{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.2557252049446106, "class": 0 } ], "prob": 0.2557252, "class": 0, "models": [ { "m": "az", "prob": 0.066183135, "class": 0 }, { "m": "az/scripts", "prob": 0.14222223, "class": 0 }, { "m": "az/javascript", "prob": 0.2557252, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T06:43:50Z" }, "path": "1cf5a6b53c1b0b126715ef584070b03c.js", "raw": { "v": "5", "fs": [ { "f": "H₂(Cm₃F)", "x": 4, "ff": { "i": [ [ "", "cookieSyncPixels" ], [ "", "t.o" ], [ "", "t.o" ], [ "", "Object.defineProperty" ], [ "", "Object.prototype.hasOwnProperty.call" ], [ "", "Object.defineProperty" ], [ "", "Object.defineProperty" ], [ "", "t.r" ], [ "", "t.d" ], [ "", "t.toLowerCase.includes" ], [ "", "t.toLowerCase" ], [ "", "t.toLowerCase.includes" ], [ "", "t.toLowerCase" ], [ "", "window.csLog" ], [ "", "decodeURIComponent.split" ], [ "", "decodeURIComponent" ], [ "", "n.charAt" ], [ "", "n.substring" ], [ "", "n.indexOf" ], [ "", "n.substring" ], [ "", "t.setTime" ], [ "", "t.getTime" ], [ "", "t.toUTCString" ], [ "", "document.cookie" ], [ "", "fetch" ], [ "", "e.json" ], [ "", "fetch" ], [ "", "JSON.stringify" ], [ "", "i.json" ], [ "", "t.split.forEach" ], [ "", "t.split" ], [ "", "t.split" ], [ "", "Object.entries.map.join" ], [ "", "Object.entries.map" ], [ "", "Object.entries" ], [ "", "t.join" ], [ "", "Object.entries.forEach" ], [ "", "Object.entries" ], [ "", "i.idMappings.push" ], [ "", "cookieSyncPixels" ] ], "m": { "ast": { "max_depth": 26.0, "bind_count": 58.0, "call_count": 76.0, "node_count": 2049.0, "target_count": 47.0, "member_depth_max": 4.0, "string_bind_count": 3.0, "string_literal_count": 58.0, "string_concat_chain_max_length": 6.0 }, "file": { "size": 3076.0, "entropy": 5.42, "size_bytes": 3076.0 }, "text": { "digit_ratio": 0.02, "space_count": 64.0, "total_lines": 1.0, "char_entropy": 5.42, "unique_chars": 83.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 58.0, "avg_line_length": 3076.0, "lines_over_1000": 1.0, "max_line_length": 3076.0, "last_line_length": 3076.0, "long_token_count": 8.0, "whitespace_ratio": 0.02, "most_common_ratio": 0.08, "identifier_density": 388.0, "encoded_string_ratio": 0.03, "normalized_string_count": 58.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 2.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.28 }, "source": { "function_count": 1.0 }, "strings": { "total": 58.0, "url_count": 2.0, "avg_length": 10.48, "max_length": 95.0, "avg_entropy": 2.18, "empty_count": 3.0, "hex_strings": 1.0, "total_bytes": 608.0, "domain_count": 2.0, "entropy_stddev": 1.32, "base64_candidates": 1.0, "high_entropy_count": 1.0 }, "comments": { "chars": 2359.0, "lines": 1.0, "total": 1.0, "url_in_comments": 1.0, "code_in_comments": 1.0, "base64_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "count": 1.0, "anonymous": 23.0, "avg_params": 0.67, "max_params": 3.0, "one_liners": 24.0, "avg_name_length": 1.0, "no_params_count": 17.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "nested_functions": 4.0, "avg_nesting_depth": 1.08, "max_nesting_depth": 2.0, "single_char_names": 1.0, "single_char_params": 16.0, "avg_param_name_length": 1.0, "density_per_100_lines": 2400.0, "code_in_functions_ratio": 24.0 }, "identifiers": { "total": 388.0, "avg_length": 5.94, "max_length": 18.0, "min_length": 1.0, "avg_entropy": 1.9, "reuse_ratio": 0.23, "unique_count": 88.0, "length_stddev": 4.38, "has_digit_ratio": 0.05, "sequential_names": 25.0, "single_char_count": 21.0, "single_char_ratio": 0.24, "high_entropy_count": 1.