{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8383554220199585,
        "class": 0
      }
    ],
    "prob": 0.8383554,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.19900933,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 0.57859534,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T19:35:24Z"
  },
  "path": "20170206_5601e3f1b386552d309c30661ae3ae30.js",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(SXe₃)H₃(CmOsPo₂)",
        "x": 6,
        "ff": {
          "i": [
            [
              "",
              "z1"
            ],
            [
              "",
              "z4"
            ],
            [
              "",
              "e.open"
            ],
            [
              "",
              "e.send"
            ],
            [
              "",
              "z3"
            ],
            [
              "",
              "z3"
            ],
            [
              "",
              "z3.split"
            ],
            [
              "",
              "z3"
            ],
            [
              "",
              "z3.join"
            ],
            [
              "",
              "eval"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 12.0,
              "bind_count": 9.0,
              "call_count": 7.0,
              "node_count": 222.0,
              "target_count": 7.0,
              "member_depth_max": 2.0,
              "string_bind_count": 3.0,
              "string_literal_count": 8.0,
              "string_concat_chain_max_length": 4.0
            },
            "file": {
              "size": 476.0,
              "entropy": 5.44,
              "size_bytes": 476.0
            },
            "text": {
              "digit_ratio": 0.09,
              "space_count": 58.0,
              "total_lines": 1.0,
              "char_entropy": 5.44,
              "unique_chars": 71.0,
              "lines_over_200": 1.0,
              "string_density": 8.0,
              "avg_line_length": 476.0,
              "max_line_length": 476.0,
              "last_line_length": 476.0,
              "whitespace_ratio": 0.12,
              "most_common_ratio": 0.05,
              "identifier_density": 36.0,
              "normalized_string_count": 8.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 114.0,
              "suspicious_identifier_ratio": 0.41
            },
            "strings": {
              "total": 8.0,
              "url_count": 1.0,
              "avg_length": 21.13,
              "max_length": 77.0,
              "path_count": 1.0,
              "avg_entropy": 2.92,
              "total_bytes": 169.0,
              "domain_count": 2.0,
              "entropy_stddev": 1.51,
              "high_entropy_count": 1.0
            },
            "identifiers": {
              "total": 36.0,
              "avg_length": 4.29,
              "max_length": 13.0,
              "min_length": 1.0,
              "avg_entropy": 1.53,
              "reuse_ratio": 0.47,
              "unique_count": 17.0,
              "length_stddev": 3.44,
              "has_digit_ratio": 0.18,
              "sequential_names": 7.0,
              "single_char_count": 4.0,
              "single_char_ratio": 0.24,
              "all_lowercase_ratio": 0.65,
              "numeric_suffix_count": 3.0
            }
          },
          "s": [
            [
              9,
              "u8",
              "Msxml2.XMLHTTP"
            ],
            [
              10,
              "u8",
              "Msxml2.XMLHTTP"
            ],
            [
              35,
              "u8",
              "zXMd7WmsfCYR4Elijowfndm9BW_vR03h-PFz1zBrfdS7hHp4vENptm70HP17kBhVEZlOn-iXcvg_0"
            ],
            [
              36,
              "u8",
              "zXMd7WmsfCYR4Elijowfndm9BW_vR03h-PFz1zBrfdS7hHp4vENptm70HP17kBhVEZlOn-iXcvg_0"
            ],
            [
              134,
              "u8",
              "singoutloudkaraoke.com"
            ],
            [
              135,
              "u8",
              "singoutloudkaraoke.com"
            ],
            [
              159,
              "u8",
              "corporationregistry-online-form.com"
            ],
            [
              160,
              "u8",
              "corporationregistry-online-form.com"
            ],
            [
              208,
              "u8",
              "a"
            ],
            [
              209,
              "u8",
              "a"
            ],
            [
              290,
              "u8",
              "GET"
            ],
            [
              291,
              "u8",
              "GET"
            ],
            [
              297,
              "u8",
              "http://"
            ],
            [
              298,
              "u8",
              "http://"
            ],
            [
              312,
              "u8",
              "/counter/?"
            ],
            [
              313,
              "u8",
              "/counter/?"
            ]
          ],
          "v": {
            "source.language": "javascript",
            "source.imports[0]": "e.open",
            "source.imports[1]": "e.send",
            "source.imports[2]": "eval",
            "source.imports[3]": "z1",
            "source.imports[4]": "z3",
            "source.imports[5]": "z3.join",
            "source.imports[6]": "z3.split",
            "source.imports[7]": "z4",
            "source.strings[0]": "/counter/?",
            "source.strings[1]": "Msxml2.XMLHTTP",
            "source.strings[2]": "corporationregistry-online-form.com",
            "source.strings[3]": "http://",
            "source.strings[4]": "singoutloudkaraoke.com",
            "source.strings[5]": "zXMd7WmsfCYR4Elijowfndm9BW_vR03h-PFz1zBrfdS7hHp4vENptm70HP17kBhVEZlOn-iXcvg_0",
            "source.has_imports": true
          },
          "ca": [
            [
              "Array",
              "corporationregistry-online-form.com"
            ],
            [
              "Array",
              "singoutloudkaraoke.com"
            ],
            [
              "e.open",
              "/counter/?"
