{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.19900932908058167,
        "class": 0
      }
    ],
    "prob": 0.19900933,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.17264573,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.19900933,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 0.14917128,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T14:20:41Z"
  },
  "path": "402a56798d8c7b02e3092d44001549d6.js",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(I)H(F)Md",
        "x": 3,
        "ff": {
          "i": [
            [
              "",
              "hashMatch"
            ],
            [
              "",
              "document.location.href.match"
            ],
            [
              "",
              "css"
            ],
            [
              "",
              "head"
            ],
            [
              "",
              "document.getElementsByTagName"
            ],
            [
              "",
              "style"
            ],
            [
              "",
              "document.createElement"
            ],
            [
              "",
              "style.styleSheet.cssText"
            ],
            [
              "",
              "style.appendChild"
            ],
            [
              "",
              "document.createTextNode"
            ],
            [
              "",
              "head.appendChild"
            ],
            [
              "",
              "encodeQuery"
            ],
            [
              "",
              "location.href"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 18.0,
              "bind_count": 7.0,
              "call_count": 10.0,
              "node_count": 304.0,
              "target_count": 6.0,
              "member_depth_max": 4.0,
              "string_bind_count": 1.0,
              "string_literal_count": 9.0,
              "string_concat_chain_max_length": 4.0
            },
            "file": {
              "size": 962.0,
              "entropy": 4.48,
              "size_bytes": 962.0
            },
            "text": {
              "digit_ratio": 0.03,
              "space_count": 318.0,
              "total_lines": 26.0,
              "char_entropy": 4.48,
              "unique_chars": 74.0,
              "string_density": 0.35,
              "avg_line_length": 35.08,
              "high_byte_ratio": 0.02,
              "max_line_length": 92.0,
              "non_ascii_ratio": 0.02,
              "empty_line_ratio": 0.23,
              "last_line_length": 13.0,
              "whitespace_ratio": 0.38,
              "most_common_ratio": 0.05,
              "identifier_density": 1.73,
              "line_length_stddev": 28.01,
              "normalized_string_count": 1.77,
              "repeated_char_sequences": 15.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 3.83
            },
            "strings": {
              "total": 9.0,
              "avg_length": 5.11,
              "max_length": 20.0,
              "path_count": 1.0,
              "avg_entropy": 1.79,
              "total_bytes": 46.0,
              "entropy_stddev": 0.94
            },
            "comments": {
              "chars": 20.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.04
            },
            "functions": {
              "anonymous": 1.0,
              "no_params_count": 1.0,
              "avg_length_lines": 23.0,
              "max_length_lines": 23.0,
              "min_length_lines": 23.0,
              "density_per_100_lines": 3.85,
              "code_in_functions_ratio": 0.88
            },
            "identifiers": {
              "total": 45.0,
              "avg_length": 8.22,
              "max_length": 20.0,
              "min_length": 3.0,
              "avg_entropy": 2.52,
              "reuse_ratio": 0.4,
              "unique_count": 18.0,
              "length_stddev": 4.28,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.06,
              "all_lowercase_ratio": 0.56
            }
          },
          "s": [
            [
              205,
              "u8",
              "body {display: none}"
            ],
            [
              206,
              "u8",
              "body {display: none}"
            ],
            [
              300,
              "u8",
              "head"
            ],
            [
              301,
              "u8",
              "head"
            ],
            [
              362,
              "u8",
              "style"
            ],
            [
              363,
              "u8",
              "style"
            ],
            [
              722,
              "u8",
              "%26"
            ],
            [
              723,
              "u8",
              "%26"
            ],
            [
              744,
              "u8",
              "%2B"
            ],
            [
              745,
              "u8",
              "%2B"
            ],
            [
              805,
              "u8",
              "wd="
            ],
            [
              806,
              "u8",
              "wd="
            ],
            [
              815,
              "u8",
              "wd="
            ],
            [
              816,
              "u8",
              "wd="
            ],
            [
              882,
              "u8",
              "//"
            ],
            [
              883,
              "u8",
              "//"
            ],
            [
              901,
              "u8",
              "/s?"
            ],
            [
              902,
              "u8",
              "/s?"
