[82]": "gyrcivh", "source.strings[83]": "hasbisgu", "source.strings[84]": "hawmemw", "source.strings[85]": "hirzagwe", "source.strings[86]": "hkorha", "source.strings[87]": "hnytum", "source.strings[88]": "hpyfnu", "source.strings[89]": "htidenko", "source.strings[90]": "hzywtysy", "source.strings[91]": "ibnobadx", "source.strings[92]": "icbangal", "source.strings[93]": "idzijycs", "source.strings[94]": "ifuctedx", "source.strings[95]": "ifyteb", "source.strings[96]": "ihgisvu", "source.strings[97]": "ijyshypl", "source.strings[98]": "ikozuf", "source.strings[99]": "ilvedjur", "source.strings[100]": "imozik", "source.strings[101]": "inixjyc", "source.strings[102]": "inumge", "source.strings[103]": "ipsyqyr", "source.strings[104]": "irysqih", "source.strings[105]": "isrokpa", "source.strings[106]": "itofezd", "source.strings[107]": "itomun", "source.strings[108]": "ivqokl", "source.strings[109]": "iwejhu", "source.strings[110]": "iwlohz", "source.strings[111]": "izgutl", "source.strings[112]": "izqacz", "source.strings[113]": "jdofdelu", "source.strings[114]": "jedxef", "source.strings[115]": "jejisjy", "source.strings[116]": "jezsot", "source.strings[117]": "jivcuz", "source.strings[118]": "jkyhciru", "source.strings[119]": "jofkywu", "source.strings[120]": "johvebjo", "source.strings[121]": "jximlyqa", "source.strings[122]": "ksyjaml", "source.strings[123]": "kwakfosz", "source.strings[124]": "kxinesa", "source.strings[125]": "kxuxagz", "source.strings[126]": "lenixa", "source.strings[127]": "lgegzy", "source.strings[128]": "liwalv", "source.strings[129]": "lkitfopsa", "source.strings[130]": "lofidja", "source.strings[131]": "lojmaqa", "source.strings[132]": "lwodaj", "source.strings[133]": "mazaqu", "source.strings[134]": "mgumbobri", "source.strings[135]": "mnepny", "source.strings[136]": "najzax", "source.strings[137]": "njymzi", "source.strings[138]": "nmaluwz", "source.strings[139]": "nwixzy", "source.strings[140]": "nymawke", "source.strings[141]": "ocreclydk", "source.strings[142]": "odrose", "source.strings[143]": "ofecro", "source.strings[144]": "ofocti", "source.strings[145]": "ognydu", "source.strings[146]": "ogwago", "source.strings[147]": "ohsuworr", "source.strings[148]": "ojaqyqj", "source.strings[149]": "ojdyqru", "source.strings[150]": "ojobdurg", "source.strings[151]": "ojzajjyc", "source.strings[152]": "okazfokt", "source.strings[153]": "okvady", "source.strings[154]": "okzuftymg", "source.strings[155]": "optovle", "source.strings[156]": "otbipbi", "source.strings[157]": "ottimwuvt", "source.strings[158]": "owecik", "source.strings[159]": "oxvorn", "source.strings[160]": "pbipmewmy", "source.strings[161]": "pekeky", "source.strings[162]": "pfivna", "source.strings[163]": "pmecune", "source.strings[164]": "pnyxnypg", "source.strings[165]": "porubt", "source.strings[166]": "pudgyz", "source.strings[167]": "pxafery", "source.strings[168]": "pzaweqw", "source.strings[169]": "qevito", "source.strings[170]": "qidyvv", "source.strings[171]": "qmazpimo", "source.strings[172]": "qocifqe", "source.strings[173]": "qtozmi", "source.strings[174]": "racneg", "source.strings[175]": "ravyhg", "source.strings[176