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.56, "all_uppercase_ratio": 0.06, "numeric_suffix_count": 4.0 } }, "s": [ [ 27, "u8", "use strict" ], [ 28, "u8", "use strict" ], [ 203, "u8", "undefined" ], [ 204, "u8", "undefined" ], [ 301, "u8", "Module" ], [ 302, "u8", "Module" ], [ 336, "u8", "__esModule" ], [ 337, "u8", "__esModule" ], [ 422, "u8", "ivid" ], [ 423, "u8", "ivid" ], [ 431, "u8", "gtm_idsynced" ], [ 432, "u8", "gtm_idsynced" ], [ 463, "u8", "PROVIDER_TRANSIENT_ID" ], [ 464, "u8", "PROVIDER_TRANSIENT_ID" ], [ 490, "u8", "PROBABILISTIC_PERSON_ID" ], [ 491, "u8", "PROBABILISTIC_PERSON_ID" ], [ 519, "u8", "PROBABILISTIC_HOUSEHOLD_ID" ], [ 520, "u8", "PROBABILISTIC_HOUSEHOLD_ID" ], [ 551, "u8", "DETERMINISTIC_PERSON_ID" ], [ 552, "u8", "DETERMINISTIC_PERSON_ID" ], [ 580, "u8", "DETERMINISTIC_HOUSEHOLD_ID" ], [ 581, "u8", "DETERMINISTIC_HOUSEHOLD_ID" ], [ 640, "u8", "creditkarma.com" ], [ 641, "u8", "creditkarma.com" ], [ 689, "u8", "intuit.com" ], [ 690, "u8", "intuit.com" ], [ 708, "u8", "https://idsync.api.intuit.com/v1/idsync/batch?domain=${t}" ], [ 709, "u8", "https://idsync.api.intuit.com/v1/idsync/batch?domain=" ], [ 800, "u8", "function" ], [ 801, "u8", "function" ], [ 867, "u8", "gtmCookieSyncHandledException" ], [ 868, "u8", "gtmCookieSyncHandledException" ], [ 913, "u8", "error" ], [ 914, "u8", "error" ], [ 940, "u8", "=" ], [ 941, "u8", "=" ], [ 988, "u8", ";" ], [ 989, "u8", ";" ], [ 1037, "u8", " " ], [ 1038, "u8", " " ], [ 1223, "u8", "expires=" ], [ 1224, "u8", "expires=" ], [ 1268, "u8", "=" ], [ 1269, "u8", "=" ], [ 1274, "u8", ";" ], [ 1275, "u8", ";" ], [ 1280, "u8", ";SameSite=None;Secure;path=/" ], [ 1281, "u8", ";SameSite=None;Secure;path=/" ], [ 1354, "u8", "2843367925" ], [ 1355, "u8", "2843367925" ], [ 1367, "u8", "1pc" ], [ 1368, "u8", "1pc" ], [ 1392, "u8", "https://fid.agkn.com/f?${e}" ], [ 1393, "u8", "https://fid.agkn.com/f?" ], [ 1480, "u8", "include" ], [ 1481, "u8", "include" ], [ 1607, "u8", "Intuit_APIKey intuit_apikey=prdakyresCsoIkuSFJwHp4n9bXlnTgk6FTNzGdz8, intuit_apikey_version=1.0" ], [ 1608, "u8", "Intuit_APIKey intuit_apikey=prdakyresCsoIkuSFJwHp4n9bXlnTgk6FTNzGdz8, intuit_apikey_version=1.0" ], [ 1705, "u8", "Content-Type" ], [ 1706, "u8", "Content-Type" ], [ 1720, "u8", "application/json" ], [ 1721, "u8", "application/json" ], [ 1753, "u8", "include" ], [ 1754, "u8", "include" ], [ 1770, "u8", "POST" ], [ 1771, "u8", "POST" ], [ 1875, "u8", "|" ], [ 1876, "u8", "|" ], [ 1992, "u8", "|" ], [ 1993, "u8", "|" ], [ 2104, "u8", "INTUIT_VISITOR_ID" ], [ 2105, "u8", "INTUIT_VISITOR_ID" ], [ 2178, "u8", "TU" ], [ 2179, "u8", "TU" ], [ 2277, "u8", "true" ], [ 2278, "u8", "true" ], [ 2293, "u8", "1|1" ], [ 2294, "u8", "1|1" ], [ 2303, "u8", "ccpa" ], [ 2304, "u8", "ccpa" ], [ 2388, "u8", "INTUIT" ], [ 2389, "u8", "INTUIT" ], [ 2435, "u8", "true" ], [ 2436, "u8", "true" ], [ 2455, "u8", "true" ], [ 2456, "u8", "true" ], [ 2550, "u8", "true" ], [ 2551, "u8", "true" ], [ 2632, "u8", "CK" ], [ 2633, "u8", "CK" ], [ 2663, "u8", "ivid" ], [ 2664, "u8", "ivid" ], [ 2697, "u8", "true" ], [ 2698, "u8", "true" ], [ 2708, "u8", "function" ], [ 2709, "u8", "function" ], [ 2754, "u8", "true" ], [ 