{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.8505155, "class": 0 }, { "m": "az/scripts", "prob": 0.94210523, "class": 0 }, { "m": "az/batch", "prob": 1.0, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-15T20:02:35Z" }, "path": "af2150ebafd8f655bc625da183bfa64597a6e16456f3be68b47830e418fdf2ac.bat", "raw": { "v": "4", "fs": [ { "f": "O(As)H(Cm)Md", "x": 40, "id": 0, "ms": { "file": { "size": 295266.0 }, "text": { "tab_count": 28.0, "digit_ratio": 0.15, "space_count": 598.0, "total_lines": 528.0, "char_entropy": 6.08, "unique_chars": 92.0, "escape_density": 0.0, "lines_over_200": 4.0, "lines_over_500": 3.0, "avg_line_length": 557.22, "lines_over_1000": 2.0, "max_line_length": 266480.0, "last_line_length": 24.0, "long_token_count": 5.0, "most_common_char": "a", "whitespace_ratio": 0.01, "most_common_ratio": 0.02, "line_length_stddev": 11586.38, "octal_escape_count": 1.0, "max_inline_whitespace_run": 2.0 } }, "ss": [ [ 11, "%VEwFYsCIbQOERThnepcG%s%VEwFYsCIbQOERThnepcG%e%VEwFYsCIbQOERThnepcG%t%VEwFYsCIbQOERThnepcG%l%VEwFYsCIbQOERThnepcG%o%VEwFYsCIbQOE" ], [ 748, "set \"AkDbxJjZCHOGgVyWcEIG=s\"" ], [ 778, "set \"rnfoZQMkVdsPMoblBfVy=t\"" ], [ 808, "set \"SDbvPagrlvNCEaXbUJxi=!AkDbxJjZCHOGgVyWcEIG!e!rnfoZQMkVdsPMoblBfVy!\"" ], [ 882, "!SDbvPagrlvNCEaXbUJxi! \"SdawGSCwEV= \u003e n\"" ], [ 2130, "!SDbvPagrlvNCEaXbUJxi! \"qjjlHEIDbC= /b \"" ], [ 2298, "!SDbvPagrlvNCEaXbUJxi! \"mKqppCzcss=cd /\"" ], [ 2505, "!SDbvPagrlvNCEaXbUJxi! \"SSNflCuTdR=st '%cd%\"" ], [ 2593, "%XYezoZURUm%%vXIkLMQAqG%%neiepOXShO%%hmcpBWAXqY%%yLOPvQVHiv%%wEYwsSQZkz%%ccKffjUtJO%%lSkrhCptJy%%TpKLrCnGWI%%gBNRWwbIKm%%VBYtjEu" ], [ 2979, "%mKqppCzcss%%EnEtgwsdou%" ], [ 3299, "!SDbvPagrlvNCEaXbUJxi! \"IOGZANbHJT=aes_\"" ], [ 3383, "!SDbvPagrlvNCEaXbUJxi! \"pFxTBwrrlJ=var.\"" ], [ 3550, "!SDbvPagrlvNCEaXbUJxi! \"WWjUpoUFeD=y.Pa\"" ], [ 4432, "!SDbvPagrlvNCEaXbUJxi! \"FBrSElxkrd=si.D\"" ], [ 4852, "!SDbvPagrlvNCEaXbUJxi! \"SVOqybeotx=To($\"" ], [ 5062, "!SDbvPagrlvNCEaXbUJxi! \"JSeNafWjDB=var.\"" ], [ 5230, "!SDbvPagrlvNCEaXbUJxi! \"IEGuwvsrbb=.Ent\"" ], [ 5440, "!SDbvPagrlvNCEaXbUJxi! \"kDIERGFTjw=am(,\"" ], [ 5776, "!SDbvPagrlvNCEaXbUJxi! \"ECdSkBzHHO=t.UI\"" ], [ 6115, "!SDbvPagrlvNCEaXbUJxi! \"JFRJTySKiG=.Raw\"" ], [ 6451, "!SDbvPagrlvNCEaXbUJxi! \"YUthvmthYY=retu\"" ], [ 6535, "!SDbvPagrlvNCEaXbUJxi! \"lFFSvREHZc=m.Re\"" ], [ 6829, "!SDbvPagrlvNCEaXbUJxi! \"geXyWFrfBG=[-1.\"" ], [ 6997, "!SDbvPagrlvNCEaXbUJxi! \"KRgpfhKZsc=tem.\"" ], [ 7333, "!SDbvPagrlvNCEaXbUJxi! \"RHEMjJISAe=..