{
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000023752451,
        "rte": "az",
        "prob": 0.000023752451
      },
      {
        "cls": 0,
        "raw": 0.000118374825,
        "rte": "az/scripts",
        "prob": 0.000118374825
      },
      {
        "cls": 0,
        "raw": 0.0003994604,
        "rte": "az/batch",
        "prob": 0.0003994604
      }
    ],
    "prob": 0.000023752451,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000023752450942993164,
        "type": "batch"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-26T20:11:44Z"
  },
  "path": "Trojan.BAT.RepairKill",
  "raw": {
    "v": "8",
    "rev": "c1ea9",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "wmYN1lPOENnLRVHs5SvAwPh6(A:i3}Bz\u003e-nwN^ugBrC\u0026r3s)Z:avwg{s4MdPpGHF1A+fh#x(WD*z/ff3xd!7zaBaz6wmYN1lPOENnLRVHs5SvAwPh6(A:ic^w)]*#BsFzU4glSSy-(8atVTG(l@c(.tYKy{vqf:!zGH2xwD",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "mol": "H(F)Md",
        "sha": "a3b1d6f5ad0f11eda0260d9c98bccd47057593ad5548a45c4df81be2e30c2ca0",
        "path": "Trojan.BAT.RepairKill",
        "risk": 2,
        "size": 347,
        "type": "batch",
        "facts": {
          "imp": [
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ],
            [
              "",
              "del"
            ]
          ],
          "tgt": [
            "del"
          ],
          "metrics": {
            "ast": {
              "max_depth": 3,
              "call_count": 10,
              "node_count": 51
            },
            "file": {
              "size": 347,
              "entropy": 4.72
            },
            "text": {
              "lines": 10,
              "top_char": 101,
              "max_ws_run": 1,
              "space_count": 20,
              "char_entropy": 4.72,
              "unique_chars": 33,
              "top_char_null": 0,
              "top_char_ratio": 0.09,
              "avg_line_length": 32.7,
              "max_line_length": 36,
              "last_line_length": 31,
              "whitespace_ratio": 0.12,
              "identifier_density": 1,
              "line_length_stddev": 2.1,
              "normalized_unique_identifiers": 0.3
            },
            "binary": {
              "peak_region_bytes": 347,
              "peak_region_entropy": 4.72
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.script_as_unknown": 1
            },
            "identifiers": {
              "count": 10,
              "unique": 1,
              "avg_length": 3,
              "max_length": 3,
              "min_length": 3,
              "avg_entropy": 1.58,
              "reuse_ratio": 0.1,
              "all_lowercase_ratio": 1
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/extension/mismatch::batch-content-extension-mismatch",
            "conf": 0.9,
            "crit": 3,
            "desc": "Batch content mismatches filename extension"
          },
          {
            "id": "micro-behaviors/fs/delete/file/command::batch-del-call",
            "conf": 0.85,
            "crit": 3,
            "desc": "Batch invokes the del command",
            "spans": [
              [
                0,
                3
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/file/command::del-command",
            "conf": 0.7,
            "crit": 3,
            "desc": "Windows del command deletes files",
            "spans": [
              [
                0,
                5
              ]
            ]
          }
        ]
      }
    ]
  }
}