{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999418258666992, "class": 2 } ], "prob": 0.9999418, "class": 2, "models": [ { "m": "az", "prob": 0.99771595, "class": 2 }, { "m": "az/scripts", "prob": 0.9997974, "class": 2 }, { "m": "az/javascript", "prob": 0.9999418, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-07T05:39:13Z" }, "path": "20170324_b37b1f0515d8039249fb472ce670c80b.js", "raw": { "v": "4", "fs": [ { "f": "O₅(As₂Xe₅C₂ErS)H₄(Db₂FOsPo₂)Md₂(Pt)", "k": { "source.imports[0]": "BGDkeBYt", "source.imports[1]": "Cxbgo", "source.imports[2]": "DUnqa", "source.imports[3]": "EUqCtDX", "source.imports[4]": "EnRvRf", "source.imports[5]": "IinA", "source.imports[6]": "IyMiQIQQHujd.ExpandEnvironmentStrings", "source.imports[7]": "JKNVrNaK", "source.imports[8]": "JnOSHt", "source.imports[9]": "KOnIKwU", "source.strings[0]": "\u0011\u0016a\u0011\u0016zirhusr\u003cjKesiizUni4d[yIxIFo0xVHRVy_ztfP5\u003cgpkr]D]e!", "source.strings[1]": "\u0011\u0016eEnv4qxoMrK[n0SRpEP5'\u0011\u0016uz\u003c4SRpEP2oh}hio\u003c!!\u003c.,-1-5\u003cg\u0011\u0016j", "source.strings[2]": "\u0011\u0016j}n\u003cY{KEpj\u003c!\u003cYlNyDzr2pyr{ht'\u0011\u0016j}n\u003cVYWN\u003c!\u003c}_uYuRo45\u003c9\u003cY", "source.strings[3]": "\u0011\u0016j}n\u003cl]KzsuSDKE!Dv]JYnQ[E'\u0011\u0016j}n\u003c~u]ZQk!Dv]JYnQ[E'\u0011\u0016j}n", "source.strings[4]": "\u0011\u0016zirhusr\u003c}_uYuRo45\u003cgj}n\u003c~die!%%%%%7-'j}n\u003cQn^PXS\u003c!\u003c-,,'n", "source.strings[5]": "\u0016j}n\u003cxxhKy\u003c!\u003cG\u003ethhl\u002633lnsin}hsnwr2}ll3.(2ydy\u003eA'\u0011\u0016OM}]tWn", "source.strings[6]": "!\u003c--1-,\u003c5g~ny}w'a\u0011\u0016a\u003c}ht4y5\u003cga\u0011\u0016UIvN", "source.strings[7]": ",d,7-'xLQ]M_y!,d,'d[yIxIFo2Nir4xVHRVy_ztfP0\u003cpkr]D]e0\u003cxLQ", "source.strings[8]": "/(1./('\u0011\u0016ktupy4hniy5\u003cg\u0011\u0016uz4YlNyDzr2pyr{ht !//(1//(5\u003c~ny}w", "source.strings[9]": "45gnyhinr\u003c;O;7;;'a\u0011\u0016zirhusr\u003c~Pkwyfx45gnyhinr\u003c;K;7;;'a\u0011\u0016z", "source.has_imports": true, "source.imports[10]": "NDbKFya", "source.imports[11]": "PEZZnWMY.substring", "source.imports[12]": "PKbwaiYc", "source.imports[13]": "QWCTkt", "source.imports[14]": "String.fromCharCode", "source.imports[15]": "WScript.CreateObject", "source.imports[16]": "YMKhM", "source.imports[17]": "ZHRUf", "source.imports[18]": "ZVeCyoiw", "source.imports[19]": "ZVeCyoiw.Close", "source.imports[20]": "ZVeCyoiw.Write", "source.imports[21]": "aPiWwaYNvJ", "source.imports[22]": "ckxZnXp", "source.imports[23]": "dOQeyy.run", "source.imports[24]": "ePiRxEJ", "source.imports[25]": "kRUqnV", "source.imports[26]": "kgJUHWD", "source.imports[27]": "koYPiQFy.charCodeAt", "source.imports[28]": "oDCcUPPhn", "source.imports[29]": "sJGW", "source.imports[30]": "sWhiQwl", "source.imports[31]": "test1", "source.imports[32]": "test2", "source.imports[33]": "wVoZgCMr", "source.imports[34]": "wVoZgCMr.OpenTextFile", "source.imports[35]": "ytlxsbxgl", "source.imports[36]": "zVyuaqHjkWNyNzeH", "source.strings[10]": "4Rh^iM[455a\u0011\u0016zirhusr\u003cmpXmq4Iun_pJIW0mxLTR0mjH[IYo_]U5ghn", "source.strings[11]": "5'\u0011\u0016zirhusr\u003cOM}]tWnehr_4YlNyDzr0Dv]JYnQ[E5\u003cg\u0011\u0016j}n\u003cUIvN!.", "source.strings[12]": "77'\u0011\u0016YlNyDzr2olpuy\u003c4VYWN0+,-1+,,5'\u0011\u0016a\u0011\u0016a\u0011\u0016zirhusr\u003chM{Hq", "source.strings[13]": "\u003c+5\u003cg\u0011\u0016~ny}w'\u0011\u0016a\u0011\u0016ZPJTu^{!ryk\u003c]hujyDS~vyh4\u003eKOnulh2Ot", "source.strings[14]": "\u003c4\u003cOr}Jtpf2_sirh\u003c", "source.strings[15]": "\u003c4\u003cOr}Jtpf2_sirh\u003c\\\"!\u003c--1-,\u003c5g~ny}w'a\u0011\u0016a\u003c}ht4y5\u003cga\u0011\u0016UIvN", "source.strings[16]": "\u003c;H;7;;'a\u0011\u0016zirhusr\u003cRh^iM[45gnyhinr\u003c;9;7PI[ViZ457;Q;7PpF{", "source.strings[17]": "\u003cvHI[hkoD!