{
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000041514635,
        "rte": "az",
        "prob": 0.000041514635
      },
      {
        "cls": 0,
        "raw": 0.00003582239,
        "rte": "az/scripts",
        "prob": 0.00003582239
      },
      {
        "cls": 0,
        "raw": 0.00033478937,
        "rte": "az/batch",
        "prob": 0.00033478937
      }
    ],
    "prob": 0.000041514635,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00004151463508605957,
        "type": "batch"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-27T11:52:04Z"
  },
  "path": "Trojan.BAT.Reboot.b",
  "raw": {
    "v": "8",
    "rev": "c1ea9",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "mmfQwav!N:mN/\u003cdfD+-=lPOENnLRVHs5Su\u003epFBLHpdetPmm70Ae\u003e5(hau\u0026L2oD\u003eO*3i",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "mol": "H(F)Md",
        "sha": "a3439a4c6d8cc52e2218560a47b5d8c6249a7751799695b7a3294b6d6532f25d",
        "path": "Trojan.BAT.Reboot.b",
        "risk": 2,
        "size": 53,
        "type": "batch",
        "facts": {
          "imp": [
            [
              "",
              "ECHO"
            ]
          ],
          "tgt": [
            "C",
            "ECHO"
          ],
          "metrics": {
            "ast": {
              "max_depth": 5,
              "call_count": 2,
              "node_count": 15
            },
            "file": {
              "size": 53,
              "entropy": 4.57
            },
            "text": {
              "lines": 1,
              "top_char": 70,
              "max_ws_run": 1,
              "digit_ratio": 0.03,
              "space_count": 5,
              "char_entropy": 4.57,
              "unique_chars": 28,
              "top_char_null": 0,
              "top_char_ratio": 0.08,
              "avg_line_length": 51,
              "max_line_length": 51,
              "last_line_length": 51,
              "whitespace_ratio": 0.13,
              "identifier_density": 2,
              "trailing_whitespace_lines": 1,
              "suspicious_identifier_ratio": 0.5
            },
            "binary": {
              "peak_region_bytes": 53,
              "peak_region_entropy": 4.57
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.script_as_unknown": 1
            },
            "identifiers": {
              "count": 2,
              "unique": 2,
              "avg_length": 2.5,
              "max_length": 4,
              "min_length": 1,
              "avg_entropy": 1,
              "reuse_ratio": 1,
              "length_stddev": 1.5,
              "sequential_names": 1,
              "single_char_count": 1,
              "single_char_ratio": 0.5,
              "all_uppercase_ratio": 1
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/extension/mismatch::batch-content-extension-mismatch",
            "conf": 0.9,
            "crit": 3,
            "desc": "Batch content mismatches filename extension"
          },
          {
            "id": "micro-behaviors/fs/write/file/redirect::batch-echo-redirect",
            "conf": 0.94,
            "crit": 3,
            "desc": "Batch ECHO redirects content to file",
            "spans": [
              [
                0,
                46
              ]
            ]
          }
        ]
      }
    ]
  }
}