{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999599456787109, "class": 2 } ], "prob": 0.99995995, "class": 2, "models": [ { "m": "az", "prob": 0.9945726, "class": 2 }, { "m": "az/scripts", "prob": 0.99950826, "class": 2 }, { "m": "az/javascript", "prob": 0.99995995, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T19:20:05Z" }, "path": "20170117_8ee3104598a7285f26d7694fda5b325e.js", "raw": { "v": "4", "fs": [ { "f": "K₂O₇(AlAs₈Xe₂CCoErS₃)H₃(DbPo₃Cr)Md", "k": { "source.imports[0]": "adaxawynahoskomjoffyvibponukoxtuheqvidahhuchewykotgezxugubfahynuqytyzeqx", "source.imports[1]": "afjesarquzosrultegejavezofezwajdiwbumnuszedihpubbazxuhwasahnijepgabiwfogfywotomqofbug", "source.imports[2]": "afxemoxxosymudnuqamlardebnacvimyjdebe", "source.imports[3]": "agkazjylxezbyrnykilakakasdimk", "source.imports[4]": "ajebazaqihxonmokolappetqyrbecjebonibwyninkiqagwuwzohvikutsyqgebsivar", "source.imports[5]": "amokyqecaxojypynylboksejkevucwovedasagzobfoxugemazarexn", "source.imports[6]": "aqrychuxumjydyjesygylfyvotunegepcybcajup", "source.imports[7]": "arlovanoljivezenaloxsuqifnixymhekca", "source.imports[8]": "avjuhocabezosifxexzutcywegnoqqywgopelnymtorerozomadutulasbewyrnyvemidwibociltyny", "source.imports[9]": "avukavku8", "source.strings[0]": "}zkqnyj8%8C://6:E#", "source.has_imports": true, "source.imports[10]": "avydwicyxezsaryjezujmyxunywevocatemetiteculurevabyfbyvahjavodwycjoz", "source.imports[11]": "avypkygrudkatexgaczuctiber", "source.imports[12]": "avyvkemcecwyhobmyknebuchizgecujogimanobwiboqobogyhsujdyqjuvjuff", "source.imports[13]": "awigasucpucpyjgodimujxuvgyhacqykpunhevrycevoqduztanekvanbojhudbabyzosinobulmybywgegjosotoxh", "source.imports[14]": "axqabajjunnofasmyswanynqosusicdaqravboxatehevubpejultylogisuwudcacyrybdaxmimxiftumrumy", "source.imports[15]": "axyhalqytgocsitubbuphehjynagodcusolygsutijtabidykehjyspibigemxehapcagb", "source.imports[16]": "aznajkeha6", "source.imports[17]": "azxelsedotubuxoqcukyfhagzekyqacwixewumuxetjehlundospombahibuvtutibelbedruhhojseflofmumni", "source.imports[18]": "bbozobfucakmawsujysawowrirysdugtogse", "source.imports[19]": "bpilguhni", "source.imports[20]": "bqacijwugemqosahafjibzoqusebadiwulhoqykbytxubilarasfycruzepdodlukletivvokgadewry", "source.imports[21]": "byssotfaprycnuqhinalnezfyxqikqygosripdudjaspypcozevpoptemzypcugaxwapsydybunmit", "source.imports[22]": "bzaqeqifakqidiztebycnapdysbemembyketenonkixmiqhehitresecovvykotxolzegonyhoniwl", "source.imports[23]": "carufaxakzicusyndimfuqysoxsyraczecytsewukanotkojhuzubuguxogycgejuhnahkatdudmehowovmosomi", "source.imports[24]": "caseryxpetxuxbejqythozodulxopowcuwquwqepuwivaztis", "source.imports[25]": "cbyjtacidexkuhtaxduxututudidpareqolwotnuqqelyfohf", "source.imports[26]": "cyhis", "source.imports[27]": "dhenaminbibuxaccymjyrnutvubyjqicuwywozomudovhodxoty", "source.imports[28]": "dijacsuzankelryjxohferqysepijpyniszexavsowypnyggyqzaxolliryvopelezu", "source.imports[29]": "dlanlumwawincicralirunozumahpytulhyvxidxepbuqyhakduzguzfyzvusyzizfadcyqekeqapel", "source.imports[30]": "dlonhepaqfasygbupyskiffassaxecxebixizanag", "source.imports[31]": "dtabodlolluxzamapodozedamaffiwteqdohdurhuwfujyqipoxisojrizoqgabytzycnacuzbupqacaquwvesvuskum", "source.imports[32]": "dyseluzocfozfixsyrkavrernuwdocedkojserykonifowesbyfadfybhi", "source.imports[33]": "ecdewni7", "source.imports[34]": "efdylkejitiqakwonzurodyhaflemorjezejgosiganhopnizsahyqapixufleqefqigxawwafytakpygoruhdo", "source.imports[35]": "egbuqohp", "source.imports[36]": "egrypifewwafezxajzafwabbyxxehitjirqeqdolohylomik", "source.imports[37]": "ejmerovihfervozomuperrebuhkegomv", "source.imports[38]": "elopgubbijafuhxyjerfepobdokhihuqwynvasazzifurkuxhaqokbawyszecabog", "source.imports[39]": "enduhnuxmesgygdofxaruxeqsupajvuckoheksiqnojamugl", "source.imports[40]": "esanpylsupitnugdedokxackezuwselkadxesnypcolizoftuqrugde", "source.imports[41]": "evyvylyqedeniqyqkahekmulyjihunetohwisavbypehlamexqidowadaju", "source.imports[42]": "exjeqidwilacjenukbetrozhum", "source.imports[43]": "exsotodikoduxpepjesutdycqelunh", "source.imports[44]": "exujxecbetgykymcudylhupfofyjykaf", "source.imports[45]": "ezokjixubsebginubbyjanjyxkysamygagepyhydahr", "source.imports[46]": "fecgipozwimoqwegnogxetkacapofgyqyfxadyqivisethyplipuqedigocupzulogecfaro", "source.imports[47]": "fekuqvorakurutaswanefunzawomuqwazufowebigzuqj", "source.imports[48]": "fifexlyczekagdaneltongurbytveqjukcuhxylewylmafucowwufipimumaqlihvaxecizgossahote", "source.imports[49]": "ghihaxdusmagivxyfbagdabekokmogfegjyztoktykekhoqzekuwzyrery", "source.imports[50]": "gitzabarynukibelbackaqhacboburufmyxbo", "source.imports[51]": "gpimykvijzivtyvmoxbitriwaxnuwqaxanzorihzykubexhitdott", "source.imports[52]": "gynfuhyhpoparkijjogyhunsuxife", "source.imports[53]": "hkemmiqixyboxkipomdywofxelsejsuqadynidzecgutsaxbajvypermurkymycyvxicfihacarhesakkyvs", "source.imports[54]": "hotahvenzivloxelugkabuhkyligosomlasatokumegypwuhdelzolypuxicwokxyxsenfalz", "source.imports[55]": "hoxetkimusecorefyngusjavytufxedzecuszexgicekk", "source.imports[56]": "hquvennatigwasyjfopsekezxafwezpigukajunecapijkogunicyjnysxagogruggeqrykcigmotduvogwadtuzbyrpixirs", "source.imports[57]": "ibattagosxuvsazacedotyvzotjynihlogjajekjywbenduxovujpedfyhemcebrubodkozysw", "source.imports[58]": "ibuwdekowfyzequftismuvewasexommasyvqetzessipultozupocqyqkopipojkexy", "source.imports[59]": "ictydjinivfewatixolifvaxwubdeqomrapcamodyppyroninitampokcolfahbipgevofsizduqjerigtal", "source.imports[60]": "idedivijgapukiwacolavoxwujysqeslovydtyw", "source.imports[61]": "igygyjsexl08", "source.imports[62]": "ijxaxidaqnawebquxednatidlyjimm", "source.imports[63]": "ikniro3", "source.imports[64]": "iltopxedlakumoprujmafsehrimwukxedohatrohvyvecutagybkyvachycpiwgocudowodpozot", "source.imports[65]": "ilxovahzagospugaqvibycemhidmilorfetyzapxizlysy", "source.imports[66]": "imgypozjipipelovusebpekukdeqgehuriwtapwacarebbido", "source.imports[67]": "inakhitubyvenycuzadeftyxvahectazvekamtyvafzuwlymdydcibigsijyfehwap", "source.imports[68]": "ingejesexpynehymxorhyqhonyvdykvosrictygvomtulyni", "source.imports[69]": "ipecmulygpylibvihhopwohvesenmilojwitlokyzyvkogyxfirydmykedujcucnuxka", "source.imports[70]": "ivlyducbyjekossickyxqidynyrsesgupedywixusodcyhivdoxisibvazzewaq", "source.imports[71]": "iwsepwasirtybkynukxexelafisez", "source.imports[72]": "jactemaqakuwijhoznefcikilfaqfagabgowynvobicumgokqovobocvisegahfagyseqpepawcefcevqutixofpu", "source.imports[73]": "jcepgubokymogacizoxhazlodevelmyp", "source.imports[74]": "jentajrixorlolsigbombahixveqqoxnogcamvebertubzawwymmikyza", "source.imports[75]": "jetkirjasoknabyjehkyzohveguxbattujykwubsyrijafludufuxobypejwyvifsake", "source.imports[76]": "jguxewufoxesxodtusvujirqunyluphymulinelxuzaxsetsodhingebimorp", "source.imports[77]": "jokmysnyqkeqsoqocakijlecdacserweduwleboftyshaxfasdosjykzuwejewkuckajylypojvygyjupamydryrzyhhivyful", "source.imports[78]": "joljaricixiwizefyfublucokracemezelryccuhijvuxlidogurzohnalvanfufcusrizijrikkoraqirbitlafzojt", "source.imports[79]": "kaqterbysitbyropypzaqazaqylojyrurtejefgijolvuxkityctopmitucrufystanpizru", "source.imports[80]": "kydanyzeljetiwxaxukbekumutivemutcotiwuqurabsunwebd", "source.imports[81]": "lejximzolaxlovejquzgidsamiwywnyruciwogexgavewogwiriprewijhimolutoxnasx", "source.imports[82]": "ljezikatatugirilekrynovvagjaq", "source.imports[83]": "mace3", "source.imports[84]": "mhuqacypdoxbefodtedjuvodhykju", "source.imports[85]": "mycogadzufafguhifkamyrlympasnyhfyzatjyxabhagsipypqimaraqcekejgenesawpudjavemfegoqtabjeqsemd", "source.imports[86]": "mytvubuxha", "source.imports[87]": "nafegugtumwymhezehywpudujanvepdizelpepmuknugxajkyxuqebijiwnibelukymvetjurkyl", "source.imports[88]": "ngyjyknavyxurbihtywqupvergafnavydysodexetyliqevlezivixhovtufupotytpykikjedrezytro", "source.imports[89]": "odevatvezinfapazowrupzidryrputbitawizqygveryburokewbygopopmidsitataxubdazbugivxolanvepjikide", "source.imports[90]": "odzymkixfyclupezfufdequkvuqadcuzelazjonjylcusipafjokikqyqsujtipfazfiqy", "source.imports[91]": "ogelxazijwutceqojibvadrebyxcamverusakosatypyvitavahzarxubyrkirgovorylyganaduwe", "source.imports[92]": "okexunxyhvilfovoxixruxkeqojegduzdijadradytorbaqtezzeruvedehakalyhpupitisolihokzuzcafiwtofdaxirc", "source.imports[93]": "okilgelenamsyrohmilpuwihyrafopcupixawkafozsufaguqxameptirpezkyxurowsymilpytxokf", "source.imports[94]": "okzajheqihotimibilirygofqoxzoltubojajcinufsagyvpanremcaqornazne", "source.imports[95]": "onlyfymuzutewokywicpydu", "source.imports[96]": "opkyvaxilapzyjlorevluthiqellyvavxivgatazqukiqugzaldafydexlygaguqcerxiwnoruvnosmyla", "source.imports[97]": "orbunuvzelhypluruboqkewbisxishigwetulugysocwowcyzjaqpomwyrimmyromsyrupixinb", "source.imports[98]": "oziwyrsodabgelugzikufdidybtenwazqowysluwzavgurykyrqircisopezcocpivgadhyfopbinqityryfsogm", "source.imports[99]": "pedkifbihxenyvefazokboqwegsusabajokiqotnawdesamjitezekoqwemuhh", "source.imports[100]": "pgumruzlidlergaluhoswetuqlahoryvladintebvirqakovucethisnywnivfupmepugwi", "source.imports[101]": "pjaxvihbyhaparaqcohuvjiqinjipixragaxapgimehnefrozbultivuxacyhluqqat", "source.imports[102]": "pjojolawuzwegtesqeryvvidamqaspujupoktel", "source.imports[103]": "povxixkewapbormocyhfybaqynliturtivammonmo", "source.imports[104]": "pysujirxiwyfunlurehwaxoke", "source.imports[105]": "qbuwlupixpogwivqysqevwompolywopmafimeddisqumjexwiwolawhypyvvogmugginjisyhalvotre", "source.imports[106]": "qedfyqozomikfarupvyhsikqevelwiluvnepijxexarobdexpimuwnuczuklyrasihlytijytqifgifappy", "source.imports[107]": "qhilvuxhutmevzykjufladytdepahyczeghigepwojpymuqyfbyzizsabigovnivcipafakavakcege", "source.imports[108]": "qikarlet9", "source.imports[109]": "rdilygangakhovucalipselipwocsixnivyqqyrfevu", "source.imports[110]": "rofugovespudalalixewynorjuvdubivvufdynlyqaqifbotmegjyxsorsukhasocexmuzojmelxomafwidlucgybyvjuha", "source.imports[111]": "rxixofnawupwohnijposehcilozanelwesxymevvinqushawabigcakahzyfsofmohjojrivinpyrkur", "source.imports[112]": "ryqijygifvizzifoniqemilqorwoda", "source.imports[113]": "sbigwotabacopofqenkyhizitsivegeqkazofhevocvivyqqimqixxebiqiwosatybtuklewynwufsejogfihwusunre", "source.imports[114]": "scomotzodaxkinkedgipakumkaxvultaqzypivabkynxysitkocnapnimnazxyzhithobavkimyjotahehatadregi", "source.imports[115]": "sikboxregeqjicsuwunnemsohxupsotwamlanutrifyzligqi", "source.imports[116]": "sozzahqylhebsikdewnukuqofmuzaxb", "source.imports[117]": "spattifimehanipydjunokkihhiqnazigitwetucoqfupgonwikokyqlihubpecahsuzhuffoswynpaxismiqlyrunofekve", "source.imports[118]": "suvvocozfaqizarduvenawyqroduxrybigiddupnacfybtolrukuhwukzeckozfygcycovbidwidjorqasmellorowurmydypyw", "source.imports[119]": "svupanmu", "source.imports[120]": "swatocesusirahuginusqumuhlariluvxikso", "source.imports[121]": "tawobmehefebtidilzatkafgesyganernejrubiznixputy", "source.imports[122]": "tjemenlyxyjfossyzypalugbymcengefyjpojohlynxeqinyqhunarxinavodzinlecrartemlibdidyhuwykuvberjo", "source.imports[123]": "tpuguzqatolwosdytujinhuvobebxarocnogsunovw", "source.imports[124]": "tramdirepjecubrigxefexfogharexahkodevobolsyrahhaqurroxyhd", "source.imports[125]": "ubhupjowisladymgofufqikaqwefubatoguberikfyrjiwboguqvyqpahlyxoqwavuglocuworohcajotl", "source.imports[126]": "ubryqibxipilbyjenihogazbohdifepwajajisyfgomomokxudxanwyfxajqepifsywlitkemhotiposajiwtenelpekqednih", "source.imports[127]": "ucezsyrtajjeqxirbujwupyzbezxupmyteqwotelyjowminropidynofesizivxyluwqihwafgotaxl", "source.imports[128]": "ucniposaquhxuhutlunhojhutekudsomhabetcoxafquwkypjawamy", "source.imports[129]": "ugapsuvorrermiglyvcevaqguzhopjezyspamilziglixyrtohfolborevlizuketosqeluryhkusnajpyntucfuxlitu", "source.imports[130]": "uglexdeniguqneluvoknazuffaddaqiwferodlezfefizafbifovbegqahzyfxugappohsobteqky", "source.imports[131]": "ugqupxihripbamofeqqocbusbozakyckekhaxnakuwhydvojalikaskaqenusanzaw", "source.imports[132]": "uhmidunwo", "source.imports[133]": "ujnyloheqyqojlubitugubnyllypgewamuvazfexydpicimwolymsufkynurwetdupyboxfebysrubqyjxegyjoxizcogzexy", "source.imports[134]": "ujygagedsaxsumolvutykbujrysdurxospizxekcovigibtojkahuxinzixohormerqykqozr", "source.imports[135]": "uklartoqeseffeczepvepvatiwhitpewbegmypykipelgaqyxisbaxcahmocolbyfukybvuhn", "source.imports[136]": "ulisuditvanhazirahukvucamvextipm", "source.imports[137]": "umokfyjpadrajxygipjaviqvakikyxcotudpyvelqylkefepuzsavrykx", "source.imports[138]": "unixivloxyxoqufytewucnaxgoweltofolfojlosulkamryffowanibegtifbu", "source.imports[139]": "upibhywzevjenwytkokavpyrlymegamutyjworybkugjobzumyrxuqyqpe", "source.imports[140]": "upqawbydafzofompijelemxapemgukupuqwokamlywb", "source.imports[141]": "uqhezyqejotohygnujuwoqpewpybmyvopawbinewyslibuwepemmivxatawpamyfkikahjuqjerepjekazelapicw", "source.imports[142]": "uquwywighigloroxowassexwesepqowzulicyzovqujxatimqehudtofahagnudimjucbe", "source.imports[143]": "usavxowijynefomdybzixukogisufacehmyfmyhytepidomtitocowywtaserkikyvamowsowokohiksojhyhkugvulpo", "source.imports[144]": "usfilcuvyjmidposnejufoxicyncixmoxycovgejoqtisyvyjbixyfwuxitovyrnuqovitufycvaqmypqommy", "source.imports[145]": "usudbujpowruhdiztoxtamitdugsicbixapkakyztuvterakucgihyfatitunugpuwyxfasfykape", "source.imports[146]": "uxrapugqaqxigxexisospahuxunosgawzagcyzirbeqewcovzizabsowexe", "source.imports[147]": "uxynjycibisyqnujovhaqebawuvufupaluxmedakabecmu", "source.imports[148]": "uzlujedyqmimtyzpysilzithuzehhubilhadarakiviremmubbafcamjylzubenhitbenreselimetcoci", "source.imports[149]": "vegejomdomobjefgunhegacihsejcaqidbyjiphopuvywjubakfytkultihbiplaxyvypcowbuwpemriltyjlevafytomamyko", "source.imports[150]": "vlicxisizavqibtojakikefretdewnaspozetuculatjibqotwuktikajeczeruskivelygvofkesicrirojecremixidezlasy", "source.imports[151]": "vnujoxhodkumeqabeppuqombukhip", "source.imports[152]": "vymqejekyhutgeqepeqgamzomfemqymzawyfakiqzedvejenqegasdazwizilbahacjorehlypte", "source.imports[153]": "wexzoqahciwusyhubonulrogmunjypyrvunqylkypijtinqilyhjafuwonpixgy", "source.imports[154]": "winvotmagemutepjocitexaprinerkypjudxoggynetixapmurichoqkehzifhumwixkyzkecudziqtacapgaxolitissats", "source.imports[155]": "wjypsablerecumegjydaranjuxovodsecinumajbugigybcoglepxazlagjyzisufa", "source.imports[156]": "wlupzafegnycrunyrmunicxusjalpyddetkosfovafobosebjuwozuznycpuvpushe", "source.imports[157]": "xfezalkydqahehudumbiqfijryrocnedilosewcicuragkiralcehjatonxuzebcycpyxa", "source.imports[158]": "xuzaxibeqavtepwulfojiqisjyhijoxrellehargepufaxixsebyxnuxgynzugytuxuvetyvxovanamyluqulijfikyhp", "source.imports[159]": "xxileziqabesixupsawovluxxecegvuvzokziqaskugozhomtykdirehugewh", "source.imports[160]": "xygudutiwyrfokaxzujyzzobtuxorzyxvemoqnijvymyc", "source.imports[161]": "ycbemhobjusbyqwalkolfakylxykhojybowetlotefikudedfesopqurokibqotuxfojsywepxonegyqjoxhycs", "source.imports[162]": "ycubodaqrijugzigimjidporjoxxutlomyjfujbamihqehzerfudotsepqyjemizgancyjtepofmetbixydgedgyv", "source.imports[163]": "ymsunuh5", "source.imports[164]": "ynefbykqykorykepawigefhadecesbeqepparsypkeqvazlavapyvyfuswipefubebeleglyjkomucnyzl", "source.imports[165]": "yqycjanicacvarsycucovochykgyshykvyvupsepjujojqamikyquzqumobirykcywjonbekdaxapwemewovh", "source.imports[166]": "zansybqoksovahowaqymawbynu", "source.imports[167]": "zbemexowewifgakaswymhihimyxwisrebhukymmikarnybligkyhpegk", "source.imports[168]": "zedi1", "source.imports[169]": "zetyhdyjqapuquznumtazpitvupzumdentelbopi", "source.imports[170]": "zkicislirijazvosozupumuxcurobnixuwsibagasridfogiwywijiwegtyvaqyduhimykwuketkihudbumeqiwrifi", "source.imports[171]": "zojylopavxecpubysufresecrocarcibtokekadyjolhaju", "source.imports[172]": "zrakosgapemojdysufitmilbolgilizo" }, "x": 106, "id": 0, "is": [ "sikboxregeqjicsuwunnemsohxupsotwamlanutrifyzligqi", "avyvkemcecwyhobmyknebuchizgecujogimanobwiboqobogyhsujdyqjuvjuff", "afxemoxxosymudnuqamlardebnacvimyjdebe", "nafegugtumwymhezehywpudujanvepdizelpepmuknugxajkyxuqebijiwnibelukymvetjurkyl", "kaqterbysitbyropypzaqazaqylojyrurtejefgijolvuxkityctopmitucrufystanpizru", "ezokjixubsebginubbyjanjyxkysamygagepyhydahr", "pgumruzlidlergaluhoswetuqlahoryvladintebvirqakovucethisnywnivfupmepugwi", "jokmysnyqkeqsoqocakijlecdacserweduwleboftyshaxfasdosjykzuwejewkuckajylypojvygyjupamydryrzyhhivyful", "xygudutiwyrfokaxzujyzzobtuxorzyxvemoqnijvymyc", "ujygagedsaxsumolvutykbujrysdurxospizxekcovigibtojkahuxinzixohormerqykqozr", "povxixkewapbormocyhfybaqynliturtivammonmo", "jentajrixorlolsigbombahixveqqoxnogcamvebertubzawwymmikyza", "inakhitubyvenycuzadeftyxvahectazvekamtyvafzuwlymdydcibigsijyfehwap", "wjypsablerecumegjydaranjuxovodsecinumajbugigybcoglepxazlagjyzisufa", "sozzahqylhebsikdewnukuqofmuzaxb", "exujxecbetgykymcudylhupfofyjykaf", "vlicxisizavqibtojakikefretdewnaspozetuculatjibqotwuktikajeczeruskivelygvofkesicrirojecremixidezlasy", "ibattagosxuvsazacedotyvzotjynihlogjajekjywbenduxovujpedfyhemcebrubodkozysw", "exsotodikoduxpepjesutdycqelunh", "dlonhepaqfasygbupyskiffassaxecxebixizanag", "ycbemhobjusbyqwalkolfakylxykhojybowetlotefikudedfesopqurokibqotuxfojsywepxonegyqjoxhycs", "efdylkejitiqakwonzurodyhaflemorjezejgosiganhopnizsahyqapixufleqefqigxawwafytakpygoruhdo", "pjojolawuzwegtesqeryvvidamqaspujupoktel", "uquwywighigloroxowassexwesepqowzulicyzovqujxatimqehudtofahagnudimjucbe", "ivlyducbyjekossickyxqidynyrsesgupedywixusodcyhivdoxisibvazzewaq", "vegejomdomobjefgunhegacihsejcaqidbyjiphopuvywjubakfytkultihbiplaxyvypcowbuwpemriltyjlevafytomamyko", "fekuqvorakurutaswanefunzawomuqwazufowebigzuqj", "avypkygrudkatexgaczuctiber", "unixivloxyxoqufytewucnaxgoweltofolfojlosulkamryffowanibegtifbu", "usudbujpowruhdiztoxtamitdugsicbixapkakyztuvterakucgihyfatitunugpuwyxfasfykape", "qedfyqozomikfarupvyhsikqevelwiluvnepijxexarobdexpimuwnuczuklyrasihlytijytqifgifappy", "dlanlumwawincicralirunozumahpytulhyvxidxepbuqyhakduzguzfyzvusyzizfadcyqekeqapel", "byssotfaprycnuqhinalnezfyxqikqygosripdudjaspypcozevpoptemzypcugaxwapsydybunmit", "zbemexowewifgakaswymhihimyxwisrebhukymmikarnybligkyhpegk", "umokfyjpadrajxygipjaviqvakikyxcotudpyvelqylkefepuzsavrykx", "arlovanoljivezenaloxsuqifnixymhekca", "cbyjtacidexkuhtaxduxututudidpareqolwotnuqqelyfohf", "pjaxvihbyhaparaqcohuvjiqinjipixragaxapgimehnefrozbultivuxacyhluqqat", "wexzoqahciwusyhubonulrogmunjypyrvunqylkypijtinqilyhjafuwonpixgy", "pysujirxiwyfunlurehwaxoke", "zrakosgapemojdysufitmilbolgilizo", "usavxowijynefomdybzixukogisufacehmyfmyhytepidomtitocowywtaserkikyvamowsowokohiksojhyhkugvulpo", "ibuwdekowfyzequftismuvewasexommasyvqetzessipultozupocqyqkopipojkexy", "ipecmulygpylibvihhopwohvesenmilojwitlokyzyvkogyxfirydmykedujcucnuxka", "egrypifewwafezxajzafwabbyxxehitjirqeqdolohylomik", "gynfuhyhpoparkijjogyhunsuxife", "bzaqeqifakqidiztebycnapdysbemembyketenonkixmiqhehitresecovvykotxolzegonyhoniwl", "joljaricixiwizefyfublucokracemezelryccuhijvuxlidogurzohnalvanfufcusrizijrikkoraqirbitlafzojt", "ubryqibxipilbyjenihogazbohdifepwajajisyfgomomokxudxanwyfxajqepifsywlitkemhotiposajiwtenelpekqednih", "ejmerovihfervozomuperrebuhkegomv", "gpimykvijzivtyvmoxbitriwaxnuwqaxanzorihzykubexhitdott", "hquvennatigwasyjfopsekezxafwezpigukajunecapijkogunicyjnysxagogruggeqrykcigmotduvogwadtuzbyrpixirs", "sbigwotabacopofqenkyhizitsivegeqkazofhevocvivyqqimqixxebiqiwosatybtuklewynwufsejogfihwusunre", "egbuqohp", "winvotmagemutepjocitexaprinerkypjudxoggynetixapmurichoqkehzifhumwixkyzkecudziqtacapgaxolitissats", "kydanyzeljetiwxaxukbekumutivemutcotiwuqurabsunwebd", "vnujoxhodkumeqabeppuqombukhip", "suvvocozfaqizarduvenawyqroduxrybigiddupnacfybtolrukuhwukzeckozfygcycovbidwidjorqasmellorowurmydypyw", "zkicislirijazvosozupumuxcurobnixuwsibagasridfogiwywijiwegtyvaqyduhimykwuketkihudbumeqiwrifi", "agkazjylxezbyrnykilakakasdimk", "ijxaxidaqnawebquxednatidlyjimm", "swatocesusirahuginusqumuhlariluvxikso", "ugapsuvorrermiglyvcevaqguzhopjezyspamilziglixyrtohfolborevlizuketosqeluryhkusnajpyntucfuxlitu", "jguxewufoxesxodtusvujirqunyluphymulinelxuzaxsetsodhingebimorp", "dtabodlolluxzamapodozedamaffiwteqdohdurhuwfujyqipoxisojrizoqgabytzycnacuzbupqacaquwvesvuskum", "dyseluzocfozfixsyrkavrernuwdocedkojserykonifowesbyfadfybhi", "zetyhdyjqapuquznumtazpitvupzumdentelbopi", "awigasucpucpyjgodimujxuvgyhacqykpunhevrycevoqduztanekvanbojhudbabyzosinobulmybywgegjosotoxh", "carufaxakzicusyndimfuqysoxsyraczecytsewukanotkojhuzubuguxogycgejuhnahkatdudmehowovmosomi", "okilgelenamsyrohmilpuwihyrafopcupixawkafozsufaguqxameptirpezkyxurowsymilpytxokf", "tjemenlyxyjfossyzypalugbymcengefyjpojohlynxeqinyqhunarxinavodzinlecrartemlibdidyhuwykuvberjo", "ucezsyrtajjeqxirbujwupyzbezxupmyteqwotelyjowminropidynofesizivxyluwqihwafgotaxl", "vymqejekyhutgeqepeqgamzomfemqymzawyfakiqzedvejenqegasdazwizilbahacjorehlypte", "lejximzolaxlovejquzgidsamiwywnyruciwogexgavewogwiriprewijhimolutoxnasx", "onlyfymuzutewokywicpydu", "avjuhocabezosifxexzutcywegnoqqywgopelnymtorerozomadutulasbewyrnyvemidwibociltyny", "ucniposaquhxuhutlunhojhutekudsomhabetcoxafquwkypjawamy", "orbunuvzelhypluruboqkewbisxishigwetulugysocwowcyzjaqpomwyrimmyromsyrupixinb", "ubhupjowisladymgofufqikaqwefubatoguberikfyrjiwboguqvyqpahlyxoqwavuglocuworohcajotl", "ljezikatatugirilekrynovvagjaq", "dhenaminbibuxaccymjyrnutvubyjqicuwywozomudovhodxoty", "dijacsuzankelryjxohferqysepijpyniszexavsowypnyggyqzaxolliryvopelezu", "ngyjyknavyxurbihtywqupvergafnavydysodexetyliqevlezivixhovtufupotytpykikjedrezytro", "caseryxpetxuxbejqythozodulxopowcuwquwqepuwivaztis", "iwsepwasirtybkynukxexelafisez", "pedkifbihxenyvefazokboqwegsusabajokiqotnawdesamjitezekoqwemuhh", "bbozobfucakmawsujysawowrirysdugtogse", "uqhezyqejotohygnujuwoqpewpybmyvopawbinewyslibuwepemmivxatawpamyfkikahjuqjerepjekazelapicw", "ajebazaqihxonmokolappetqyrbecjebonibwyninkiqagwuwzohvikutsyqgebsivar", "exjeqidwilacjenukbetrozhum", "esanpylsupitnugdedokxackezuwselkadxesnypcolizoftuqrugde", "qhilvuxhutmevzykjufladytdepahyczeghigepwojpymuqyfbyzizsabigovnivcipafakavakcege", "ilxovahzagospugaqvibycemhidmilorfetyzapxizlysy", "axqabajjunnofasmyswanynqosusicdaqravboxatehevubpejultylogisuwudcacyrybdaxmimxiftumrumy", "ingejesexpynehymxorhyqhonyvdykvosrictygvomtulyni", "upqawbydafzofompijelemxapemgukupuqwokamlywb", "ycubodaqrijugzigimjidporjoxxutlomyjfujbamihqehzerfudotsepqyjemizgancyjtepofmetbixydgedgyv", "amokyqecaxojypynylboksejkevucwovedasagzobfoxugemazarexn", "ulisuditvanhazirahukvucamvextipm", "uklartoqeseffeczepvepvatiwhitpewbegmypykipelgaqyxisbaxcahmocolbyfukybvuhn", "afjesarquzosrultegejavezofezwajdiwbumnuszedihpubbazxuhwasahnijepgabiwfogfywotomqofbug", "okexunxyhvilfovoxixruxkeqojegduzdijadradytorbaqtezzeruvedehakalyhpupitisolihokzuzcafiwtofdaxirc", "azxelsedotubuxoqcukyfhagzekyqacwixewumuxetjehlundospombahibuvtutibelbedruhhojseflofmumni", "wlupzafegnycrunyrmunicxusjalpyddetkosfovafobosebjuwozuznycpuvpushe", "uglexdeniguqneluvoknazuffaddaqiwferodlezfefizafbifovbegqahzyfxugappohsobteqky", "fecgipozwimoqwegnogxetkacapofgyqyfxadyqivisethyplipuqedigocupzulogecfaro", "idedivijgapukiwacolavoxwujysqeslovydtyw", "ghihaxdusmagivxyfbagdabekokmogfegjyztoktykekhoqzekuwzyrery", "xfezalkydqahehudumbiqfijryrocnedilosewcicuragkiralcehjatonxuzebcycpyxa", "rdilygangakhovucalipselipwocsixnivyqqyrfevu", "uzlujedyqmimtyzpysilzithuzehhubilhadarakiviremmubbafcamjylzubenhitbenreselimetcoci", "zansybqoksovahowaqymawbynu", "qbuwlupixpogwivqysqevwompolywopmafimeddisqumjexwiwolawhypyvvogmugginjisyhalvotre", "ryqijygifvizzifoniqemilqorwoda", "upibhywzevjenwytkokavpyrlymegamutyjworybkugjobzumyrxuqyqpe", "tpuguzqatolwosdytujinhuvobebxarocnogsunovw", "tawobmehefebtidilzatkafgesyganernejrubiznixputy", "evyvylyqedeniqyqkahekmulyjihunetohwisavbypehlamexqidowadaju", "adaxawynahoskomjoffyvibponukoxtuheqvidahhuchewykotgezxugubfahynuqytyzeqx", "gitzabarynukibelbackaqhacboburufmyxbo", "iltopxedlakumoprujmafsehrimwukxedohatrohvyvecutagybkyvachycpiwgocudowodpozot", "spattifimehanipydjunokkihhiqnazigitwetucoqfupgonwikokyqlihubpecahsuzhuffoswynpaxismiqlyrunofekve", "imgypozjipipelovusebpekukdeqgehuriwtapwacarebbido", "uxynjycibisyqnujovhaqebawuvufupaluxmedakabecmu", "ogelxazijwutceqojibvadrebyxcamverusakosatypyvitavahzarxubyrkirgovorylyganaduwe", "oziwyrsodabgelugzikufdidybtenwazqowysluwzavgurykyrqircisopezcocpivgadhyfopbinqityryfsogm", "ugqupxihripbamofeqqocbusbozakyckekhaxnakuwhydvojalikaskaqenusanzaw", "jactemaqakuwijhoznefcikilfaqfagabgowynvobicumgokqovobocvisegahfagyseqpepawcefcevqutixofpu", "enduhnuxmesgygdofxaruxeqsupajvuckoheksiqnojamugl", "zojylopavxecpubysufresecrocarcibtokekadyjolhaju", "hotahvenzivloxelugkabuhkyligosomlasatokumegypwuhdelzolypuxicwokxyxsenfalz", "ictydjinivfewatixolifvaxwubdeqomrapcamodyppyroninitampokcolfahbipgevofsizduqjerigtal", "fifexlyczekagdaneltongurbytveqjukcuhxylewylmafucowwufipimumaqlihvaxecizgossahote", "usfilcuvyjmidposnejufoxicyncixmoxycovgejoqtisyvyjbixyfwuxitovyrnuqovitufycvaqmypqommy", "mycogadzufafguhifkamyrlympasnyhfyzatjyxabhagsipypqimaraqcekejgenesawpudjavemfegoqtabjeqsemd", "mhuqacypdoxbefodtedjuvodhykju", "hoxetkimusecorefyngusjavytufxedzecuszexgicekk", "odzymkixfyclupezfufdequkvuqadcuzelazjonjylcusipafjokikqyqsujtipfazfiqy", "axyhalqytgocsitubbuphehjynagodcusolygsutijtabidykehjyspibigemxehapcagb", "bqacijwugemqosahafjibzoqusebadiwulhoqykbytxubilarasfycruzepdodlukletivvokgadewry", "uxrapugqaqxigxexisospahuxunosgawzagcyzirbeqewcovzizabsowexe", "ynefbykqykorykepawigefhadecesbeqepparsypkeqvazlavapyvyfuswipefubebeleglyjkomucnyzl", "xuzaxibeqavtepwulfojiqisjyhijoxrellehargepufaxixsebyxnuxgynzugytuxuvetyvxovanamyluqulijfikyhp", "yqycjanicacvarsycucovochykgyshykvyvupsepjujojqamikyquzqumobirykcywjonbekdaxapwemewovh", "aqrychuxumjydyjesygylfyvotunegepcybcajup", "xxileziqabesixupsawovluxxecegvuvzokziqaskugozhomtykdirehugewh", "rxixofnawupwohnijposehcilozanelwesxymevvinqushawabigcakahzyfsofmohjojrivinpyrkur", "opkyvaxilapzyjlorevluthiqellyvavxivgatazqukiqugzaldafydexlygaguqcerxiwnoruvnosmyla", "ujnyloheqyqojlubitugubnyllypgewamuvazfexydpicimwolymsufkynurwetdupyboxfebysrubqyjxegyjoxizcogzexy", "jetkirjasoknabyjehkyzohveguxbattujykwubsyrijafludufuxobypejwyvifsake", "okzajheqihotimibilirygofqoxzoltubojajcinufsagyvpanremcaqornazne", "elopgubbijafuhxyjerfepobdokhihuqwynvasazzifurkuxhaqokbawyszecabog", "scomotzodaxkinkedgipakumkaxvultaqzypivabkynxysitkocnapnimnazxyzhithobavkimyjotahehatadregi", "rofugovespudalalixewynorjuvdubivvufdynlyqaqifbotmegjyxsorsukhasocexmuzojmelxomafwidlucgybyvjuha", "tramdirepjecubrigxefexfogharexahkodevobolsyrahhaqurroxyhd", "odevatvezinfapazowrupzidryrputbitawizqygveryburokewbygopopmidsitataxubdazbugivxolanvepjikide", "hkemmiqixyboxkipomdywofxelsejsuqadynidzecgutsaxbajvypermurkymycyvxicfihacarhesakkyvs", "jcepgubokymogacizoxhazlodevelmyp", "avydwicyxezsaryjezujmyxunywevocatemetiteculurevabyfbyvahjavodwycjoz", "aznajkeha6", "igygyjsexl08", "mytvubuxha", "svupanmu", "ymsunuh5", "bpilguhni", "ecdewni7", "avukavku8", "ikniro3", "zedi1", "qikarlet9", "mace3", "uhmidunwo", "cyhis" ], "ms": { "file": { "size": 25824.0 }, "text": { "tab_count": 29.0, "digit_ratio": 0.02, "space_count": 988.0, "total_lines": 191.0, "char_entropy": 5.08, "unique_chars": 73.0, "import_density": 90.58, "lines_over_200": 17.0, "lines_over_500": 7.0, "string_density": 1.68, "avg_line_length": 134.21, "lines_over_1000": 2.0, "max_line_length": 2126.0, "last_line_length": 3.0, "long_token_count": 17.0, "most_common_char": "a", "whitespace_ratio": 0.05, "most_common_ratio": 0.06, "identifier_density": 1.76, "line_length_stddev": 214.98, "normalized_import_count": 12.52, "normalized_string_count": 23.23, "suspicious_comment_ratio": 0.67, "max_inline_whitespace_run": 1.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 23.49 }, "imports": { "total": 173.0, "unique_modules": 173.0, "third_party_count": 173.0, "third_party_ratio": 1.0 }, "strings": { "total": 321.0, "avg_length": 2.16, "max_length": 4.0, "path_count": 6.0, "avg_entropy": 1.01, "total_bytes": 692.0, "entropy_stddev": 0.4 }, "comments": { "chars": 2340.