*,(1*,/'\u0011\u0016j}n\u003c{UnvOvy]s\u003c!\u003cryk\u003c]hujyDS~vyh4~Pk", "source.strings[18]": "\u003eYdl}rxYrjunsrqy\u003e7\u003erhOhnur{o\u003eA'nyhinr\u003cH]^feSGzij[wSKG,AA", "source.strings[19]": "JEN2knuhy4JUsRS5'a\u0011\u0016zirhusr\u003cdRRKp_Qe4wo~tNJ5\u003cgj}n\u003ctPiD", "source.strings[20]": "KDEF;7;}~xyz{tuvwpqrslmnohijkdef;'zsn4j}n\u003cjqj^R!,'jqj^R ", "source.strings[21]": "LL^w]Jh5'a\u0011\u0016\u0011\u0016j}n\u003cD]X~ImP\u003c!\u003cryk\u003cX}hy45'\u0011\u0016ktupy4hniy5\u003cg\u0011\u0016j", "source.strings[22]": "MkKO6Y6H6RXkjhY{[~DQ;2olpuh4;6;5'eeWzdt2slyr4J]zhG,A7J]", "source.strings[23]": "NGtiFIDkKoAA'anyhinr\u003c^PExN_2oi~ohnur{4/0^PExN_2pyr{ht5", "source.strings[24]": "NJZSHJagIRLruvTxSECnfIBXRHEjFFKaUdcFmSeMjmylZEoMSwulKGCWlDOfcKgcEcYDKCMIccaFCPKPErRfLjEEkLxibfvBNGUoctOnbsiRSCwPRjdVlunTFgvXOpGNA", "source.strings[25]": "NwLTdou4]^yuWmrLL^w]Jh5\u003cgnyhinr\u003cryk\u003c]hujyDS~vyh4]^yuWmr", "source.strings[26]": "Scripting.FileSystemObject", "source.strings[27]": "Scripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObject", "source.strings[28]": "TR5'dRRKp_Qe4Iun_pJIW5'~Zey4Iun_pJIW0mjH[IYo_]U5'_Ziekhs", "source.strings[29]": "U457;;7;9;\u003c7\u003c;;'a\u0011\u0016zirhusr\u003cxYQtd4H]^feS5gj}n\u003czij[wSK!G", "source.strings[30]": "Uni4{UnvOvy]s0~u]ZQk5'\u0011\u0016j}n\u003cOr}Jtpf\u003c!\u003c[yhS~vyh4;kurq{qh", "source.strings[31]": "VedY0\u003c.5'a\u0011\u0016zirhusr\u003cr]rOkwh4N~^jq5\u003cgN~^jq2psoy45'a\u0011\u0016", "source.strings[32]": "[P}LhkN:QP.2D;7;Q:jL}MWrKxHXu:PTHHL;0G,0.0(A0;:;55'\u0011\u0016a45", "source.strings[33]": "\\\"\u003c+5\u003cg\u0011\u0016~ny}w'\u0011\u0016a\u0011\u0016ZPJTu^{!ryk\u003c]hujyDS~vyh4\u003eKOnulh2Ot", "source.strings[34]": "]M_y5'a\u0011\u0016j}n\u003c^PYh\u003c!\u003cG\u003ethhl\u002633lnsin}hsnwr2}ll3./2ydy\u003eA'\u0011", "source.strings[35]": "a\u0011\u0016zirhusr\u003c[WiftJt45gj}n\u003cpj_Eyo!G\u003en}rxsq\u003eA'nyhinr\u003cQ}htGp", "source.strings[36]": "a\u0011\u0016zirhusr\u003c~Zey4]shFJRm0[HLVedY5\u003cg]shFJRm2o}jyHsZupy4[HL", "source.strings[37]": "d4{UnvOvy]s5\u003c7\u003cOhnur{2znsq_t}n_sxy4%.5\u003c7\u003c~u]ZQk'\u0011\u0016j}n\u003cSR", "source.strings[38]": "d~iRwr4yX}}sMzu0l__snEk[L5'^PExN_\u003c!\u003c;V~{;'zsn4tiFIDkKo!,", "source.strings[39]": "eFuU5'a\u0011\u0016zirhusr\u003c^[Neq4yX}}sMzu0WPEXlN0l__snEk[L5gWFYir!", "source.strings[40]": "egIun_pJIW2slyr45'_SFTJWZw4Iun_pJIW5'{yNqPSR4Iun_pJIW0mxL", "source.strings[41]": "ehr_4^PYh0\u003c;-))-,2ydy;5'\u0011\u0016OM}]tWnehr_4xxhKy0\u003c;.+$$,2ydy;", "source.strings[42]": "irhusr\u003cPpF{U45gnyhinr\u003c;L;7;;'a\u0011\u0016zirhusr\u003cPI[ViZ45gnyhinr", "source.strings[43]": "jTJFnOyjQ:Ohny}q;0G,0-0/0)A0;:;55'\u0011\u0016j}n\u003cQlZYrZ}hXjWd!mpXm", "source.strings[44]": "j_EyoG,AA45a\u0011\u0016zirhusr\u003c]OTP4lKQzj{5\u003cglKQzj{2slyr45'a\u0011\u0016zir", "source.strings[45]": "j}W[]'jqj^R775gfIy}[7!}kFyQFsp2t}n]h4Q}ht2zpssn4Q}ht2n}r", "source.strings[46]": "o!Iun_pJIW2oufy'r]rOkwh4Iun_pJIW5'nyhinr\u003c_Ziekhso'a}ht4", "source.strings[47]": "o\u0026guqlynosr}husrPyjyp!uqlynosr}hya;52YdyMiyne4;Oypyh\u003c6\u003c", "source.strings[48]": "oyn1]{yrh\u003e0\u003c\u003eLehtsr\u003e7\u003e1inppu~3/2-\u003e5'LyE]dOw4eeWzdt5'a}h", "source.strings[49]": "pEP\u003c!\u003czirhusr45g\u0011\u0016nyhinr\u003cryk\u003c]hujyDS~vyh4^[Neq4;QOD:Q{", "source.strings[50]": "q4eMHOz_v0SRpEP2Nyolsroy^sxe0~u]ZQk5'\u0011\u0016a\u0011\u0016hne\u003cg\u0011\u0016jKesiiz", "source.strings[51]": "rhusr\u003cd~iRwr4SII}H[i0rq[~eFuU5gnyhinr\u003cSII}H[i2olpuh4rq[~", "source.strings[52]": "tiFIDkKo WPEXlN2pyr{ht'tiFIDkKo775\u003cg^PExN_7!WFYirGWPEXl", "source.strings[53]": "usr\u003cSNOqw~dW4j}W[]5\u003cgj}n\u003c}kFyQFsp!;]^_XYZ[TUVWPQRSLMNOHIJ", "source.strings[54]": "vjXSF!GA'wo~tNJ2lsouhusr!tPiDvjXSF2pyr{ht64++*$%-/1***5", "source.strings[55]": "wyfx457hM{Hq457\u003e\u003e7\u003enul\u003e7\u003eh2Otypp\u003e5'\u0011\u0016j}n\u003c~u]ZQk\u003c!