-1\"" ], [ 7375, "!SDbvPagrlvNCEaXbUJxi! \"xpxrAVKcMb=em.I\"" ], [ 7417, "!SDbvPagrlvNCEaXbUJxi! \"STghapYTXK=(,[s\"" ], [ 7585, "!SDbvPagrlvNCEaXbUJxi! \"scPEJVPEWT=ose(\"" ], [ 7669, "!SDbvPagrlvNCEaXbUJxi! \"byUnGvbtfs=O.Me\"" ], [ 8005, "!SDbvPagrlvNCEaXbUJxi! \"TMIwVJgQos=mM.D\"" ], [ 8215, "!SDbvPagrlvNCEaXbUJxi! \"EtgypvOzJB=('\\'\"" ], [ 8467, "!SDbvPagrlvNCEaXbUJxi! \"zuvKDZWApb=tion\"" ], [ 8635, "!SDbvPagrlvNCEaXbUJxi! \"DDOEOTdfGu=m.Co\"" ], [ 8845, "!SDbvPagrlvNCEaXbUJxi! \"AqVpDDJpjC=UI.W\"" ], [ 8971, "!SDbvPagrlvNCEaXbUJxi! \"ZhstUTcpeo=ity.\"" ], [ 9013, "!SDbvPagrlvNCEaXbUJxi! \"TFfeeLFGHd=AAz.\"" ], [ 9139, "!SDbvPagrlvNCEaXbUJxi! \"tBkoizypUo=var.\"" ], [ 9349, "!SDbvPagrlvNCEaXbUJxi! \"MNPJJdxIBQ=();}\"" ], [ 9643, "!SDbvPagrlvNCEaXbUJxi! \"GShIUTHGsy=.-16\"" ], [ 9727, "!SDbvPagrlvNCEaXbUJxi! \"JfqCZYqLAp=var.\"" ], [ 9769, "!SDbvPagrlvNCEaXbUJxi! \"JcnfZEWAbj=sbY.\"" ], [ 9853, "!SDbvPagrlvNCEaXbUJxi! \"DAUZaeccJr=::('\"" ], [ 10147, "!SDbvPagrlvNCEaXbUJxi! \"eTSUQIHLuA=).Sp\"" ], [ 10441, "!SDbvPagrlvNCEaXbUJxi! \"UdWJaXbcUh=ZmM.\"" ], [ 10861, "!SDbvPagrlvNCEaXbUJxi! \"kripWpWDKF=em.S\"" ], [ 11155, "!SDbvPagrlvNCEaXbUJxi! \"euKmnMcuWX=on.G\"" ], [ 11239, "!SDbvPagrlvNCEaXbUJxi! \"BuBlavHljO=ar.I\"" ], [ 11365, "!SDbvPagrlvNCEaXbUJxi! \"QTLLJDSkvv=ormF\"" ], [ 11407, "!SDbvPagrlvNCEaXbUJxi! \"xpUGRHHefi=j/33\"" ], [ 12037, "!SDbvPagrlvNCEaXbUJxi! \"AHCLWEhijW=tion\"" ], [ 12163, "!SDbvPagrlvNCEaXbUJxi! \"aDMRAeFbau=::('\"" ], [ 12583, "!SDbvPagrlvNCEaXbUJxi! \"TaQqAjaCeH=-1..\"" ], [ 12835, "!SDbvPagrlvNCEaXbUJxi! \"iahHrIGhhv=)));\"" ], [ 13423, "!SDbvPagrlvNCEaXbUJxi! \"vMLuNghBFE=..-1\"" ], [ 13465, "!SDbvPagrlvNCEaXbUJxi! \"ZiLSLZMzqU=.-11\"" ], [ 13507, "!SDbvPagrlvNCEaXbUJxi! \"EBERAsvqPB=cute\"" ], [ 13801, "!SDbvPagrlvNCEaXbUJxi! \"ojZqBFjiwB=-1..\"" ], [ 13843, ":: xkIEcPfTqBydGYqdTDmrY49T61MpPvBZ/rJVRsNzcVEkMRIXrNe5Xv6aprCDQyfnhDtAM8VzniwQ5YsOFJi+dzlP43QxsYsqVeVPqYYLjMOxAqlqjUTnADlUSnbkh" ], [ 149171, "xor", "://-z8s250" ], [ 199960, "xor", "cnKvM}S1p832J_l{$Za`rwQ/yrnXi*WFVGNPWD^N_|b" ], [ 203032, "xor", "zuQMGLMVdOg9hHaJDY" ], [ 280325, "!SDbvPagrlvNCEaXbUJxi! \"KDrlknRMMV=se()\"" ], [ 280535, "!SDbvPagrlvNCEaXbUJxi! \"mHzvWkxUsu=.Aes\"" ], [ 280661, "!SDbvPagrlvNCEaXbUJxi! \"fqyTVIGKjU=var.\"" ], [ 280871, "!SDbvPagrlvNCEaXbUJxi! \"LUxFkiVrBS=IO.C\"" ], [ 281291, "!SDbvPagrlvNCEaXbUJxi! \"aNKRRKKXUz=_fun\"" ], [ 281753, "!SDbvPagrlvNCEaXbUJxi! \"vYlpiamoba=aphy\"" ], [ 282131, "!SDbvPagrlvNCEaXbUJxi! \"PtkrhAvkhz=h/rS\"" ], [ 282341, "!SDbvPagrlvNCEaXbUJxi! \"RzhtJtKwOq=.Mem\"" ], [ 282383, "!SDbvPagrlvNCEaXbUJxi! \"pkugvsrEIK=decr\"" ], [ 282551, "!SDbvPagrlvNCEaXbUJxi! \"ehZNphRxWk=.Cry\"" ], [ 282593, "!SDbvPagrlvNCEaXbUJxi! \"EPZngpvAIx=[-1.