2755, "u8", "true" ], [ 2790, "u8", "CK" ], [ 2791, "u8", "CK" ], [ 2811, "u8", "ivid" ], [ 2812, "u8", "ivid" ], [ 2845, "u8", "true" ], [ 2846, "u8", "true" ], [ 2856, "u8", "function" ], [ 2857, "u8", "function" ] ], "v": { "source.language": "javascript", "source.imports[0]": "JSON.stringify", "source.imports[1]": "Object.defineProperty", "source.imports[2]": "Object.entries", "source.imports[3]": "Object.entries.forEach", "source.imports[4]": "Object.entries.map", "source.imports[5]": "Object.entries.map.join", "source.imports[6]": "Object.prototype.hasOwnProperty.call", "source.imports[7]": "cookieSyncPixels", "source.imports[8]": "decodeURIComponent", "source.imports[9]": "decodeURIComponent.split", "source.strings[0]": "2843367925", "source.strings[1]": ";SameSite=None;Secure;path=/", "source.strings[2]": "Content-Type", "source.strings[3]": "DETERMINISTIC_HOUSEHOLD_ID", "source.strings[4]": "DETERMINISTIC_PERSON_ID", "source.strings[5]": "INTUIT", "source.strings[6]": "INTUIT_VISITOR_ID", "source.strings[7]": "Intuit_APIKey intuit_apikey=prdakyresCsoIkuSFJwHp4n9bXlnTgk6FTNzGdz8, intuit_apikey_version=1.0", "source.strings[8]": "Module", "source.strings[9]": "PROBABILISTIC_HOUSEHOLD_ID", "source.has_imports": true, "source.imports[10]": "document.cookie", "source.imports[11]": "e.json", "source.imports[12]": "fetch", "source.imports[13]": "i.idMappings.push", "source.imports[14]": "i.json", "source.imports[15]": "n.charAt", "source.imports[16]": "n.indexOf", "source.imports[17]": "n.substring", "source.imports[18]": "t.d", "source.imports[19]": "t.getTime", "source.imports[20]": "t.join", "source.imports[21]": "t.o", "source.imports[22]": "t.r", "source.imports[23]": "t.setTime", "source.imports[24]": "t.split", "source.imports[25]": "t.split.forEach", "source.imports[26]": "t.toLowerCase", "source.imports[27]": "t.toLowerCase.includes", "source.imports[28]": "t.toUTCString", "source.imports[29]": "window.csLog", "source.strings[10]": "PROBABILISTIC_PERSON_ID", "source.strings[11]": "PROVIDER_TRANSIENT_ID", "source.strings[12]": "__esModule", "source.strings[13]": "application/json", "source.strings[14]": "creditkarma.com", "source.strings[15]": "expires=", "source.strings[16]": "function", "source.strings[17]": "gtmCookieSyncHandledException", "source.strings[18]": "gtm_idsynced", "source.strings[19]": "https://fid.agkn.com/f?", "source.strings[20]": "https://fid.agkn.com/f?${e}", "source.strings[21]": "https://idsync.api.intuit.com/v1/idsync/batch?domain=", "source.strings[22]": "https://idsync.api.intuit.com/v1/idsync/batch?domain=${t}", "source.strings[23]": "include", "source.strings[24]": "intuit.com", "source.strings[25]": "undefined", "source.strings[26]": "use strict", "source.functions[0]": "anonymous", "source.functions[1]": "e", "source.functions[2]": "h", "source.functions[3]": "m", "source.functions[4]": "t" }, "ca": [ [ "Headers", "Content-Type" ], [ "Headers", "Intuit_APIKey intuit_apikey=prdakyresCsoIkuSFJwHp4n9bXlnTgk6FTNzGdz8, intuit_apikey_version=1.0" ], [ "Headers", "application/json" ], [ "Object.defineProperty", "Module" ], [ "Object.defineProperty", "__esModule" ], [ "Object.entries().map().join", "|" ], [ "T", "" ], [ "URL", "https://fid.agkn.com/f?