]": "restehj", "source.strings[177]": "retfacv", "source.strings[178]": "rmepix", "source.strings[179]": "rpekgoxy", "source.strings[180]": "ryneshy", "source.strings[181]": "sadyll", "source.strings[182]": "seryxru", "source.strings[183]": "shizenxa", "source.strings[184]": "sicafjo", "source.strings[185]": "sjevekbu", "source.strings[186]": "skasfiw", "source.strings[187]": "sletvor", "source.strings[188]": "sobelo", "source.strings[189]": "tcyrjo", "source.strings[190]": "tejvib", "source.strings[191]": "thezmy", "source.strings[192]": "tynpyw", "source.strings[193]": "tzatzowli", "source.strings[194]": "ubcehyb", "source.strings[195]": "ubomje", "source.strings[196]": "ucogrijf", "source.strings[197]": "udfurwobz", "source.strings[198]": "udycve", "source.strings[199]": "ugfijzih", "source.strings[200]": "ugupak", "source.strings[201]": "uhsevy", "source.strings[202]": "ujenxa", "source.strings[203]": "ujgopa", "source.strings[204]": "ukmehu", "source.strings[205]": "ulkyne", "source.strings[206]": "ulloba", "source.strings[207]": "umyhiwz", "source.strings[208]": "unumub", "source.strings[209]": "uphanwax", "source.strings[210]": "upwyre", "source.strings[211]": "uqnibu", "source.strings[212]": "uwgetzitk", "source.strings[213]": "uzboqfi", "source.strings[214]": "uziwulf", "source.strings[215]": "vapjisi", "source.strings[216]": "vbafok", "source.strings[217]": "vcagkyhpy", "source.strings[218]": "vefciq", "source.strings[219]": "vfyhaza", "source.strings[220]": "vpavby", "source.strings[221]": "vuwnepq", "source.strings[222]": "vwesuro", "source.strings[223]": "vzakzegw", "source.strings[224]": "wdudare", "source.strings[225]": "wefyxp", "source.strings[226]": "wejaplo", "source.strings[227]": "wespoxn", "source.strings[228]": "wpocbe", "source.strings[229]": "wriwocy", "source.strings[230]": "wsurkykr", "source.strings[231]": "wzejtykz", "source.strings[232]": "xbanhafc", "source.strings[233]": "xdasip", "source.strings[234]": "xidpexg", "source.strings[235]": "xpisenf", "source.strings[236]": "xukumy", "source.strings[237]": "xygdyz", "source.strings[238]": "xzaqofu", "source.strings[239]": "ybfetxutx", "source.strings[240]": "ybicca", "source.strings[241]": "ybocrigh", "source.strings[242]": "ydenifk", "source.strings[243]": "yhsegect", "source.strings[244]": "yjhebry", "source.strings[245]": "ykqislu", "source.strings[246]": "ylcidzyp", "source.strings[247]": "yngusi", "source.strings[248]": "ysveqq", "source.strings[249]": "ytfadbiv", "source.strings[250]": "ywyghab", "source.strings[251]": "yxinry", "source.strings[252]": "zjubdixe", "source.strings[253]": "znokru", "source.strings[254]": "zrinufto", "source.strings[255]": "zumqoc" }, "x": 104, "id": 0, "is": [ "unoja7", "ewucburry3", "iniqzohs6", "wsevhiza3", "xxavuko7", "opivdo1", "okazycku8", "irisbe5", "yzbokoj6", "yzbokoj6", "lwikuzxa6", "afdimorr6", "yzbokoj6", "yzbokoj6", "yzbokoj6", "yzbokoj6", "yzbokoj6", "yzbokoj6" ], "ms": { "file": { "size": 41734.0 }, "text": { "tab_count": 18.0, "digit_ratio": 0.02, "space_count": 4319.0, "total_lines": 21.0, "char_entropy": 4.53, "unique_chars": 72.0, "import_density": 85.71, "lines_over_200": 