\u003cxYQt", "source.strings[56]": "xHPfxZ", "source.strings[57]": "xsq456}kFyQFsp2pyr{ht55'anyhinr\u003cfIy}['a\u0011\u0016zirhusr\u003cSVFFlTF", "source.strings[58]": "y5gaa\u0011\u0016zirhusr\u003ceEnv4TFnrif0eeWzdt5ghnegJ]zh\u003c!\u003c;[6]hPvEq", "source.strings[59]": "yNqPSR4^JEN0JUsRS5\u003cgnyhinr\u003c36m[vQKN_hVufzlDdFjReLOoE63^", "source.strings[60]": "yhinr\u003cQ}ht2nsirx4[WiftJt4564~die1Qn^PXS57Qn^PXS5'a\u0011\u0016zirh", "source.strings[61]": "ypp\u003e5'\u0011\u0016ZPJTu^{2nir4\u003elur{\u003c1r\u003c-\u003c1k\u003c\u003e7\u003e.,,,\u003c,2,2,2-\u003e0,01-5", "source.strings[62]": "zhG.A7J]zhG/A0\u003cTFnrif0\u003cz}poy5'eeWzdt2oyhNymiyohTy}xyn4\u003eI", "source.strings[63]": "znsq\u003cKur/.CLnsyoo\u003cKtyny\u003cR}qy\u003c!\u003c@;;7l]KzsuSDKE7;@;;5'\u0011\u0016uz", "source.strings[64]": "{KEpj'\u0011\u0016j}n\u003cqxoMrK[n!YlNyDzrGVYWNA'\u0011\u0016j}n\u003c^hmsZ!}_uYuRo45", "source.strings[65]": "{yhHuqy45\u003c1\u003cD]X~ImP2{yhHuqy455'\u0011\u0016uz4pYplSX{2{yhOysrxo45\u003c", "source.strings[66]": "}n\u003c^DFmvQ\u003c!\u003cryk\u003cX}hy45'\u0011\u0016j}n\u003cpYplSX{\u003c!\u003cryk\u003cX}hy4^DFmvQ2", "source.strings[67]": "}n\u003ceMHOz_v\u003c!\u003cryk\u003c]hujyDS~vyh4^[Neq4;]XS:X^:uUzvwrVKS:2:", "source.strings[68]": "husr\u003c_SFTJWZw4unn~uTLNq5\u003cgunn~uTLNq2hely!-'a\u0011\u0016zirhusr\u003c{", "source.strings[69]": "t4y5gaa\u0011\u0016zirhusr\u003cLyE]dOw4sfkRuql5\u003cgsfkRuql2oyrx45'a\u0011\u0016zi", "source.functions[0]": "BGDkeBYt", "source.functions[1]": "DUnqa", "source.functions[2]": "JdDmfcGRZ", "source.functions[3]": "QWCTkt", "source.functions[4]": "aPiWwaYNvJ", "source.functions[5]": "ePiRxEJ", "source.functions[6]": "oDCcUPPhn", "source.functions[7]": "rojADaYaIEebNq", "source.functions[8]": "ytlxsbxgl", "source.functions[9]": "zVyuaqHjkWNyNzeH" }, "x": 78, "id": 0, "is": [ "KOnIKwU", "JKNVrNaK", "YMKhM", "ZHRUf", "sWhiQwl", "oDCcUPPhn", "QWCTkt", "test1", "test2", "JnOSHt", "String.fromCharCode", "koYPiQFy.charCodeAt", "Cxbgo", "DUnqa", "EUqCtDX", "aPiWwaYNvJ", "BGDkeBYt", "IyMiQIQQHujd.ExpandEnvironmentStrings", "ckxZnXp", "wVoZgCMr", "ZVeCyoiw", "EnRvRf", "PKbwaiYc", "NDbKFya", "kRUqnV", "kgJUHWD", "EnRvRf", "WScript.CreateObject", "wVoZgCMr", "ZVeCyoiw", "wVoZgCMr.OpenTextFile", "zVyuaqHjkWNyNzeH", "ZVeCyoiw.Write", "ZVeCyoiw.Close", "ePiRxEJ", "ytlxsbxgl", "BGDkeBYt", "dOQeyy.run", "aPiWwaYNvJ", "String.fromCharCode", "sJGW", "PEZZnWMY.substring", "IinA", "PEZZnWMY.substring" ], "ms": { "file": { "size": 5674.0 }, "text": { "digit_ratio": 0.09, "space_count": 61.0, "total_lines": 80.0, "char_entropy": 6.23, "unique_chars": 96.0, "import_density": 55.0, "lines_over_200": 2.0, "lines_over_500": 1.0, "string_density": 2.17, "avg_line_length": 68.95, "max_line_length": 948.0, "empty_line_ratio": 0.06, "last_line_length": 948.0, "long_token_count": 4.0, "most_common_char": "n", "whitespace_ratio": 0.04, "most_common_ratio": 0.04, "identifier_density": 1.25, "line_length_stddev": 102.89, "non_printable_ratio": 0.04, "normalized_import_count": 4.92, "normalized_string_count": 19.45, "max_inline_whitespace_run": 1.0, "normalized_function_count": 1.12, "imports_to_functions_ratio": 4.4, "strings_to_functions_ratio": 17.4, "normalized_unique_identifiers": 7.28, "identifiers_to_functions_ratio": 4.6 }, "imports": { "total": 44.0, "unique_modules": 37.0, "third_party_count": 44.0, "third_party_ratio": 1.0 }, "strings": { "total": 174.0, "avg_length": 44.97, "max_length": 130.0, "path_count": 2.0, "avg_entropy": 3.89, "total_bytes": 7824.0, "entropy_stddev": 1.8, "high_entropy_count": 34.0 }, "comments": {}, "functions": { "total": 10.0, "one_liners": 10.0, "avg_name_length": 9.3, "no_params_count": 10.