{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9995030164718628,
        "class": 1
      }
    ],
    "prob": 0.999503,
    "class": 1,
    "oprob": 0.9876543,
    "models": [
      {
        "m": "az",
        "prob": 0.9067564,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.69911504,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 0.9876543,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T21:44:54Z"
  },
  "path": "0aacca70eefd3c6e0a6ca65ee9e7ba30.js",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As)H(Cm)Md",
        "x": 39,
        "ff": {
          "i": [
            [
              "",
              "conditionalSignInParams"
            ],
            [
              "",
              "BingAtWork.ConditionalSignIn.bindToConditionalSignIn"
            ],
            [
              "",
              "config"
            ],
            [
              "",
              "sj_evt.fire"
            ],
            [
              "",
              "identityBtn"
            ],
            [
              "",
              "document.getElementById"
            ],
            [
              "",
              "identityBtn.addEventListener"
            ],
            [
              "",
              "sj_log"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 17.0,
              "bind_count": 3.0,
              "call_count": 8.0,
              "node_count": 241.0,
              "target_count": 5.0,
              "member_depth_max": 3.0,
              "string_literal_count": 14.0
            },
            "file": {
              "size": 1211.0,
              "entropy": 5.42,
              "size_bytes": 1211.0
            },
            "text": {
              "digit_ratio": 0.19,
              "space_count": 40.0,
              "total_lines": 3.0,
              "char_entropy": 5.42,
              "unique_chars": 71.0,
              "lines_over_200": 1.0,
              "lines_over_500": 1.0,
              "string_density": 4.67,
              "avg_line_length": 402.33,
              "lines_over_1000": 1.0,
              "max_line_length": 1191.0,
              "last_line_length": 5.0,
              "long_token_count": 1.0,
              "whitespace_ratio": 0.04,
              "most_common_ratio": 0.07,
              "identifier_density": 7.0,
              "line_length_stddev": 557.68,
              "encoded_string_ratio": 0.07,
              "normalized_string_count": 8.08,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 110.0,
              "normalized_unique_identifiers": 7.57
            },
            "strings": {
              "total": 14.0,
              "avg_length": 51.14,
              "max_length": 540.0,
              "avg_entropy": 2.63,
              "total_bytes": 716.0,
              "entropy_stddev": 1.17,
              "url_encoded_strings": 1.0
            },
            "comments": {
              "chars": 13.0,
              "lines": 2.0,
              "total": 2.0,
              "to_code_ratio": 2.0
            },
            "functions": {
              "anonymous": 4.0,
              "one_liners": 4.0,
              "no_params_count": 4.0,
              "avg_length_lines": 1.0,
              "max_length_lines": 1.0,
              "min_length_lines": 1.0,
              "nested_functions": 1.0,
              "avg_nesting_depth": 0.25,
              "max_nesting_depth": 1.0,
              "density_per_100_lines": 133.33,
              "code_in_functions_ratio": 1.33
            },
            "identifiers": {
              "total": 21.0,
              "avg_length": 12.0,
              "max_length": 23.0,
              "min_length": 4.0,
              "avg_entropy": 2.97,
              "reuse_ratio": 0.57,
              "unique_count": 12.0,
              "length_stddev": 6.32,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.08,
              "all_lowercase_ratio": 0.42
            }
          },
          "s": [
            [
              57,
              "u8",
              "notifEnabled"
            ],
            [
              58,
              "u8",
              "notifEnabled"
            ],
            [
              78,
              "u8",
              "notifFetchAsync"
            ],
            [
              79,
              "u8",
              "notifFetchAsync"
            ],
            [
              304,
              "u8",
              "url"
            ],
            [
              305,
              "u8",
              "url"
            ],
            [
              310,
              "u8",
              "https%3a%2f%2flogin.microsoftonline.com%2fcommon%2foauth2%2fauthorize%3fclient_id%3d9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7%26respo"
            ],
            [
              311,
              "u8",
              "https%3a%2f%2flogin.microsoftonline.com%2fcommon%2foauth2%2fauthorize%3fclient_id%3d9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7%26respo"
            ],
            [
              853,
              "u8",
              "sandbox"
            ],
            [
              854,
              "u8",