\"" ], [ 283097, "!SDbvPagrlvNCEaXbUJxi! \"LFlkLXJRJJ=ispo\"" ], [ 283559, "!SDbvPagrlvNCEaXbUJxi! \"wrcDMnlccm=em.S\"" ], [ 283601, "!SDbvPagrlvNCEaXbUJxi! \"psuAXHNFCu=tem.\"" ], [ 283727, "!SDbvPagrlvNCEaXbUJxi! \"WtJwiYMspj=r.Tr\"" ], [ 283811, "!SDbvPagrlvNCEaXbUJxi! \"CwfOCLCZum=ity.\"" ], [ 283895, "!SDbvPagrlvNCEaXbUJxi! \"eVXZTbyeFA=::('\"" ], [ 283979, "!SDbvPagrlvNCEaXbUJxi! \"gRbJfMTzch=tem.\"" ], [ 284231, "!SDbvPagrlvNCEaXbUJxi! \"bjvYkBUfzk=QL.S\"" ], [ 284567, "!SDbvPagrlvNCEaXbUJxi! \"qgXnycuItx=m.IO\"" ], [ 284651, "!SDbvPagrlvNCEaXbUJxi! \"LmHQmSSfFF=.Cip\"" ], [ 285113, "!SDbvPagrlvNCEaXbUJxi! \"UlyuPxsYQy=.Ass\"" ], [ 285323, "!SDbvPagrlvNCEaXbUJxi! \"KvoTPSEclR=var.\"" ], [ 285617, "!SDbvPagrlvNCEaXbUJxi! \"zxzVhCbdGj=.Dis\"" ], [ 285659, "!SDbvPagrlvNCEaXbUJxi! \"QIBBWuYyHg=sbY.\"" ], [ 285913, "!SDbvPagrlvNCEaXbUJxi! \"anrsskogEN=cute\"" ], [ 286417, "!SDbvPagrlvNCEaXbUJxi! \"uVBDLHRIFu=IO.F\"" ], [ 286459, "!SDbvPagrlvNCEaXbUJxi! \"OuGIREnvPR=tem.\"" ], [ 286753, "!SDbvPagrlvNCEaXbUJxi! \"sghBhIqTVo=r.Mo\"" ], [ 287005, "!SDbvPagrlvNCEaXbUJxi! \"miskaLNOGh=wegs\"" ], [ 287047, "!SDbvPagrlvNCEaXbUJxi! \"pPZQbbjfIr=.ToA\"" ], [ 287131, "!SDbvPagrlvNCEaXbUJxi! \"rDqfQQvALu=n.Co\"" ], [ 287467, "!SDbvPagrlvNCEaXbUJxi! \"RIzlmbTQBG=O.Co\"" ], [ 288603, "!SDbvPagrlvNCEaXbUJxi! \"wNnXCPrXbf=\"%systemdrive%\"" ], [ 288697, "!SDbvPagrlvNCEaXbUJxi! \"XAYHBdOxJK=2\\Wi\"" ], [ 288739, "!SDbvPagrlvNCEaXbUJxi! \"fgEUSdiDCg=ell.\"" ], [ 288781, "!SDbvPagrlvNCEaXbUJxi! \"hKskZtHxdm=\\Sys\"" ], [ 288907, "!SDbvPagrlvNCEaXbUJxi! \"xzpEJejdxr=\\pow\"" ], [ 288949, "!SDbvPagrlvNCEaXbUJxi! \"FkNsjxlzLn=ell\\\"" ], [ 289156, "!SDbvPagrlvNCEaXbUJxi! \"mXQRkJCRoj=v1.0\"" ], [ 289198, "!SDbvPagrlvNCEaXbUJxi! \"encWTQKctv=\\Win\"" ], [ 289240, "%wNnXCPrXbf%%encWTQKctv%%utZPnRMMgN%%hKskZtHxdm%%ccNJHhQOqt%%XAYHBdOxJK%%cFRoYuUSXz%%jnYhsrFpif%%aYvNQGMLIV%%FkNsjxlzLn%%mXQRkJC" ], [ 295201, "!SDbvPagrlvNCEaXbUJxi! \"oakFNMHFYe= /b\"" ], [ 295242, "%pnUBtzKIJw%%oakFNMHFYe%" ] ], "sz": 295266, "ts": [ { "a": "T1614", "c": 0.6000000238418579, "d": "Country code TJ token", "e": [ "/TJ/" ], "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-tj", "l": 1, "m": "B0007.003" }, { "c": 0.699999988079071, "d": "Redirect output to null", "e": [ "\u003enul" ], "i": "objectives/command-and-control/dropper/execution/batch::redirect-null", "l": 1 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 0.800000011920929, "d": "Batch self path reference", "e": [ "\"%~f0\"" ], "i": "micro-behaviors/process/info/selfpath::self-path-fragment", "l": 1 }, { "c": 