20.0, "lines_over_500": 18.0, "string_density": 300.0, "avg_line_length": 1986.38, "lines_over_1000": 12.0, "max_line_length": 9809.0, "last_line_length": 3.0, "most_common_char": "\"", "whitespace_ratio": 0.1, "most_common_ratio": 0.2, "identifier_density": 2.0, "line_length_stddev": 2032.96, "normalized_import_count": 3.93, "normalized_string_count": 1374.77, "max_inline_whitespace_run": 1.0, "normalized_unique_identifiers": 2.73 }, "imports": { "total": 18.0, "unique_modules": 11.0, "third_party_count": 18.0, "third_party_ratio": 1.0 }, "strings": { "total": 6300.0, "avg_length": 5.47, "max_length": 9.0, "path_count": 6.0, "avg_entropy": 2.21, "total_bytes": 34460.0, "entropy_stddev": 0.5 }, "comments": { "chars": 9808.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.11, "code_in_comments": 1.0 }, "functions": {}, "identifiers": { "total": 42.0, "avg_length": 8.17, "max_length": 10.0, "min_length": 6.0, "avg_entropy": 2.84, "reuse_ratio": 0.29, "unique_count": 12.0, "length_stddev": 1.14, "has_digit_ratio": 0.92, "numeric_suffix_count": 11.0 } }, "ss": [ [ 27, "amvalr" ], [ 28, "amvalr" ], [ 37, "ognydu" ], [ 38, "ognydu" ], [ 47, "oxals" ], [ 48, "oxals" ], [ 56, "dyqvugi" ], [ 57, "dyqvugi" ], [ 67, "amqo" ], [ 68, "amqo" ], [ 75, "bacbymr" ], [ 76, "bacbymr" ], [ 86, "ukmehu" ], [ 87, "ukmehu" ], [ 96, "swimy" ], [ 97, "swimy" ], [ 105, "ejduci" ], [ 106, "ejduci" ], [ 116, "fluwcy" ], [ 117, "fluwcy" ], [ 126, "pmehl" ], [ 127, "pmehl" ], [ 135, "Cr" ], [ 136, "Cr" ], [ 141, "pzaweqw" ], [ 142, "pzaweqw" ], [ 152, "uqnoq" ], [ 153, "uqnoq" ], [ 165, "hirzagwe" ], [ 166, "hirzagwe" ], [ 177, "wejaplo" ], [ 178, "wejaplo" ], [ 188, "jofkywu" ], [ 189, "jofkywu" ], [ 199, "xcub" ], [ 200, "xcub" ], [ 207, "ymguv" ], [ 208, "ymguv" ], [ 216, "umce" ], [ 217, "umce" ], [ 224, "urot" ], [ 225, "urot" ], [ 232, "mqyce" ], [ 233, "mqyce" ], [ 241, "qkapa" ], [ 242, "qkapa" ], [ 256, "dyny" ], [ 257, "dyny" ], [ 264, "gwuxynmu" ], [ 265, "gwuxynmu" ], [ 276, "sobelo" ], [ 277, "sobelo" ], [ 286, "tzatzowli" ], [ 287, "tzatzowli" ], [ 299, "etymib" ], [ 300, "etymib" ], [ 309, "elsij" ], [ 310, "elsij" ], [ 319, "onvo" ], [ 320, "onvo" ], [ 327, "xtelx" ], [ 328, "xtelx" ], [ 336, "acyba" ], [ 337, "acyba" ], [ 345, "ea" ], [ 346, "ea" ], [ 351, "sletvor" ], [ 352, "sletvor" ], [ 366, "iwlohz" ], [ 367, "iwlohz" ], [ 376, "eja" ], [ 377, "eja" ], [ 383, "xqoru" ], [ 384, "xqoru" ], [ 392, "igtu" ], [ 393, "igtu" ], [ 400, "uqex" ], [ 401, "uqex" ], [ 408, "yrjo" ], [ 409, "yrjo" ], [ 416, "dong" ], [ 417, "dong" ], [ 424, "xarxu" ], [ 425, "xarxu" ], [ 433, "pxafery" ], [ 434, "pxafery" ], [ 444, "akfesi" ], [ 445, "akfesi" ], [ 460, "htidenko" ], [ 461, "htidenko" ], [ 472, "cugw" ], [ 473, "cugw" ], [ 480, "crykide" ], [ 481, "crykide" ], [ 491, "awdyrj" ], [ 492, "awdyrj" ], [ 501, "qtozmi" ], [ 502, "qtozmi" ], [ 511, "ijyshypl" ], [ 512, "ijyshypl" ], [ 523, "ege" ], [ 524, "ege" ], [ 530, "pmecune" ], [ 531, "pmecune" ], [ 541, "rgoxw" ], [ 542, "rgoxw" ], [ 550, "xygdyz" ], [ 551, "xygdyz" ], [ 560, "ogwago" ], [ 561, "ogwago" ], [ 570, "ibri" ], [ 571, "ibri" ], [ 578, "cozniq" ], [ 579, "cozniq" ], [ 