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.02, "high_entropy_comments": 2.0 }, "functions": {}, "identifiers": { "total": 337.0, "avg_length": 59.7, "max_length": 102.0, "min_length": 5.0, "avg_entropy": 4.1, "reuse_ratio": 0.53, "unique_count": 178.0, "length_stddev": 26.83, "has_digit_ratio": 0.05, "high_entropy_count": 161.0, "high_entropy_ratio": 0.9, "all_lowercase_ratio": 0.94, "numeric_suffix_count": 9.0, "keyboard_pattern_names": 1.0 } }, "ss": [ [ 57, "en" ], [ 58, "en" ], [ 135, "WSc" ], [ 136, "WSc" ], [ 192, "op" ], [ 193, "op" ], [ 283, "ws" ], [ 284, "ws" ], [ 370, "lde" ], [ 371, "lde" ], [ 437, "re" ], [ 438, "re" ], [ 523, "\\\\\\\\" ], [ 646, "e " ], [ 647, "e " ], [ 706, "ct" ], [ 707, "ct" ], [ 801, "je" ], [ 802, "je" ], [ 870, "nu" ], [ 871, "nu" ], [ 947, "on" ], [ 948, "on" ], [ 1028, "e" ], [ 1029, "e" ], [ 1108, "s" ], [ 1109, "s" ], [ 1161, "Ope" ], [ 1162, "Ope" ], [ 1214, "ri" ], [ 1215, "ri" ], [ 1328, "tr" ], [ 1329, "tr" ], [ 1421, "htt" ], [ 1422, "htt" ], [ 1475, "d." ], [ 1476, "d." ], [ 1536, "g." ], [ 1537, "g." ], [ 1638, "GE" ], [ 1639, "GE" ], [ 1749, "ct" ], [ 1750, "ct" ], [ 1803, "Pos" ], [ 1804, "Pos" ], [ 1898, "do" ], [ 1899, "do" ], [ 1984, "rn" ], [ 1985, "rn" ], [ 2097, "sp" ], [ 2098, "sp" ], [ 2170, "se" ], [ 2171, "se" ], [ 2215, "ys" ], [ 2216, "ys" ], [ 2305, "er" ], [ 2306, "er" ], [ 2397, "rip" ], [ 2398, "rip" ], [ 2496, "\\\\S" ], [ 2499, "S" ], [ 2600, "C:" ], [ 2601, "C:" ], [ 2701, "je" ], [ 2702, "je" ], [ 2772, "le" ], [ 2773, "le" ], [ 2861, "MSX" ], [ 2862, "MSX" ], [ 2912, "me" ], [ 2913, "me" ], [ 2981, "n" ], [ 2982, "n" ], [ 3071, "cm" ], [ 3072, "cm" ], [ 3158, "ct" ], [ 3159, "ct" ], [ 3207, "it" ], [ 3208, "it" ], [ 3254, "cia" ], [ 3255, "cia" ], [ 3368, "Sy" ], [ 3369, "Sy" ], [ 3454, "pNa" ], [ 3455, "pNa" ], [ 3543, "Fil" ], [ 3544, "Fil" ], [ 3607, "Get" ], [ 3608, "Get" ], [ 3660, "p:/" ], [ 3661, "p:/" ], [ 3759, "hel" ], [ 3760, "hel" ], [ 3876, " A" ], [ 3877, " A" ], [ 3993, "Ob" ], [ 3994, "Ob" ], [ 4045, "te" ], [ 4046, "te" ], [ 4113, "Fu" ], [ 4114, "Fu" ], [ 4225, "ete" ], [ 4226, "ete" ], [ 4341, "je" ], [ 4342, "je" ], [ 4512, "ll" ], [ 4513, "ll" ], [ 4577, "lFo" ], [ 4578, "lFo" ], [ 4622, "t.S" ], [ 4623, "t.S" ], [ 4737, "Na" ], [ 4738, "Na" ], [ 4851, "iv" ], [ 4852, "iv" ], [ 4899, "in" ], [ 4900, "in" ], [ 4944, "tF" ], [ 4945, "tF" ], [ 5001, "ct" ], [ 5002, "ct" ], [ 5109, "le" ], [ 5110, "le" ], [ 5198, "st" ], [ 5199, "st" ], [ 5305, "ri" ], [ 5306, "ri" ], [ 5378, "Sc" ], [ 5379, "Sc" ], [ 5433, "B." ], [ 5434, "B." ], [ 5548, "n" ], [ 5549, "n" ], [ 5655, "ri" ], [ 5656, "ri" ], [ 5749, "2\\\\" ], [ 5750, "2" ], [ 5857, "c\\\\" ], [ 5858, "c" ], [ 5988, "TP" ], [ 5989, "TP" ], [ 6082, "Get" ], [ 6083, "Get" ], [ 6183, "Sta" ], [ 6184, "Sta" ], [ 6269, "Tem" ], [ 6270, "Tem" ], [ 6312, "il" ], [ 6313, "il" ], [ 6416, "ct" ], [ 6417, "ct" ], [ 6489, "ve" ], [ 6490, "ve" ], [ 6579, "ut" ], [ 6580, "ut" ], [ 6685, "Clo" ], [ 6686, "Clo" ], [ 6735, "AD" ], [ 6736, "AD" ], [ 6805, "Fi" ], [ 6806, "Fi" ], [ 6896, "em" ], [ 6897, "em" ], [ 7002, "pe" ], [ 7003, "pe" ], [ 7066, "pt" ], [ 7067, "pt" ], [ 7118, "tu" ], [ 7119, "tu" ], [ 7204, "me" ], [ 7205, "me" ], [ 7255, "\\\\W" ], [ 7258, "W" ], [ 7370, "st" ], [ 7371, "st" ], [ 7453, "77." ], [ 7454, "77." ], [ 7495, "Re" ], [ 7496, "Re" ], [ 7570, "exe" ], [ 7571, "exe" ], [ 7669, "s\\\\" ], [ 7670, "s" ], [ 7739, "l" ], [ 7740, "l" ], [ 7839, "iv" ], [ 7840, "iv" ], [ 7902, "At" ], [ 7903, "At" ], [ 7970, ".XM" ], [ 7971, ".XM" ], [ 8079, "Sc" ], [ 8080, "Sc" ], [ 8153, "ltd" ], [ 8154, "ltd" ], [ 8201, "st" ], [ 8202, "st" ], [ 8293, "em" ], [ 8294, "em" ], [ 8397, "ea" ], [ 8398, "ea" ], [ 8516, "Sa" ], [ 8517, "Sa" ], [ 8633, "se" ], [ 8634, "se" ], [ 8727, "am" ], [ 8728, "am" ], [ 8819, ";" ], [ 8820, ";" ], [ 8905, "Sc" ], [ 8906, "Sc" ], [ 8959, "eX" ], [ 8960, "eX" ], [ 9037, "iti" ], [ 9038, "iti" ], [ 9127, "Cr" ], [ 9128, "Cr" ], [ 9185, "Sy" ], [ 9186, "Sy" ], [ 9291, "del" ], [ 9292, "del" ], [ 9337, "ex" ], [ 9338, "ex" ], [ 9436, "T" ], [ 9437, "T" ], [ 9489, "dy" ], [ 9490, "dy" ], [ 9571, "es" ], [ 9572, "es" ], [ 9633, "je" ], [ 9634, "je" ], [ 9700, "ho" ], [ 9701, "ho" ], [ 9778, "Fi" ], [ 9779, "Fi" ], [ 9865, "Ob" ], [ 9866, "Ob" ], [ 9917, "pt" ], [ 9918, "pt" ], [ 10008, "te" ], [ 10009, "te" ], [ 10123, "Bo" ], [ 10124, "Bo" ], [ 10187, "Fi" ], [ 10188, "Fi" ], [ 10248, "Ob" ], [ 10249, "Ob" ], [ 10355, "re" ], [ 10356, "re" ], [ 10458, "Spe" ], [ 10459, "Spe" ], [ 10580, "nd" ], [ 10581, "nd" ], [ 10661, "pt" ], [ 10662, "pt" ], [ 10782, "Wr" ] ], "sz": 25824, "ts": [ { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170117_8ee3104598a7285f26d7694fda5b325e.