{
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.3",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000023335218,
        "rte": "az",
        "prob": 0.000023335218
      },
      {
        "cls": 0,
        "raw": 0.00003818671,
        "rte": "az/scripts",
        "prob": 0.00003818671
      },
      {
        "cls": 0,
        "raw": 0.34409577,
        "rte": "az/powershell",
        "prob": 0.34409577
      }
    ],
    "prob": 0.000023335218,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00002333521842956543,
        "type": "powershell"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-10-07T04:20:43Z"
  },
  "path": "a32d8b48ca40070329ce374a915af35e30ab2027cdfcb0448157b1175157db82.unknown",
  "raw": {
    "v": "8",
    "rev": "c1ea9",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "bY\u003e.6cT]I0fFB\u003ebA+fiavpJ\u003c%cT[COcRkWme]\u003eJxy***+c){-6fEFz0CQB}4B75(cp-}39fGQK)w\u003c4K@fFLmnf!+pjfFLmnfFLmoehe!kf!+pofF1[jf!\u003evof!+djf!\u003evpf!\u003eylfFLppfFCjnehe!jfFCgmf!t1kf!+pnf!\u003ejkf!\u003eypf!+pjfFLpof!+poehe!kfFLppf!t1kf!+spf!+djf!+sofFCgifFLppfFCjnehe!kfFCjnf!t1kf!+pof!+djf!\u003evof!+skfFLppfFCjnehe!kfFCjnf!t1kf!+spf!+djf!\u003evofFLpkfFLpofFLmoehe+jfFCgmfF1[if!\u003eyqfFLajfFLmnfFCgifFCjnfFLppehe!jf!+pof!t1kf!+sofFLajf!\u003evpf!+pjfFLpofFLmoehe!kfFLppfF1[jf!\u003evpfFC4if!\u003evpf!+pjfFLppf!+poehe!jfFCgnf!t1kf!+spf!\u003ejkf!\u003evpf!\u003evkfFLppfFLmnehe!kfFLmnf!t1kf!+spf!+djf!\u003eypf!+skfFLpofFLmoehe+jfFCjof!t1jf!\u003eypf!\u003ejkfFLmnf!+pjfFLppfFLmnehe+jf!+sof!t1jf!\u003evpf!+djf!\u003evof!\u003evkfFLpofFLppehe+jfFCgmfF1[if!\u003eyqfFLajfFLmnfFCgifFLmof!+spehe!jfFCjnf!t1kf!+spf!+djf!\u003eypf!+skfFLpof!\u003evpehe!jf!\u003eypf!t1jf!\u003eypf!+djfFLppfFLmjfFLmofFLmnehe!kfFLppf!t1kfFCjof!\u003ejk",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "fFCjof!t1jf!+pof!\u003ejkfFLmofFCjjfFLppf!\u003evoehe!jf!+pnfEXb(ashvStt]/*By/qwraQq@e\u003e6U/z!9N1xi^LVrA8BEe\u003eoF{q/)4]zF7w4q*ACawO\u003c4!z/f-fA=+OFi-H2?zGEV\u0026c)SdJgasT{Ele\u0026YB9R?GwO\u003c4#BAh8kxi^LVn]FAYc){w[as7PidjGTv4gi",
            "ln": 4638,
            "col": 4639,
            "line": 1
          }
        ],
        "mol": "O(As)Md",
        "sha": "a32d8b48ca40070329ce374a915af35e30ab2027cdfcb0448157b1175157db82",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-07/a32d8b48ca40070329ce374a915af35e30ab2027cdfcb0448157b1175157db82.unknown",
        "risk": 2,
        "size": 4796,
        "type": "powershell",
        "facts": {
          "imp": [
            [
              "",
              "sal"
            ]
          ],
          "tgt": [
            "%",
            "P",
            "sal"
          ],
          "metrics": {
            "ast": {
              "max_depth": 48,
              "call_count": 3,
              "node_count": 2362,
              "max_array_length": 513
            },
            "file": {
              "size": 4796,
              "entropy": 1.75
            },
            "text": {
              "lines": 1,
              "top_char": 48,
              "digit_ratio": 0.98,
              "space_count": 7,
              "char_entropy": 1.75,
              "unique_chars": 53,
              "top_char_null": 0,
              "lines_over_200": 1,
              "lines_over_500": 1,
              "string_density": 6,
              "top_char_ratio": 0.43,
              "avg_line_length": 4794,
              "lines_over_1000": 1,
              "max_line_length": 4794,
              "last_line_length": 4794,
              "long_token_count": 1,
              "whitespace_ratio": 0,
              "identifier_density": 15,
              "max_whitespace_run": 1,
              "normalized_string_count": 6,
              "suspicious_identifier_ratio": 0.09
            },
            "binary": {
              "peak_region_bytes": 700,
              "peak_region_entropy": 2.65
            },
            "strings": {
              "bytes": 11,
              "count": 6,
              "avg_length": 1.83,
              "max_length": 5,
              "avg_entropy": 0.57,
              "empty_count": 1,
              "entropy_stddev": 0.76
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.script_as_unknown": 1
            },
            "identifiers": {
              "count": 15,
              "unique": 11,
              "avg_length": 4,
              "max_length": 9,
              "min_length": 1,
              "avg_entropy": 1.64,
              "reuse_ratio": 0.73,
              "length_stddev": 2.49,
              "has_digit_ratio": 0.27,
              "sequential_names": 1,
              "single_char_count": 2,
              "single_char_ratio": 0.18,
              "all_lowercase_ratio": 0.18,
              "all_uppercase_ratio": 0.09,
              "numeric_suffix_count": 3
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/line::powershell-long-line",
            "conf": 0.85,
            "crit": 3,
            "desc": "PowerShell contains a line over 1000 characters",
            "spans": [
              [
                0,
                4794
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Last line is over 1000 chars"
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Exactly one line exceeds 1000 chars"
          }
        ]
      }
    ]
  }
}