${e}" ], [ "URLSearchParams", "1pc" ], [ "URLSearchParams", "2843367925" ], [ "d", "ccpa" ], [ "decodeURIComponent().split", ";" ], [ "fetch", "POST" ], [ "fetch", "include" ], [ "p", "" ], [ "p", "CK" ], [ "p", "INTUIT" ], [ "s", "CK" ], [ "s", "INTUIT" ], [ "t.join", ":" ], [ "t.split", ":" ], [ "t.split", "|" ], [ "t.toLowerCase().includes", "creditkarma.com" ], [ "t.toLowerCase().includes", "intuit.com" ], [ "u", "ivid" ], [ "window.csLog", "error" ] ], "ct": [ "Date", "Headers", "I", "JSON.stringify", "Object.defineProperty", "Object.entries", "Object.entries().forEach", "Object.entries().map", "Object.entries().map().join", "Object.prototype.hasOwnProperty.call", "S", "T", "URL", "URLSearchParams", "a", "c", "d", "decodeURIComponent", "decodeURIComponent().split", "e", "e.json", "f", "fetch", "g", "i.idMappings.push", "i.json", "l", "n.charAt", "n.indexOf", "n.substring", "p", "r", "s", "t.d", "t.getTime", "t.join", "t.o", "t.r", "t.setTime", "t.split", "t.split().forEach", "t.toLowerCase", "t.toLowerCase().includes", "t.toUTCString", "u", "window.csLog", "y" ], "id": "javascript", "mc": [ "JSON.stringify", "Object.defineProperty", "Object.entries", "Object.entries().forEach", "Object.entries().map", "Object.entries().map().join", "Object.prototype", "Object.prototype.hasOwnProperty", "Object.prototype.hasOwnProperty.call", "Symbol.toStringTag", "URL().href", "c.TruAudienceID", "decodeURIComponent().split", "document.cookie", "e.json", "e.length", "i.idMappings", "i.idMappings.push", "i.json", "i.length", "i.tu", "n.charAt", "n.indexOf", "n.ivid", "n.length", "n.substring", "o.TruAudienceID", "o.tu", "t.d", "t.getTime", "t.ivid", "t.join", "t.message", "t.o", "t.r", "t.setTime", "t.split", "t.split().forEach", "t.toLowerCase", "t.toLowerCase().includes", "t.toUTCString", "window.csLog", "window.location", "window.location.hostname" ] }, "id": 0, "sz": 3076, "ts": [ { "a": "T1552.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "fetch" ], "i": "objectives/supply-chain/credential-theft/registry::js-creds-to-fetch--rx-12", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Hostname profile field", "e": [ "hostname" ], "i": "objectives/discovery/system/profile::host-profile-hostname-field", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "\"POST\"" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "c": 1.0, "d": "JavaScript includes method", "e": [ "includes" ], "i": "metadata/lang/scripted::includes-method", "l": 1 }, { "a": "T1027.002", "c": 0.8999999761581421, "d": "LZString decoded value split call", "e": [ ").split(\";\")" ], "i": "objectives/anti-static/obfuscation/string/encoding::js-lzstring-table-split-call", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript undefined literal", "e": [ "undefined" ], "i": "metadata/lang/scripted::undefined-literal", "l": 1 }, { "c": 0.949999988079071, "d": "fetch/XMLHttpRequest/http(s) require (flatted tamper fragment)", "e": [ "fetch" ], "i": "well-known/lib/flatted::flatted-tamper-network", "l": 1 }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ "{for(" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Many single-char params", "e": [ "functions.single_char_params = 16.