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "high_entropy_names": 1.0, "density_per_100_lines": 12.5, "code_in_functions_ratio": 0.13 }, "identifiers": { "total": 100.0, "avg_length": 7.63, "max_length": 16.0, "min_length": 4.0, "avg_entropy": 2.71, "reuse_ratio": 0.46, "unique_count": 46.0, "length_stddev": 2.56, "has_digit_ratio": 0.04, "high_entropy_count": 1.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.02, "numeric_suffix_count": 2.0 } }, "ss": [ [ 94, "28" ], [ 95, "28" ], [ 109, "\"" ], [ 128, "\"" ], [ 284, "\u0011\u0016zirhusr\u003c}_uYuRo45\u003cgj}n\u003c~die!%%%%%7-'j}n\u003cQn^PXS\u003c!\u003c-,,'n" ], [ 285, "\u0011\u0016zirhusr\u003c}_uYuRo45\u003cgj}n\u003c~die!%%%%%7-'j}n\u003cQn^PXS\u003c!\u003c-,,'n" ], [ 346, "yhinr\u003cQ}ht2nsirx4[WiftJt4564~die1Qn^PXS57Qn^PXS5'a\u0011\u0016zirh" ], [ 347, "yhinr\u003cQ}ht2nsirx4[WiftJt4564~die1Qn^PXS57Qn^PXS5'a\u0011\u0016zirh" ], [ 408, "usr\u003cSNOqw~dW4j}W[]5\u003cgj}n\u003c}kFyQFsp!;]^_XYZ[TUVWPQRSLMNOHIJ" ], [ 409, "usr\u003cSNOqw~dW4j}W[]5\u003cgj}n\u003c}kFyQFsp!;]^_XYZ[TUVWPQRSLMNOHIJ" ], [ 470, "KDEF;7;}~xyz{tuvwpqrslmnohijkdef;'zsn4j}n\u003cjqj^R!,'jqj^R " ], [ 471, "KDEF;7;}~xyz{tuvwpqrslmnohijkdef;'zsn4j}n\u003cjqj^R!,'jqj^R " ], [ 532, "j}W[]'jqj^R775gfIy}[7!}kFyQFsp2t}n]h4Q}ht2zpssn4Q}ht2n}r" ], [ 533, "j}W[]'jqj^R775gfIy}[7!}kFyQFsp2t}n]h4Q}ht2zpssn4Q}ht2n}r" ], [ 594, "xsq456}kFyQFsp2pyr{ht55'anyhinr\u003cfIy}['a\u0011\u0016zirhusr\u003cSVFFlTF" ], [ 595, "xsq456}kFyQFsp2pyr{ht55'anyhinr\u003cfIy}['a\u0011\u0016zirhusr\u003cSVFFlTF" ], [ 656, "NwLTdou4]^yuWmrLL^w]Jh5\u003cgnyhinr\u003cryk\u003c]hujyDS~vyh4]^yuWmr" ], [ 657, "NwLTdou4]^yuWmrLL^w]Jh5\u003cgnyhinr\u003cryk\u003c]hujyDS~vyh4]^yuWmr" ], [ 718, "LL^w]Jh5'a\u0011\u0016\u0011\u0016j}n\u003cD]X~ImP\u003c!\u003cryk\u003cX}hy45'\u0011\u0016ktupy4hniy5\u003cg\u0011\u0016j" ], [ 719, "LL^w]Jh5'a\u0011\u0016\u0011\u0016j}n\u003cD]X~ImP\u003c!\u003cryk\u003cX}hy45'\u0011\u0016ktupy4hniy5\u003cg\u0011\u0016j" ], [ 780, "}n\u003c^DFmvQ\u003c!\u003cryk\u003cX}hy45'\u0011\u0016j}n\u003cpYplSX{\u003c!\u003cryk\u003cX}hy4^DFmvQ2" ], [ 781, "}n\u003c^DFmvQ\u003c!\u003cryk\u003cX}hy45'\u0011\u0016j}n\u003cpYplSX{\u003c!\u003cryk\u003cX}hy4^DFmvQ2" ], [ 842, "{yhHuqy45\u003c1\u003cD]X~ImP2{yhHuqy455'\u0011\u0016uz4pYplSX{2{yhOysrxo45\u003c" ], [ 843, "{yhHuqy45\u003c1\u003cD]X~ImP2{yhHuqy455'\u0011\u0016uz4pYplSX{2{yhOysrxo45\u003c" ], [ 904, "\\\"\u003c+5\u003cg\u0011\u0016~ny}w'\u0011\u0016a\u0011\u0016ZPJTu^{!ryk\u003c]hujyDS~vyh4\u003eKOnulh2Ot" ], [ 907, "\u003c+5\u003cg\u0011\u0016~ny}w'\u0011\u0016a\u0011\u0016ZPJTu^{!ryk\u003c]hujyDS~vyh4\u003eKOnulh2Ot" ], [ 966, "ypp\u003e5'\u0011\u0016ZPJTu^{2nir4\u003elur{\u003c1r\u003c-\u003c1k\u003c\u003e7\u003e.,,,\u003c,2,2,2-\u003e0,01-5" ], [ 967, "ypp\u003e5'\u0011\u0016ZPJTu^{2nir4\u003elur{\u003c1r\u003c-\u003c1k\u003c\u003e7\u003e.,,,\u003c,2,2,2-\u003e0,01-5" ], [ 1028, "\u0011\u0016a\u0011\u0016zirhusr\u003cjKesiizUni4d[yIxIFo0xVHRVy_ztfP5\u003cgpkr]D]e!" ], [ 1029, "\u0011\u0016a\u0011\u0016zirhusr\u003cjKesiizUni4d[yIxIFo0xVHRVy_ztfP5\u003cgpkr]D]e!" ], [ 1090, ",d,7-'xLQ]M_y!,d,'d[yIxIFo2Nir4xVHRVy_ztfP0\u003cpkr]D]e0\u003cxLQ" ], [ 1091, ",d,7-'xLQ]M_y!,d,'d[yIxIFo2Nir4xVHRVy_ztfP0\u003cpkr]D]e0\u003cxLQ" ], [ 1152, "]M_y5'a\u0011\u0016j}n\u003c^PYh\u003c!\u003cG\u003ethhl\u002633lnsin}hsnwr2}ll3./2ydy\u003eA'\u0011" ], [ 1153, "]M_y5'a\u0011\u0016j}n\u003c^PYh\u003c!\u003cG\u003ethhl\u002633lnsin}hsnwr2}ll3./2ydy\u003eA'\u0011" ], [ 1214, "\u0016j}n\u003cxxhKy\u003c!\u003cG\u003ethhl\u002633lnsin}hsnwr2}ll3.(2ydy\u003eA'\u0011\u0016OM}]tWn" ], [ 1215, "\u0016j}n\u003cxxhKy\u003c!\u003cG\u003ethhl\u002633lnsin}hsnwr2}ll3.(2ydy\u003eA'\u0011\u0016OM}]tWn" ], [ 1276, "ehr_4^PYh0\u003c;-))-,2ydy;5'\u0011\u0016OM}]tWnehr_4xxhKy0\u003c;.