              "sandbox"
            ],
            [
              863,
              "u8",
              "allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts"
            ],
            [
              864,
              "u8",
              "allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts"
            ],
            [
              941,
              "u8",
              "currentEpoch"
            ],
            [
              942,
              "u8",
              "currentEpoch"
            ],
            [
              956,
              "u8",
              "1740662420000"
            ],
            [
              957,
              "u8",
              "1740662420000"
            ],
            [
              986,
              "u8",
              "ssoFrameExists"
            ],
            [
              987,
              "u8",
              "ssoFrameExists"
            ],
            [
              1076,
              "u8",
              "id_l"
            ],
            [
              1077,
              "u8",
              "id_l"
            ],
            [
              1133,
              "u8",
              "click"
            ],
            [
              1134,
              "u8",
              "click"
            ],
            [
              1163,
              "u8",
              "CI.ICPopup"
            ],
            [
              1164,
              "u8",
              "CI.ICPopup"
            ],
            [
              1177,
              "u8",
              "popup"
            ],
            [
              1178,
              "u8",
              "popup"
            ],
            [
              1186,
              "u8",
              "1"
            ],
            [
              1187,
              "u8",
              "1"
            ],
            [
              13,
              "url",
              "(function() { var conditionalSignInParams ={\"notifEnabled\":false,\"notifFetchAsync\":false}; BingAtWork.ConditionalSignIn \u0026\u0026 BingA"
            ]
          ],
          "v": {
            "source.language": "javascript",
            "source.imports[0]": "BingAtWork.ConditionalSignIn.bindToConditionalSignIn",
            "source.imports[1]": "conditionalSignInParams",
            "source.imports[2]": "config",
            "source.imports[3]": "document.getElementById",
            "source.imports[4]": "identityBtn",
            "source.imports[5]": "identityBtn.addEventListener",
            "source.imports[6]": "sj_evt.fire",
            "source.imports[7]": "sj_log",
            "source.strings[0]": "(function() { var conditionalSignInParams ={\"notifEnabled\":false,\"notifFetchAsync\":false}; BingAtWork.ConditionalSignIn \u0026\u0026 BingAtWork.ConditionalSignIn.bindToConditionalSignIn \u0026\u0026 BingAtWork.ConditionalSignIn.bindToConditionalSignIn(conditionalSignInParams); })();;(function() { var config ={\"url\":\"https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7\u0026response_type=id_token+code\u0026nonce=e05ab609-6dcc-475d-876c-c938ef47dd0d\u0026redirect_uri=https%3a%2f%2fcn.bing.com%2forgid%2fidtoken%2fconditional\u0026scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default\u0026response_mode=form_post\u0026instance_aware=true\u0026msafed=0\u0026prompt=none\u0026state=%7b%22ig%22%3a%224E0979295D6B440EA1F100197B2728E1%22%7d\",\"sandbox\":\"allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts\",\"currentEpoch\":\"1740662420000\"}; sj_evt.fire('ssoFrameExists', config); })();;(function () { var identityBtn = document.getElementById(\"id_l\"); if (identityBtn) { identityBtn.addEventListener(\"click\", function () { sj_log(\"CI.ICPopup\", \"popup\", \"1\"); }); } })();;",
            "source.strings[1]": "1740662420000",
            "source.strings[2]": "CI.ICPopup",
            "source.strings[3]": "allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts",
            "source.strings[4]": "currentEpoch",
            "source.strings[5]": "https%3a%2f%2flogin.microsoftonline.com%2fcommon%2foauth2%2fauthorize%3fclient_id%3d9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7%26response_type%3did_token%2bcode%26nonce%3de05ab609-6dcc-475d-876c-c938ef47dd0d%26redirect_uri%3dhttps%253a%252f%252fcn.bing.com%252forgid%252fidtoken%252fconditional%26scope%3dopenid%2520email%2520profile%25209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7%2f.default%26response_mode%3dform_post%26instance_aware%3dtrue%26msafed%3d0%26prompt%3dnone%26state%3d%257b%2522ig%2522%253a%25224E0979295D6B440EA1F100197B2728E1%2522%257d",
            "source.strings[6]": "notifEnabled",
            "source.strings[7]": "notifFetchAsync",
            "source.strings[8]": "sandbox",
            "source.strings[9]": "ssoFrameExists",
            "source.has_imports": true,
            "source.functions[0]": "anonymous"
          },
          "ca": [
            [
              "document.getElementById",
              "id_l"
            ],
            [
              "identityBtn.addEventListener",
              "click"
            ],
            [
              "sj_evt.fire",