588, "vpavby" ], [ 589, "vpavby" ], [ 598, "irysqih" ], [ 599, "irysqih" ], [ 609, "ujenxa" ], [ 610, "ujenxa" ], [ 620, "te" ], [ 621, "te" ], [ 626, "eqbeclu" ], [ 627, "eqbeclu" ], [ 641, "squrr" ], [ 642, "squrr" ], [ 650, "moke" ], [ 651, "moke" ], [ 665, "epy" ], [ 666, "epy" ], [ 672, "flijipi" ], [ 673, "flijipi" ], [ 683, "itofezd" ], [ 684, "itofezd" ], [ 694, "ekufekr" ], [ 695, "ekufekr" ], [ 705, "qycx" ], [ 706, "qycx" ], [ 713, "qevito" ], [ 714, "qevito" ], [ 723, "ljinu" ], [ 724, "ljinu" ], [ 732, "hox" ], [ 733, "hox" ], [ 739, "yxinry" ], [ 740, "yxinry" ], [ 749, "epoh" ], [ 750, "epoh" ], [ 757, "uziwulf" ], [ 758, "uziwulf" ], [ 768, "qidyvv" ], [ 769, "qidyvv" ], [ 778, "dihr" ], [ 779, "dihr" ], [ 786, "zumqoc" ], [ 787, "zumqoc" ], [ 796, "xpisenf" ], [ 797, "xpisenf" ], [ 807, "evxamwy" ], [ 808, "evxamwy" ], [ 818, "xgehy" ], [ 819, "xgehy" ], [ 827, "yrzi" ], [ 828, "yrzi" ], [ 835, "dlehalo" ], [ 836, "dlehalo" ], [ 847, "ylcidzyp" ], [ 848, "ylcidzyp" ], [ 859, "Ob" ], [ 860, "Ob" ], [ 865, "efemq" ], [ 866, "efemq" ], [ 874, "kxuxagz" ], [ 875, "kxuxagz" ], [ 885, "fodisv" ], [ 886, "fodisv" ], [ 899, "owecik" ], [ 900, "owecik" ], [ 909, "ocem" ], [ 910, "ocem" ], [ 924, "boluh" ], [ 925, "boluh" ], [ 934, "ywvu" ], [ 935, "ywvu" ], [ 942, "je" ], [ 943, "je" ], [ 948, "ysmu" ], [ 949, "ysmu" ], [ 956, "yxyd" ], [ 957, "yxyd" ], [ 968, "aged" ], [ 969, "aged" ], [ 976, "hzywtysy" ], [ 977, "hzywtysy" ], [ 988, "sadyll" ], [ 989, "sadyll" ], [ 998, "wsurkykr" ], [ 999, "wsurkykr" ], [ 1010, "ihgisvu" ], [ 1011, "ihgisvu" ], [ 1021, "uwgetzitk" ], [ 1022, "uwgetzitk" ], [ 1034, "eny" ], [ 1035, "eny" ], [ 1041, "hasbisgu" ], [ 1042, "hasbisgu" ], [ 1053, "ujgopa" ], [ 1054, "ujgopa" ], [ 1063, "ges" ], [ 1064, "ges" ], [ 1070, "ikne" ], [ 1071, "ikne" ], [ 1078, "qhut" ], [ 1079, "qhut" ], [ 1086, "okazfokt" ], [ 1087, "okazfokt" ], [ 1098, "huwg" ], [ 1099, "huwg" ], [ 1106, "eqymi" ], [ 1107, "eqymi" ], [ 1115, "opxu" ], [ 1116, "opxu" ], [ 1123, "qviz" ], [ 1124, "qviz" ], [ 1131, "xyd" ], [ 1132, "xyd" ], [ 1138, "ivihv" ], [ 1139, "ivihv" ], [ 1147, "pekeky" ], [ 1148, "pekeky" ], [ 1163, "adke" ], [ 1164, "adke" ], [ 1171, "upqe" ], [ 1172, "upqe" ], [ 1179, "ravyhg" ], [ 1180, "ravyhg" ], [ 1189, "uhsevy" ], [ 1190, "uhsevy" ], [ 1199, "ajwonwo" ], [ 1200, "ajwonwo" ], [ 1210, "elaj" ], [ 1211, "elaj" ], [ 1218, "afbyfl" ], [ 1219, "afbyfl" ], [ 1228, "yhsegect" ], [ 1229, "yhsegect" ], [ 1240, "ywyghab" ], [ 1241, "ywyghab" ], [ 1251, "aniql" ], [ 1252, "aniql" ], [ 1260, "gamugu" ], [ 1261, "gamugu" ], [ 1270, "afsavid" ], [ 1271, "afsavid" ], [ 1281, "iwejhu" ], [ 1282, "iwejhu" ] ], "sz": 41734, "ts": [ { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "iwr" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-analysis/timing/timer::js-newdate-then-eval--rx-5", "l": 1 }, { "c": 1.0, "d": "Tiny SaveToFile fragment (variant 2b)", "e": [ "ile" ], "i": "objectives/execution/interpreter/script/wsh-fragments::savetofile-fragment-tiny-2b", "l": 1 }, { "a": "T1027.003", "c": 1.0, "d": "JavaScript or TypeScript source file extension", "e": [ "20170123_db7e7a9524bdabece0cfdda191406c5e.js" ], "i": "objectives/anti-static/obfuscation/payload/container::js-source-extension", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".Fi" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Immediate indexing of array literal", "e": [ "[\"fluwcy\", \"pmehl\", \"Cr\", \"pzaweqw\", \"uqnoq\"][2]" ], "i": "micro-behaviors/data/source/syntax/array::array-literal-indexing", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170123_db7e7a9524bdabece0cfdda191406c5e.