+$$,2ydy;" ], [ 1277, "ehr_4^PYh0\u003c;-))-,2ydy;5'\u0011\u0016OM}]tWnehr_4xxhKy0\u003c;.+$$,2ydy;" ], [ 1338, "5'\u0011\u0016zirhusr\u003cOM}]tWnehr_4YlNyDzr0Dv]JYnQ[E5\u003cg\u0011\u0016j}n\u003cUIvN!." ], [ 1339, "5'\u0011\u0016zirhusr\u003cOM}]tWnehr_4YlNyDzr0Dv]JYnQ[E5\u003cg\u0011\u0016j}n\u003cUIvN!." ], [ 1400, "/(1./('\u0011\u0016ktupy4hniy5\u003cg\u0011\u0016uz4YlNyDzr2pyr{ht !//(1//(5\u003c~ny}w" ], [ 1401, "/(1./('\u0011\u0016ktupy4hniy5\u003cg\u0011\u0016uz4YlNyDzr2pyr{ht !//(1//(5\u003c~ny}w" ], [ 1462, "\u0011\u0016j}n\u003cY{KEpj\u003c!\u003cYlNyDzr2pyr{ht'\u0011\u0016j}n\u003cVYWN\u003c!\u003c}_uYuRo45\u003c9\u003cY" ], [ 1463, "\u0011\u0016j}n\u003cY{KEpj\u003c!\u003cYlNyDzr2pyr{ht'\u0011\u0016j}n\u003cVYWN\u003c!\u003c}_uYuRo45\u003c9\u003cY" ], [ 1524, "{KEpj'\u0011\u0016j}n\u003cqxoMrK[n!YlNyDzrGVYWNA'\u0011\u0016j}n\u003c^hmsZ!}_uYuRo45" ], [ 1525, "{KEpj'\u0011\u0016j}n\u003cqxoMrK[n!YlNyDzrGVYWNA'\u0011\u0016j}n\u003c^hmsZ!}_uYuRo45" ], [ 1586, "\u0011\u0016j}n\u003cl]KzsuSDKE!Dv]JYnQ[E'\u0011\u0016j}n\u003c~u]ZQk!Dv]JYnQ[E'\u0011\u0016j}n" ], [ 1587, "\u0011\u0016j}n\u003cl]KzsuSDKE!Dv]JYnQ[E'\u0011\u0016j}n\u003c~u]ZQk!Dv]JYnQ[E'\u0011\u0016j}n" ], [ 1648, "\u003cvHI[hkoD!*,(1*,/'\u0011\u0016j}n\u003c{UnvOvy]s\u003c!\u003cryk\u003c]hujyDS~vyh4~Pk" ], [ 1649, "\u003cvHI[hkoD!*,(1*,/'\u0011\u0016j}n\u003c{UnvOvy]s\u003c!\u003cryk\u003c]hujyDS~vyh4~Pk" ], [ 1710, "wyfx457hM{Hq457\u003e\u003e7\u003enul\u003e7\u003eh2Otypp\u003e5'\u0011\u0016j}n\u003c~u]ZQk\u003c!\u003cxYQt" ], [ 1711, "wyfx457hM{Hq457\u003e\u003e7\u003enul\u003e7\u003eh2Otypp\u003e5'\u0011\u0016j}n\u003c~u]ZQk\u003c!\u003cxYQt" ], [ 1772, "d4{UnvOvy]s5\u003c7\u003cOhnur{2znsq_t}n_sxy4%.5\u003c7\u003c~u]ZQk'\u0011\u0016j}n\u003cSR" ], [ 1773, "d4{UnvOvy]s5\u003c7\u003cOhnur{2znsq_t}n_sxy4%.5\u003c7\u003c~u]ZQk'\u0011\u0016j}n\u003cSR" ], [ 1834, "pEP\u003c!\u003czirhusr45g\u0011\u0016nyhinr\u003cryk\u003c]hujyDS~vyh4^[Neq4;QOD:Q{" ], [ 1835, "pEP\u003c!\u003czirhusr45g\u0011\u0016nyhinr\u003cryk\u003c]hujyDS~vyh4^[Neq4;QOD:Q{" ], [ 1896, "[P}LhkN:QP.2D;7;Q:jL}MWrKxHXu:PTHHL;0G,0.0(A0;:;55'\u0011\u0016a45" ], [ 1897, "[P}LhkN:QP.2D;7;Q:jL}MWrKxHXu:PTHHL;0G,0.0(A0;:;55'\u0011\u0016a45" ], [ 1958, "\u0011\u0016eEnv4qxoMrK[n0SRpEP5'\u0011\u0016uz\u003c4SRpEP2oh}hio\u003c!!\u003c.,-1-5\u003cg\u0011\u0016j" ], [ 1959, "\u0011\u0016eEnv4qxoMrK[n0SRpEP5'\u0011\u0016uz\u003c4SRpEP2oh}hio\u003c!!\u003c.,-1-5\u003cg\u0011\u0016j" ], [ 2020, "}n\u003ceMHOz_v\u003c!\u003cryk\u003c]hujyDS~vyh4^[Neq4;]XS:X^:uUzvwrVKS:2:" ], [ 2021, "}n\u003ceMHOz_v\u003c!\u003cryk\u003c]hujyDS~vyh4^[Neq4;]XS:X^:uUzvwrVKS:2:" ], [ 2082, "jTJFnOyjQ:Ohny}q;0G,0-0/0)A0;:;55'\u0011\u0016j}n\u003cQlZYrZ}hXjWd!mpXm" ], [ 2083, "jTJFnOyjQ:Ohny}q;0G,0-0/0)A0;:;55'\u0011\u0016j}n\u003cQlZYrZ}hXjWd!mpXm" ], [ 2144, "q4eMHOz_v0SRpEP2Nyolsroy^sxe0~u]ZQk5'\u0011\u0016a\u0011\u0016hne\u003cg\u0011\u0016jKesiiz" ], [ 2145, "q4eMHOz_v0SRpEP2Nyolsroy^sxe0~u]ZQk5'\u0011\u0016a\u0011\u0016hne\u003cg\u0011\u0016jKesiiz" ], [ 2206, "Uni4{UnvOvy]s0~u]ZQk5'\u0011\u0016j}n\u003cOr}Jtpf\u003c!\u003c[yhS~vyh4;kurq{qh" ], [ 2207, "Uni4{UnvOvy]s0~u]ZQk5'\u0011\u0016j}n\u003cOr}Jtpf\u003c!\u003c[yhS~vyh4;kurq{qh" ], [ 2280, "o\u0026guqlynosr}husrPyjyp!uqlynosr}hya;52YdyMiyne4;Oypyh\u003c6\u003c" ], [ 2281, "o\u0026guqlynosr}husrPyjyp!uqlynosr}hya;52YdyMiyne4;Oypyh\u003c6\u003c" ], [ 2342, "znsq\u003cKur/.CLnsyoo\u003cKtyny\u003cR}qy\u003c!\u003c@;;7l]KzsuSDKE7;@;;5'\u0011\u0016uz" ], [ 2343, "znsq\u003cKur/.CLnsyoo\u003cKtyny\u003cR}qy\u003c!\u003c@;;7l]KzsuSDKE7;@;;5'\u0011\u0016uz" ], [ 2404, "\u003c4\u003cOr}Jtpf2_sirh\u003c\\\"!\u003c--1-,\u003c5g~ny}w'a\u0011\u0016a\u003c}ht4y5\u003cga\u0011\u0016UIvN" ], [ 2405, "\u003c4\u003cOr}Jtpf2_sirh\u003c" ], [ 2424, "!