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.800000011920929, "d": "JavaScript strings capped at five", "e": [ "strings.max_length = 4.00" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::js-max-string-length-short", "l": 1 }, { "c": 0.8500000238418579, "d": "Quoted JSON IV field", "e": [ "\"iv\"" ], "i": "micro-behaviors/crypto/symmetric/aes/payload::quoted-iv-field", "l": 1, "m": "C0021.001" }, { "a": "T1027", "c": 0.8399999737739563, "d": "Decoded property function alias", "e": [ "var mytvubuxha = umokfyjpadrajxygipjaviqvakikyxcotudpyvelqylkefepuzsavrykx[2]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "identifiers.avg_length = 59.70" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 2126.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 1.0, "d": "JavaScript many imported modules", "e": [ "imports.unique_modules = 173.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::js-many-import-modules", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 191.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\".XM" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170117_8ee3104598a7285f26d7694fda5b325e.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Public IPv4 first octet list", "e": [ "[39," ], "i": "objectives/anti-static/obfuscation/encoding/ip-notation::int-octet-list", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 173.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Indirect bracketed WScript command invocation", "e": [ "cbyjtacidexkuhtaxduxututudidpareqolwotnuqqelyfohf[0]](cyhis, 0)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 173.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "iwr" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.699999988079071, "d": "JavaScript new Function constructor", "e": [ "new Function(" ], "i": "micro-behaviors/process/interpreter/eval::js-new-function-constructor", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 2.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exact tiny WScript fragments (She, ll)", "e": [ "ll" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-exact-2", "l": 4 }, { "c": 0.75, "d": "JScript array index concatenation (URL obfuscation)", "e": [ "xfezalkydqahehudumbiqfijryrocnedilosewcicuragkiralcehjatonxuzebcycpyxa[0] + afjesarquzosrultegejavezofezwajdiwbumnuszedihpubbazx" ], "i": "objectives/anti-static/obfuscation/syntax::js-array-index-concatenation", "l": 4 }, { "a": "T1027", "c": 0.75, "d": "Large random variable names (obfuscation)", "e": [ "var sikboxregeqjicsuwunnemsohxupsotwamlanutrifyzligqi" ], "i": "objectives/anti-static/obfuscation/string/array::large-random-variables", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate new Function invocation pattern", "e": [ "Function" ], "i": "micro-behaviors/data/source/dynamic/eval::new-function-iife", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.8399999737739563, "d": "High ratio of entropy-heavy identifiers", "e": [ "identifiers.high_entropy_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::js-high-entropy-identifier-ratio", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Many random-looking source identifier names", "e": [ "identifiers.high_entropy_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.8600000143051147, "d": "Hardcoded extension ID map or list", "e": [ "exujxecbetgykymcudylhupfofyjykaf" ], "i": "objectives/supply-chain/metadata-anomaly/manifest/browser-ext::extension-id-map", "l": 1 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "c": 0.9300000071525574, "d": "Nemucod short token cap", "e": [ "strings.max_length = 4.00" ], "i": "well-known/malware/dropper/nemucod::short-token-array-cap", "l": 1 }, { "c": 0.8999999761581421, "d": "Exact tiny readyState fragments (rea, dy, tate)", "e": [ "dy" ], "i": "objectives/execution/interpreter/script/wsh-fragments::readystate-fragment-tiny-exact", "l": 4 }, { "c": 0.8999999761581421, "d": "Exact tiny ADODB fragments (AD, OD, DB,", "e": [ "AD", "OD" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-tiny-exact", "l": 1 }, { "a": "T1497.001", "c": 0.800000011920929, "d": "Obfuscated JScript timing-based analysis evasion", "e": [ "dy", "ll" ], "i": "objectives/anti-analysis/timing/evasion::js-obfuscated-timing-evasion", "l": 4, "m": "B0001.032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate invocation of new Function", "e": [ "Function" ], "i": "objectives/anti-static/obfuscation/eval/function::suspicious-new-function-iife", "l": 4, "m": "B0032" } ], "sha": "be7b6a5112f7fef0632eb87b5d9a4832b3743b32e13fdff252ae83a40437ec8d", "path": "20170117_8ee3104598a7285f26d7694fda5b325e.js", "type": "javascript" } ], "tv": "ac09c" } }