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.800000011920929, "d": "ADODB.Stream string fragment (ADODB/ADO)", "e": [ "ADO" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-1", "l": 3 }, { "a": "T1195.002, T1059.007", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/supply-chain/hidden-payload/runtime::fetched-text-function-param--rx-5", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-14", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 9809.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "new Function(" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-1", "l": 1 }, { "c": 0.8500000238418579, "d": "Quoted JSON IV field", "e": [ "\"iv\"" ], "i": "micro-behaviors/crypto/symmetric/aes/payload::quoted-iv-field", "l": 1, "m": "C0021.001" }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 21.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170123_db7e7a9524bdabece0cfdda191406c5e.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.9200000166893005, "d": "Executable code embedded in comment", "e": [ "comments.code_in_comments = 1.00" ], "i": "objectives/anti-static/obfuscation/string/array::js-comment-exec-body", "l": 3 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Multiple source lines exceed 1000 chars", "e": [ "text.lines_over_1000 = 12.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-layout", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exact tiny XMLHTTP fragments (XMLH, XML2., MS)", "e": [ "MS" ], "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-exact", "l": 1 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.8999999761581421, "d": "Exact tiny readyState fragments (rea, dy, tate)", "e": [ "dy" ], "i": "objectives/execution/interpreter/script/wsh-fragments::readystate-fragment-tiny-exact", "l": 4 }, { "c": 0.8999999761581421, "d": "Exact tiny WScript fragments (She, ll)", "e": [ "ll" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-exact-2", "l": 4 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "c": 0.8399999737739563, "d": "JavaScript unusually long average lines", "e": [ "text.avg_line_length = 1986.38" ], "i": "objectives/anti-static/obfuscation/string/anomaly::javascript-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 12.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1497.001", "c": 0.800000011920929, "d": "Obfuscated JScript timing-based analysis evasion", "e": [ "ll", "dy" ], "i": "objectives/anti-analysis/timing/evasion::js-obfuscated-timing-evasion", "l": 4, "m": "B0001.032" } ], "sha": "895f9367139928462af4b6316770d8493c951918b7965c51b4246066b6bf4ebd", "path": "20170123_db7e7a9524bdabece0cfdda191406c5e.js", "type": "javascript" } ], "tv": "84923" } }