\u003c--1-,\u003c5g~ny}w'a\u0011\u0016a\u003c}ht4y5\u003cga\u0011\u0016UIvN" ], [ 2466, "77'\u0011\u0016YlNyDzr2olpuy\u003c4VYWN0+,-1+,,5'\u0011\u0016a\u0011\u0016a\u0011\u0016zirhusr\u003chM{Hq" ], [ 2467, "77'\u0011\u0016YlNyDzr2olpuy\u003c4VYWN0+,-1+,,5'\u0011\u0016a\u0011\u0016a\u0011\u0016zirhusr\u003chM{Hq" ], [ 2528, "45gnyhinr\u003c;O;7;;'a\u0011\u0016zirhusr\u003c~Pkwyfx45gnyhinr\u003c;K;7;;'a\u0011\u0016z" ], [ 2529, "45gnyhinr\u003c;O;7;;'a\u0011\u0016zirhusr\u003c~Pkwyfx45gnyhinr\u003c;K;7;;'a\u0011\u0016z" ], [ 2590, "irhusr\u003cPpF{U45gnyhinr\u003c;L;7;;'a\u0011\u0016zirhusr\u003cPI[ViZ45gnyhinr" ], [ 2591, "irhusr\u003cPpF{U45gnyhinr\u003c;L;7;;'a\u0011\u0016zirhusr\u003cPI[ViZ45gnyhinr" ], [ 2652, "\u003c;H;7;;'a\u0011\u0016zirhusr\u003cRh^iM[45gnyhinr\u003c;9;7PI[ViZ457;Q;7PpF{" ], [ 2653, "\u003c;H;7;;'a\u0011\u0016zirhusr\u003cRh^iM[45gnyhinr\u003c;9;7PI[ViZ457;Q;7PpF{" ], [ 2714, "U457;;7;9;\u003c7\u003c;;'a\u0011\u0016zirhusr\u003cxYQtd4H]^feS5gj}n\u003czij[wSK!G" ], [ 2715, "U457;;7;9;\u003c7\u003c;;'a\u0011\u0016zirhusr\u003cxYQtd4H]^feS5gj}n\u003czij[wSK!G" ], [ 2776, "\u003eYdl}rxYrjunsrqy\u003e7\u003erhOhnur{o\u003eA'nyhinr\u003cH]^feSGzij[wSKG,AA" ], [ 2777, "\u003eYdl}rxYrjunsrqy\u003e7\u003erhOhnur{o\u003eA'nyhinr\u003cH]^feSGzij[wSKG,AA" ], [ 2838, "4Rh^iM[455a\u0011\u0016zirhusr\u003cmpXmq4Iun_pJIW0mxLTR0mjH[IYo_]U5ghn" ], [ 2839, "4Rh^iM[455a\u0011\u0016zirhusr\u003cmpXmq4Iun_pJIW0mxLTR0mjH[IYo_]U5ghn" ], [ 2900, "egIun_pJIW2slyr45'_SFTJWZw4Iun_pJIW5'{yNqPSR4Iun_pJIW0mxL" ], [ 2901, "egIun_pJIW2slyr45'_SFTJWZw4Iun_pJIW5'{yNqPSR4Iun_pJIW0mxL" ], [ 2962, "TR5'dRRKp_Qe4Iun_pJIW5'~Zey4Iun_pJIW0mjH[IYo_]U5'_Ziekhs" ], [ 2963, "TR5'dRRKp_Qe4Iun_pJIW5'~Zey4Iun_pJIW0mjH[IYo_]U5'_Ziekhs" ], [ 3024, "o!Iun_pJIW2oufy'r]rOkwh4Iun_pJIW5'nyhinr\u003c_Ziekhso'a}ht4" ], [ 3025, "o!Iun_pJIW2oufy'r]rOkwh4Iun_pJIW5'nyhinr\u003c_Ziekhso'a}ht4" ], [ 3086, "y5gaa\u0011\u0016zirhusr\u003ceEnv4TFnrif0eeWzdt5ghnegJ]zh\u003c!\u003c;[6]hPvEq" ], [ 3087, "y5gaa\u0011\u0016zirhusr\u003ceEnv4TFnrif0eeWzdt5ghnegJ]zh\u003c!\u003c;[6]hPvEq" ], [ 3148, "MkKO6Y6H6RXkjhY{[~DQ;2olpuh4;6;5'eeWzdt2slyr4J]zhG,A7J]" ], [ 3149, "MkKO6Y6H6RXkjhY{[~DQ;2olpuh4;6;5'eeWzdt2slyr4J]zhG,A7J]" ], [ 3210, "zhG.A7J]zhG/A0\u003cTFnrif0\u003cz}poy5'eeWzdt2oyhNymiyohTy}xyn4\u003eI" ], [ 3211, "zhG.A7J]zhG/A0\u003cTFnrif0\u003cz}poy5'eeWzdt2oyhNymiyohTy}xyn4\u003eI" ], [ 3272, "oyn1]{yrh\u003e0\u003c\u003eLehtsr\u003e7\u003e1inppu~3/2-\u003e5'LyE]dOw4eeWzdt5'a}h" ], [ 3273, "oyn1]{yrh\u003e0\u003c\u003eLehtsr\u003e7\u003e1inppu~3/2-\u003e5'LyE]dOw4eeWzdt5'a}h" ], [ 3334, "t4y5gaa\u0011\u0016zirhusr\u003cLyE]dOw4sfkRuql5\u003cgsfkRuql2oyrx45'a\u0011\u0016zi" ], [ 3335, "t4y5gaa\u0011\u0016zirhusr\u003cLyE]dOw4sfkRuql5\u003cgsfkRuql2oyrx45'a\u0011\u0016zi" ], [ 3396, "rhusr\u003cd~iRwr4SII}H[i0rq[~eFuU5gnyhinr\u003cSII}H[i2olpuh4rq[~" ], [ 3397, "rhusr\u003cd~iRwr4SII}H[i0rq[~eFuU5gnyhinr\u003cSII}H[i2olpuh4rq[~" ], [ 3458, "eFuU5'a\u0011\u0016zirhusr\u003c^[Neq4yX}}sMzu0WPEXlN0l__snEk[L5gWFYir!" ], [ 3459, "eFuU5'a\u0011\u0016zirhusr\u003c^[Neq4yX}}sMzu0WPEXlN0l__snEk[L5gWFYir!" ], [ 3520, "d~iRwr4yX}}sMzu0l__snEk[L5'^PExN_\u003c!\u003c;V~{;'zsn4tiFIDkKo!," ], [ 3521, "d~iRwr4yX}}sMzu0l__snEk[L5'^PExN_\u003c!\u003c;V~{;'zsn4tiFIDkKo!," ], [ 3582, "tiFIDkKo WPEXlN2pyr{ht'tiFIDkKo775\u003cg^PExN_7!WFYirGWPEXl" ], [ 3583, "tiFIDkKo WPEXlN2pyr{ht'tiFIDkKo775\u003cg^PExN_7!WFYirGWPEXl" ], [ 3644, "NGtiFIDkKoAA'anyhinr\u003c^PExN_2oi~ohnur{4/0^PExN_2pyr{ht5" ], [ 3645, "NGtiFIDkKoAA'anyhinr\u003c^PExN_2oi~ohnur{4/0^PExN_2pyr{ht5" ], [ 3706, "a\u0011\u0016zirhusr\u003c[WiftJt45gj}n\u003cpj_Eyo!G\u003en}rxsq\u003eA'nyhinr\u003cQ}htGp" ], [ 3707, "a\u0011\u0016zirhusr\u003c[WiftJt45gj}n\u003cpj_Eyo!G\u003en}rxsq\u003eA'nyhinr\u003cQ}htGp" ], [ 3768, "j_EyoG,AA45a\u0011\u0016zirhusr\u003c]OTP4lKQzj{5\u003cglKQzj{2slyr45'a\u0011\u0016zir" ], [ 3769, "j_EyoG,AA45a\u0011\u0016zirhusr\u003c]OTP4lKQzj{5\u003cglKQzj{2slyr45'a\u0011\u0016zir" ], [ 3830, "husr\u003c_SFTJWZw4unn~uTLNq5\u003cgunn~uTLNq2hely!