1.0, "d": "echo off batch command", "e": [ "@echo off" ], "i": "objectives/command-and-control/dropper/builder::echo-off-batch", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "NoProfile flag", "e": [ "-nop" ], "i": "objectives/anti-static/obfuscation/string/concat::ps-noprofile", "l": 2, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Variable assigned d fragment", "e": [ "EnEtgwsdou=d" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-d-var", "l": 1 }, { "c": 0.8799999952316284, "d": "S7 library or module reference", "e": [ "snaP7" ], "i": "micro-behaviors/communications/s7::library", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 528.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AM token", "e": [ "+AM/" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-am", "l": 1, "m": "B0007.003" }, { "c": 0.550000011920929, "d": "Stdout redirected to NUL", "e": [ "\u003enul" ], "i": "micro-behaviors/os/console/io::windows-stdout-to-nul", "l": 2 }, { "c": 0.6000000238418579, "d": "Echo off", "e": [ "@echo off" ], "i": "objectives/command-and-control/dropper/execution/batch::echo-off", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 266480.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027,T1112,T1059.001", "c": 0.8600000143051147, "d": "Batch has near-zero whitespace", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/command-and-control/dropper/staging/embedded::batch-near-zero-whitespace", "l": 1 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "IwR" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 0.8399999737739563, "d": "Variable assigned e fragment", "e": [ "msnbRtJsOe=e" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-e-var", "l": 1 }, { "c": 0.949999988079071, "d": "Batch extreme line-length bloat", "e": [ "text.avg_line_length = 557.22" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-extreme-line-bloat", "l": 4 }, { "c": 0.8999999761581421, "d": "Batch unusually low whitespace density", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density", "l": 4 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Batch has long encoded token", "e": [ "text.long_token_count = 5.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 2.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.08" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "cnKvM}S1p832J_l{$Za`rwQ/yrnXi*WFVGNPWD^N \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "af2150ebafd8f655bc625da183bfa64597a6e16456f3be68b47830e418fdf2ac", "path": "af2150ebafd8f655bc625da183bfa64597a6e16456f3be68b47830e418fdf2ac.bat", "type": "batch" } ], "tv": "08128" } }