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::single-char-params", "l": 1, "m": "B0032" }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for(;\" \"==n.charAt(0);)n=n.substring(1);", "for(let t=0;t\u003ci.length;t++){let n=i[t];for(;\" \"==n.charAt(0);)n=n.substring(1);if(0==n.indexOf(e))re...", "for(var n in i)t.o(i,n)\u0026\u0026!t.o(e,n)\u0026\u0026Object.defineProperty(e,n,{enumerable:!0,get:i[n]})" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 0.699999988079071, "d": "decodeURIComponent function", "e": [ "decodeURIComponent" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-decodeuricomponent", "l": 2 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny JavaScript file lines", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::tiny-javascript-file-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "window.location.hostname" ], "i": "micro-behaviors/communications/http/url/path::browser-location-host-ref--rx-1", "l": 1 }, { "c": 0.75, "d": "Reads browser location hostname", "e": [ "window.location.hostname" ], "i": "micro-behaviors/fs/path/sensitive/browser::window-location-hostname", "l": 3 }, { "c": 0.699999988079071, "d": "Domain tracking field", "e": [ "domain=" ], "i": "objectives/command-and-control/infrastructure/tracking::domain-field", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "application/json" ], "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-18", "l": 1 }, { "c": 0.949999988079071, "d": "JavaScript or TypeScript basename", "e": [ "1cf5a6b53c1b0b126715ef584070b03c.js" ], "i": "metadata/lang/source::js-ts-source-basename", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 3076.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Content-Type" ], "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-21", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "error" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "credit" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-1", "l": 1, "m": "B0030" }, { "c": 0.6000000238418579, "d": "use strict directive string", "e": [ "use strict" ], "i": "metadata/package/tooling::use-strict-quote", "l": 1 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "a": "T1539", "c": 0.6499999761581421, "d": "Sets browser cookie via document.cookie assignment", "e": [ "document.cookie=" ], "i": "micro-behaviors/communications/http/cookies::document-cookie-write", "l": 3, "m": "C0002" }, { "c": 0.8199999928474426, "d": "JavaScript static key string assignment", "e": [ "=\",i=decodeURIComponent(document.cookie).split(\"" ], "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "c": 1.0, "d": "Plain JavaScript identifier assignment", "e": [ "SameSite=None;" ], "i": "metadata/lang/scripted::plain-js-identifier-assignment", "l": 1 }, { "c": 0.30000001192092896, "d": "HTTP configuration field (headers)", "e": [ "headers:" ], "i": "micro-behaviors/communications/http/request/client::http-config-headers", "l": 2 }, { "c": 0.6000000238418579, "d": "__esModule property", "e": [ "__esModule" ], "i": "metadata/package/tooling::esmodule-export", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "fetch() API call (JavaScript)", "e": [ "fetch(t,{headers:new Headers({Authorization:\"Intuit_APIKey intuit_apikey=prdakyresCsoIkuSFJwHp4n9bXl...", "fetch(t,{credentials:\"include\"})" ], "i": "micro-behaviors/communications/http/request/client::js-fetch-call", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 25.