-'a\u0011\u0016zirhusr\u003c{" ], [ 3831, "husr\u003c_SFTJWZw4unn~uTLNq5\u003cgunn~uTLNq2hely!-'a\u0011\u0016zirhusr\u003c{" ], [ 3892, "yNqPSR4^JEN0JUsRS5\u003cgnyhinr\u003c36m[vQKN_hVufzlDdFjReLOoE63^" ], [ 3893, "yNqPSR4^JEN0JUsRS5\u003cgnyhinr\u003c36m[vQKN_hVufzlDdFjReLOoE63^" ], [ 3954, "JEN2knuhy4JUsRS5'a\u0011\u0016zirhusr\u003cdRRKp_Qe4wo~tNJ5\u003cgj}n\u003ctPiD" ], [ 3955, "JEN2knuhy4JUsRS5'a\u0011\u0016zirhusr\u003cdRRKp_Qe4wo~tNJ5\u003cgj}n\u003ctPiD" ], [ 4016, "vjXSF!GA'wo~tNJ2lsouhusr!tPiDvjXSF2pyr{ht64++*$%-/1***5" ], [ 4017, "vjXSF!GA'wo~tNJ2lsouhusr!tPiDvjXSF2pyr{ht64++*$%-/1***5" ], [ 4078, "a\u0011\u0016zirhusr\u003c~Zey4]shFJRm0[HLVedY5\u003cg]shFJRm2o}jyHsZupy4[HL" ], [ 4079, "a\u0011\u0016zirhusr\u003c~Zey4]shFJRm0[HLVedY5\u003cg]shFJRm2o}jyHsZupy4[HL" ], [ 4140, "VedY0\u003c.5'a\u0011\u0016zirhusr\u003cr]rOkwh4N~^jq5\u003cgN~^jq2psoy45'a\u0011\u0016" ], [ 4141, "VedY0\u003c.5'a\u0011\u0016zirhusr\u003cr]rOkwh4N~^jq5\u003cgN~^jq2psoy45'a\u0011\u0016" ], [ 4199, "\u0016" ], [ 4200, "\u0016" ], [ 4449, "Scripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObje" ], [ 4450, "Scripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObjectScripting.FileSystemObje" ], [ 4611, ".j" ], [ 4612, ".j" ], [ 4616, "s" ], [ 4617, "s" ], [ 4691, "\\\\" ], [ 4696, "xHPfxZ" ], [ 4697, "xHPfxZ" ], [ 4705, "pTzpO" ], [ 4706, "pTzpO" ], [ 4805, "%" ], [ 4806, "%" ], [ 4809, "T" ], [ 4810, "T" ], [ 4813, "MP%" ], [ 4814, "MP%" ], [ 4833, "NJZSHJagIRLruvTxSECnfIBXRHEjFFKaUdcFmSeMjmylZEoMSwulKGCWlDOfcKgcEcYDKCMIccaFCPKPErRfLjEEkLxibfvBNGUoctOnbsiRSCwPRjdVlunTFgvXOpGN" ], [ 4834, "NJZSHJagIRLruvTxSECnfIBXRHEjFFKaUdcFmSeMjmylZEoMSwulKGCWlDOfcKgcEcYDKCMIccaFCPKPErRfLjEEkLxibfvBNGUoctOnbsiRSCwPRjdVlunTFgvXOpGN" ], [ 5007, "." ], [ 5008, "." ], [ 5023, "ip" ], [ 5024, "ip" ], [ 5039, "W" ], [ 5040, "W" ], [ 5043, "S" ], [ 5044, "S" ], [ 5047, "cr" ], [ 5048, "cr" ], [ 5075, "t" ], [ 5076, "t" ], [ 5088, "She" ], [ 5089, "She" ], [ 5094, "ll" ], [ 5095, "ll" ], [ 5163, "Scripting.FileSystemObject" ], [ 5164, "Scripting.FileSystemObject" ], [ 5331, "xHPfxZ" ], [ 5332, "xHPfxZ" ], [ 5340, "pTzpO" ], [ 5341, "pTzpO" ] ], "sz": 5674, "ts": [ { "c": 1.0, "d": "Creates a text file using FileSystemObject", "e": [ ".OpenTextFile" ], "i": "micro-behaviors/fs/write/text::create-text-file-api", "l": 3 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "from" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInNewContext--rx-9", "l": 1 }, { "c": 0.699999988079071, "d": "String.fromCharCode() assembly", "e": [ "String.fromCharCode(" ], "i": "micro-behaviors/data/encode/charcode::from-char-code", "l": 1 }, { "c": 0.30000001192092896, "d": "JavaScript Date object construction", "e": [ "new Date" ], "i": "micro-behaviors/time/query::js-new-date", "l": 2 }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (romChar)", "e": [ "romChar" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-romchar", "l": 1 }, { "c": 0.8500000238418579, "d": "FileSystemObject ProgID string", "e": [ "Scripting.FileSystemObject" ], "i": "micro-behaviors/os/com/object::filesystemobject-progid", "l": 3 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170324_b37b1f0515d8039249fb472ce670c80b.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "a": "T1059.005", "c": 0.800000011920929, "d": "WScript.CreateObject call", "e": [ "WScript.CreateObject(" ], "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-createobject-dup", "l": 3 }, { "c": 0.8399999737739563, "d": "Symbolic ExpandEnvironmentStrings method access", "e": [ "IyMiQIQQHujd.ExpandEnvironmentStrings" ], "i": "objectives/execution/interpreter/scripting/host::expandenv-symbol", "l": 3 }, { "c": 0.699999988079071, "d": "charCodeAt() method call", "e": [ ".charCodeAt(" ], "i": "micro-behaviors/data/encode/charcode::charcode-at", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 948.