            ],
            [
              "e.open",
              "GET"
            ],
            [
              "e.open",
              "http://"
            ]
          ],
          "ct": [
            "ActiveXObject",
            "Array",
            "e.open",
            "e.send",
            "eval",
            "z3.join",
            "z3.split"
          ],
          "id": "javascript",
          "mc": [
            "e.open",
            "e.responseText",
            "e.send",
            "e.status",
            "x.length",
            "z3.join",
            "z3.split"
          ]
        },
        "id": 0,
        "sz": 476,
        "ts": [
          {
            "c": 1.0,
            "d": "ADODB.Stream Open method call",
            "e": [
              ".open("
            ],
            "i": "micro-behaviors/fs/write/stream::adodb-open",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "XMLHTTP/WinHTTP COM ProgID reference",
            "e": [
              "XMLHTTP"
            ],
            "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-com-progid-text",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8199999928474426,
            "d": "JavaScript static key string assignment",
            "e": [
              "= \"zXMd7WmsfCYR4Elijowfndm9BW_vR03h-PFz1zBrfdS7hHp4vENptm70HP17kBhVEZlOn-iXcvg_0\""
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ActiveXObject instantiation call",
            "e": [
              "new ActiveXObject("
            ],
            "i": "objectives/execution/interpreter/script/wsh::activexobject-call",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Short sidecar-sized source",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/package/config::short-sidecar-file",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (AST)",
            "e": [
              "for (var i=0; i\u003cx.length; i++) { var e = new ActiveXObject(z1); try { e.open(\"GET\", \"http://\"+x[i]+\"..."
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "URL path fragment 'unte' (part of /counter/)",
            "e": [
              "/counter/"
            ],
            "i": "objectives/command-and-control/channel/http/uri::uri-fragment-counter-path-unte",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "ActiveXObject string presence",
            "e": [
              "ActiveXObject"
            ],
            "i": "micro-behaviors/process/interpreter/jscript::activex-object",
            "l": 3
          },
          {
            "a": "T1059.007",
            "c": 0.8500000238418579,
            "d": "HTTP status 200 check",
            "e": [
              "e.status == 200"
            ],
            "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-status-code-200",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              " for ("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "eval/new Function call (flatted tamper fragment)",
            "e": [
              "eval("
            ],
            "i": "well-known/lib/flatted::flatted-tamper-eval",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "ActiveXObject usage (JScript/VBScript)",
            "e": [
              "ActiveXObject("
            ],
            "i": "objectives/command-and-control/dropper/builder::activex-object-dup",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "ActiveXObject marker",
            "e": [
              "ActiveXObject"
            ],
            "i": "micro-behaviors/process/create/script/wsh::activexobject-marker",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny JavaScript file lines",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::tiny-javascript-file-lines",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "20170206_5601e3f1b386552d309c30661ae3ae30.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "20170206_5601e3f1b386552d309c30661ae3ae30.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Variable-based split with token delimiter",
            "e": [
              ".split(m)"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-var-split-marker",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Generic XMLHTTP CLSID reference",
            "e": [
              "Msxml2.XMLHTTP"
            ],
            "i": "micro-behaviors/os/com/object::clsid-xmlhttp-generic",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "send"
            ],
            "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTP protocol prefix",
            "e": [
              "http://"
            ],
            "i": "micro-behaviors/communications/http/protocol::http-prefix",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "eval() function call (raw)",
            "e": [
              "eval"
            ],
            "i": "micro-behaviors/process/interpreter/eval::js-eval-raw",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Tiny XMLHTTP fragment (variant 2)",
            "e": [
              ".XMLHT"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "20170206_5601e3f1b386552d309c30661ae3ae30.js"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.75,
            "d": "eval() with dynamic argument",
            "e": [
              "eval"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::eval-function-call-arg",
            "l": 3
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "eval on decoded variable",
            "e": [
              "eval(z3)"
            ],
            "i": "objectives/execution/interpreter/eval/dynamic::array-eval-variable",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "Access to HTTP response body (.responseText)",
            "e": [
              ".responseText"
            ],
            "i": "micro-behaviors/communications/http/client/response-body::response-text",
            "l": 3
          },
          {
            "a": "T1202",
            "c": 0.800000011920929,
            "d": "new ActiveXObject pattern",
            "e": [
              "new ActiveXObject("
            ],
            "i": "objectives/execution/activex/com::activex-object-create-literal",
            "l": 3,
            "m": "E1243"
          },
          {
            "a": "T1195.002",
            "c": 0.9700000286102295,
            "d": "Empty catch hides loader errors",
            "e": [
              "catch(e) { }"
            ],
            "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Top-level try/catch empty handler",
            "e": [
              "catch(e) { }"
            ],
            "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty",
            "l": 1,
            "m": "B0024"
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "XMLHTTP status 200 check",
            "e": [
              "XMLHTTP",
              "e.status == 200"
            ],
            "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-status-200-check",
            "l": 1
          },
          {
            "a": "T1202",
            "c": 0.75,
            "d": "Windows Script Host execution",
            "e": [
              "new ActiveXObject(",
              "Msxml2.XMLHTTP"
            ],
            "i": "objectives/execution/interpreter/script/wsh::wscript-execution-comp",
            "l": 3
          }
        ],
        "sha": "9c4ccc867541ad9babae466c570b54de6abfd8c3cc8df5041ac685d9a2319391",
        "path": "20170206_5601e3f1b386552d309c30661ae3ae30.js",
        "type": "javascript"
      }
    ],
    "tv": "cf883"
  }
}