              "ssoFrameExists"
            ],
            [
              "sj_log",
              "1"
            ],
            [
              "sj_log",
              "CI.ICPopup"
            ],
            [
              "sj_log",
              "popup"
            ]
          ],
          "ct": [
            "BingAtWork.ConditionalSignIn.bindToConditionalSignIn",
            "document.getElementById",
            "identityBtn.addEventListener",
            "sj_evt.fire",
            "sj_log"
          ],
          "id": "javascript",
          "mc": [
            "BingAtWork.ConditionalSignIn",
            "BingAtWork.ConditionalSignIn.bindToConditionalSignIn",
            "document.getElementById",
            "identityBtn.addEventListener",
            "sj_evt.fire"
          ]
        },
        "id": 0,
        "sz": 1211,
        "ts": [
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Comment-heavy source context",
            "e": [
              "comments.to_code_ratio = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::comment-heavy-source",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.001",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "allow"
            ],
            "i": "objectives/execution/lure/video-meeting::meeting-device-permission-lure--rx-6",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Microsoft login domain marker",
            "e": [
              "login.microsoftonline.com"
            ],
            "i": "micro-behaviors/communications/http/oauth::microsoft-login",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Short sidecar-sized source",
            "e": [
              "text.total_lines = 3.00"
            ],
            "i": "metadata/package/config::short-sidecar-file",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 3.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny JavaScript file lines",
            "e": [
              "text.total_lines = 3.00"
            ],
            "i": "metadata/file/text/metrics::tiny-javascript-file-lines",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "0aacca70eefd3c6e0a6ca65ee9e7ba30.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Comment-heavy base64 context",
            "e": [
              "comments.to_code_ratio = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-comment-heavy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6499999761581421,
            "d": "OAuth client_id field",
            "e": [
              "client_id"
            ],
            "i": "micro-behaviors/communications/http/oauth::oauth-client-id-field",
            "l": 1
          },
          {
            "a": "T1056",
            "c": 0.8999999761581421,
            "d": "document.getElement*/querySelector* DOM lookup",
            "e": [
              "document.getElement"
            ],
            "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5",
            "l": 1
          },
          {
            "a": "T1528",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "auth"
            ],
            "i": "objectives/credential-access/cloud/token::google-gmail-full-scope--rx-6",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "0aacca70eefd3c6e0a6ca65ee9e7ba30.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 1191.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Encoded URL decoded to https",
            "e": [
              "(function() { var conditionalSignInParams ={\"notifEnabled\":false,\"notifFetchAsync\":false}; BingAtWor..."
            ],
            "i": "micro-behaviors/communications/url/encoded::encoded-https-url",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High function density",
            "e": [
              "functions.density_per_100_lines = 133.33"
            ],
            "i": "metadata/file/text/metrics::high-function-density",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Encoded URL decoded to http(s)",
            "e": [
              "(function() { var conditionalSignInParams ={\"notifEnabled\":false,\"notifFetchAsync\":false}; BingAtWor..."
            ],
            "i": "micro-behaviors/communications/url/encoded::encoded-http-url",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1071.001",
            "c": 0.75,
            "d": "Encoded HTTP URL",
            "e": [
              "(function() { var conditionalSignInParams ={\"notifEnabled\":false,\"notifFetchAsync\":false}; BingAtWor..."
            ],
            "i": "objectives/anti-static/obfuscation/encoding/content::encoded-http-url",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "0aacca70eefd3c6e0a6ca65ee9e7ba30.js"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: url",
            "e": [
              "(function() { var conditionalSignInParam \u003curl\u003e"
            ],
            "i": "metadata/encoded-payload/url",
            "l": 3
          }
        ],
        "sha": "a8db4b2ada859c1be85e7045feb4c9765c215a6fd2bcec6f40649177b2ef32f1",
        "path": "0aacca70eefd3c6e0a6ca65ee9e7ba30.js",
        "type": "javascript"
      }
    ],
    "tv": "9ea7c"
  }
}