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (CharCode)", "e": [ "CharCode" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-charcode", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "ClickFix copy-paste action word", "e": [ "run" ], "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word", "l": 1, "m": "B0024" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "charCodeAt" ], "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-4", "l": 1, "m": "B0032" }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170324_b37b1f0515d8039249fb472ce670c80b.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.6000000238418579, "d": "FileSystemObject string reference", "e": [ "FileSystemObject" ], "i": "objectives/execution/interpreter/scripting/host::filesystem-object-string", "l": 3 }, { "c": 1.0, "d": "XOR bitwise operator in expression", "e": [ "JKNVrNaK^QWCTkt" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-xor", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 80.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\"znsq\u003cKur/.CLns" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 1.0, "d": "Writes to text file", "e": [ ".Write(" ], "i": "micro-behaviors/fs/write/text::write-text-file-method", "l": 2 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.800000011920929, "d": "Calls ExpandEnvironmentStrings", "e": [ "ExpandEnvironmentStrings" ], "i": "objectives/execution/interpreter/script/wsh::wsh-expand-env-strings-literal", "l": 3 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "from" ], "i": "micro-behaviors/process/interpreter/vm::vm-runInContext--rx-4", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "String.fromCharCode" ], "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-3", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.23" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Loop variable incremented by a variable step", "e": [ "sWhiQwl" ], "i": "micro-behaviors/data/control-flow/analysis::loop-variable-variable-step", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Massive string concatenation operations", "e": [ "+\r\n\"yhinr\u003cQ}ht2nsirx4[WiftJt4564~die1Qn^PXS57Qn^PXS5'" ], "i": "objectives/anti-static/obfuscation/string/array::massive-string-concatenation", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exact tiny WScript fragments (She, ll)", "e": [ "She", "ll" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-exact-2", "l": 4 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.800000011920929, "d": "ExpandEnvironmentStrings fragment (xpandE)", "e": [ "xpandE" ], "i": "objectives/execution/interpreter/script/wsh-fragments::expand-env-fragment-1", "l": 3 }, { "a": "T1027", "c": 0.6000000238418579, "d": "No comments in code", "e": [ "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "High string entropy indicating obfuscation", "e": [ "strings.high_entropy_count = 34.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/source::high-string-entropy-dup", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Massive string concatenation operations", "e": [ "+\r\n\"yhinr\u003cQ}ht2nsirx4[WiftJt4564~die1Qn^PXS57Qn^PXS5'" ], "i": "objectives/anti-static/obfuscation/string/array::suspicious-massive-string-concatenation", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "comments.total = 0.00", "text.whitespace_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" } ], "sha": "bc72fbf84e6da768d28924a0fc08d1cf4f8b5c07b4f4fde27423ba537fcc02af", "path": "20170324_b37b1f0515d8039249fb472ce670c80b.js", "type": "javascript" } ], "tv": "7f26a" } }