            ],
            [
              659,
              "url",
              "var encodeQuery=hashMatch[2].replace(/\u0026/g, '\u0026').replace(/\\+/g, '+');"
            ]
          ],
          "v": {
            "source.language": "javascript",
            "source.imports[0]": "css",
            "source.imports[1]": "document.createElement",
            "source.imports[2]": "document.createTextNode",
            "source.imports[3]": "document.getElementsByTagName",
            "source.imports[4]": "document.location.href.match",
            "source.imports[5]": "encodeQuery",
            "source.imports[6]": "hashMatch",
            "source.imports[7]": "head",
            "source.imports[8]": "head.appendChild",
            "source.imports[9]": "location.href",
            "source.strings[0]": "body {display: none}",
            "source.strings[1]": "var encodeQuery=hashMatch[2].replace(/\u0026/g, '\u0026').replace(/\\+/g, '+');",
            "source.has_imports": true,
            "source.imports[10]": "style",
            "source.imports[11]": "style.appendChild",
            "source.imports[12]": "style.styleSheet.cssText",
            "source.functions[0]": "anonymous"
          },
          "ca": [
            [
              "document.createElement",
              "style"
            ],
            [
              "document.getElementsByTagName",
              "head"
            ]
          ],
          "ct": [
            "document.createElement",
            "document.createTextNode",
            "document.getElementsByTagName",
            "document.location.href.match",
            "head.appendChild",
            "style.appendChild"
          ],
          "id": "javascript",
          "mc": [
            "document.createElement",
            "document.createTextNode",
            "document.getElementsByTagName",
            "document.head",
            "document.location",
            "document.location.href",
            "document.location.href.match",
            "head.appendChild",
            "location.host",
            "location.href",
            "style.appendChild",
            "style.styleSheet",
            "style.styleSheet.cssText"
          ]
        },
        "id": 0,
        "sz": 962,
        "ts": [
          {
            "c": 0.8199999928474426,
            "d": "JavaScript static key string assignment",
            "e": [
              "='body {display: none}'"
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "Decoded property function alias",
            "e": [
              "var encodeQuery=hashMatch[2]"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "innerHTML/location.href rewrite (page blocker shape)",
            "e": [
              "location.href"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-page-block",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.8999999761581421,
            "d": "display:none CSS declaration (hides element)",
            "e": [
              "display: none"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::hidden-zero-iframe--rx-2",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Plain JavaScript identifier assignment",
            "e": [
              "cssText = css;"
            ],
            "i": "metadata/lang/scripted::plain-js-identifier-assignment",
            "l": 1
          },
          {
            "a": "T1056",
            "c": 0.8999999761581421,
            "d": "document.getElement*/querySelector* DOM lookup",
            "e": [
              "document.getElement"
            ],
            "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "402a56798d8c7b02e3092d44001549d6.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.75,
            "d": "Reads browser location host",
            "e": [
              "location.host"
            ],
            "i": "micro-behaviors/fs/path/sensitive/browser::location-host",
            "l": 3
          },
          {
            "a": "T1090.004",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "append"
            ],
            "i": "objectives/command-and-control/infrastructure/dns-pin::js-hosts-file-write--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "location.href"
            ],
            "i": "micro-behaviors/communications/http/url/path::browser-location-host-ref--rx-1",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "Stylesheet href literal remote URL",
            "e": [
              ".href=\"//"
            ],
            "i": "objectives/impact/ui/delivery::remote-stylesheet-literal-url",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "402a56798d8c7b02e3092d44001549d6.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "402a56798d8c7b02e3092d44001549d6.js"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "DOM write API innerHTML or appendChild",
            "e": [
              ".appendChild("
            ],
            "i": "objectives/impact/ui/delivery::dynamic-ad-injection-dom-api-a",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Trailing IIFE closure indicating auto-execution",
            "e": [
              "})();\r\n        \r\n    "
            ],
            "i": "objectives/anti-static/obfuscation/eval/dynamic::export-iife-closure",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: url",
            "e": [
              "var encodeQuery=hashMatch[2].replace(/\u0026/ \u003curl\u003e"
            ],
            "i": "metadata/encoded-payload/url",
            "l": 3
          }
        ],
        "sha": "ba3db009ef870a0de5da5cae704fbc43ae9f61c520c281511878f5632194c862",
        "path": "/data/samples/good/datasets/jsimplifier/BenignJS/402a56798d8c7b02e3092d44001549d6.js",
        "type": "javascript"
      }
    ],
    "tv": "9ea7c"
  }
}