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ "_ID\"" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003" }, { "a": "T1552.001", "c": 0.699999988079071, "d": "Settings API key keyword", "e": [ "apiKey" ], "i": "objectives/supply-chain/credential-theft/registry::settings-api-keyword", "l": 1 }, { "c": 0.30000001192092896, "d": "JavaScript Date object construction", "e": [ "new Date" ], "i": "micro-behaviors/time/query::js-new-date", "l": 2 }, { "d": "JSON.stringify call", "e": [ "JSON.stringify" ], "i": "micro-behaviors/data/serialize/json::json-stringify-call", "l": 2 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "join(" ], "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4", "l": 1 }, { "c": 0.30000001192092896, "d": "HTTP configuration field (body)", "e": [ "body:" ], "i": "micro-behaviors/communications/http/request/client::http-config-body", "l": 2 }, { "c": 0.8199999928474426, "d": "JavaScript substring search call", "e": [ "includes(" ], "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "l": 2 }, { "a": "T1041", "c": 0.75, "d": "HTTP upload request call token", "e": [ "fetch" ], "i": "objectives/supply-chain/recon-exfil/npm-install-targeting::upload-request-call", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "charAt in loop pattern", "e": [ "n.charAt" ], "i": "objectives/anti-static/obfuscation/string/encoding::js-charat-loop", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Nested loops with multiple charAt calls", "e": [ "for(let t=0;t\u003ci.length;t++){let n=i[t];for(;\" \"==n.charAt(0);)n=n.substring(1);if(0==n.indexOf(e))return n.substring(e.length,n." ], "i": "micro-behaviors/data/encode/permutation/loop::js-permutation-loop", "l": 2 }, { "c": 0.6000000238418579, "d": "Object.defineProperty call marker", "e": [ "Object.defineProperty" ], "i": "metadata/lang/javascript-features::object-define-property", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "new URL(`https://fid.agkn.com/f?${e}`).href" ], "i": "micro-behaviors/communications/http/url/path::browser-location-host-ref--rx-2", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "1cf5a6b53c1b0b126715ef584070b03c.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "a": "T1195.002", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "credential" ], "i": "objectives/supply-chain/impersonation/core-module::fs-write-sensitive--rx-3", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 3076.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1539", "c": 0.75, "d": "Reads browser cookies via document.cookie", "e": [ "document.cookie" ], "i": "micro-behaviors/communications/http/cookies::document-cookie-read", "l": 3, "m": "C0002" }, { "c": 0.8500000238418579, "d": "Trailing IIFE closure indicating auto-execution", "e": [ "})();" ], "i": "objectives/anti-static/obfuscation/eval/dynamic::export-iife-closure", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Many one-line source function definitions", "e": [ "functions.one_liners = 24.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-one-liner-functions", "l": 2, "m": "B0032" }, { "a": "T1071.001", "c": 0.7200000286102295, "d": "POST method field in request config", "e": [ "method:\"POST\"" ], "i": "micro-behaviors/communications/http/request/client::post-method-text", "l": 3, "m": "C0002" }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(t){}" ], "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors", "l": 1 }, { "a": "T1005", "c": 0.30000001192092896, "d": "JSON file extension", "e": [ ".json" ], "i": "objectives/collection/file-targeting/filter::json-extension", "l": 1, "m": "B0024" }, { "c": 0.75, "d": "Fetch request includes browser credentials", "e": [ "credentials:\"include\"" ], "i": "micro-behaviors/communications/http/headers::credentialed-fetch-include", "l": 3 }, { "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 2400.00" ], "i": "metadata/file/text/metrics::high-function-density", "l": 2 }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Authorization:" ], "i": "micro-behaviors/communications/http/headers::auth-header", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Many comma sequence expressions (obfuscation)", "e": [ "t.setTime(t.getTime()+24*i*60*60*1e3),n=\"expires=\"+t.toUTCString()", "\"undefined\"!=typeof Symbol\u0026\u0026Symbol.toStringTag\u0026\u0026Object.defineProperty(t,Symbol.toStringTag,{value:\"M...", "n\u0026\u0026n.ivid\u0026\u0026(i={...i,idsync:\"true\"}),i={...i,tu:\"true\"},f(i)", "t\u0026\u0026t.ivid\u0026\u0026(u(\"ivid\",t.ivid,365),o={...o,idsync:\"true\"},e\u0026\u0026\"function\"==typeof e\u0026\u0026e(t.ivid,c)),o={......", "t.r(e),t.d(e,{default:()=\u003em,initPixel:()=\u003eh});", "t\u0026\u0026t.ivid\u0026\u0026(u(\"ivid\",t.ivid,365),o={...o,idsync:\"true\"},e\u0026\u0026\"function\"==typeof e\u0026\u0026e(t.ivid,c)),f(o)" ], "i": "objectives/anti-static/obfuscation/syntax::js-comma-sequence-obfuscation-v2", "l": 2 }, { "a": "T1204.001", "c": 0.7799999713897705, "d": "Ajax message field", "e": [ "message:" ], "i": "objectives/execution/lure/clipboard::ajax-message-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Prototype guard keyword", "e": [ "prototype" ], "i": "micro-behaviors/data/source/prototype::js-proto-guard-prototype", "l": 2 }, { "c": 0.699999988079071, "d": "JavaScript file under 5KB", "e": [ "1cf5a6b53c1b0b126715ef584070b03c.js" ], "i": "metadata/file/text/metrics::javascript-small-file-5k", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(t){}" ], "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "l": 1, "m": "B0024" }, { "a": "T1071.001", "c": 0.699999988079071, "d": "fetch() call string reference", "e": [ "fetch" ], "i": "micro-behaviors/communications/http/request/client::fetch-string", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "d": "HTTP configuration fields (method/body/headers)", "e": [ "headers:", "body:" ], "i": "micro-behaviors/communications/http/request/client::http-config-fields", "l": 2 }, { "c": 0.8500000238418579, "d": "JavaScript transpiler or minifier markers", "e": [ "__esModule", "use strict" ], "i": "metadata/package/quality::terser-output", "l": 2 }, { "c": 0.800000011920929, "d": "HTTP/HTTPS client request capability", "e": [ "fetch(t,{headers:new Headers({Authorization:\"Intuit_APIKey intuit_apikey=prdakyresCsoIkuSFJwHp4n9bXl...", "method:\"POST\"", "fetch", "fetch(t,{credentials:\"include\"})", "body:", "headers:" ], "i": "micro-behaviors/crypto/symmetric/aes/library::http-client-comp", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "text.whitespace_ratio = 0.02", "functions.density_per_100_lines = 2400.00", "functions.one_liners = 24.00", "identifiers.sequential_names = 25.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" } ], "sha": "9f7b79fa4650c64b7ff66e9040b1f325b38653a628a29926cc53e55ef479ad0d", "path": "1cf5a6b53c1b0b126715ef584070b03c.js", "type": "javascript" } ], "tv": "9ea7c" } }