{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.99919224, "class": 1 }, { "m": "az/scripts", "prob": 1.0, "class": 1 }, { "m": "az/javascript", "prob": 1.0, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T13:48:54Z" }, "path": "VirusShare_5536dce1033c5a088ce0eb6ae4340de5", "raw": { "v": "4", "fs": [ { "f": "O(C)H(Cm)Md", "k": { "source.imports[0]": "document.cookie", "source.strings[0]": "#000000", "source.strings[1]": "#ffffff", "source.strings[2]": "100%,*", "source.strings[3]": "\u003ca href=\"http://icloudinfo.ru.com/rg-erdr.php?_rpo=t nhFexEw\u0026_rdm=WJav34WBQv.N3.JvV\u0026p=5f95|@|5f95|@|WJav34WBQv.N3.JvV|@|fB|@||@|ZzAZAzFHF|@|zbb|@|39|@|19c4NW4cGtAtAtzEGAATHbGG|@|t+nAGL7EI|@|T+7hEEpub\u0026ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt/AZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng+gY9kDULC2XAGJVVgeDgGGBg5Mcl8+OV8099if7jA7uoo7IOmDKqJBQwQnJ/Lu2XRRYGJlSx0iBl7Xc0dI7ZLdCW3I=\u0026t=nfrm\"\u003eClick here to proceed\u003c/a\u003e.", "source.strings[4]": "\u003cframe src=\"http://icloudinfo.ru.com/?ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt/AZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng+gY9kDULC2XAGJVVgeDgGGBg5Mcl8+OV8099if7jA7uoo7IOmDKqJBQwQnJ/Lu2XRRYGJlSx0iBl7Xc0dI7ZLdCW3I=\u0026gerf=Wz95reUgWR3Y8ivFttOJ6nRQL6lZJSxZKocBCH9c1zo=\u0026guro=x+y8DZA7ybAFzOBjEMQerJP7bxs/VNDXZWPz7UIyE88C1CS2Dw3Yb0mfUSo+HdHV\u0026\"\u003e", "source.strings[5]": "Content-Type", "source.strings[6]": "IE=EmulateIE7", "source.strings[7]": "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrfIMFkSaoTSqKmC+BrghK0CpDHc0MuVzmMHin8LIORhpXbped+iYhSnZurWnEO0zcKcVIrzp026LVc5pMB9bUCAwEAAQ==_FJanxwymoM5n7se0rGRObullpwTQcUeZ1iaujBIElKLWHWiDm/UnPR5g7nuzsintLU5CMSsE1GiiUlGcNiYJpw==", "source.strings[8]": "X-UA-Compatible", "source.strings[9]": "browser_height=", "source.has_imports": true, "source.strings[10]": "browser_width=", "source.strings[11]": "http://a.rmgserving.com/rmgjsc/zcFilters.js?1", "source.strings[12]": "http://icloudinfo.ru.com/?ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt%2FAZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng%2BgY9kDULC2XAGJVVgeDgGGBg5Mcl8%2BOV8099if7jA7uoo7IOmDKqJBQwQnJ%2FLu2XRRYGJlSx0iBl7Xc0dI7ZLdCW3I%3D", "source.strings[13]": "http://icloudinfo.ru.com/?ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt%2FAZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng%2BgY9kDULC2XAGJVVgeDgGGBg5Mcl8%2BOV8099if7jA7uoo7IOmDKqJBQwQnJ%2FLu2XRRYGJlSx0iBl7Xc0dI7ZLdCW3I%3D\u0026gerf=Wz95reUgWR3Y8ivFttOJ6nRQL6lZJSxZKocBCH9c1zo%3D\u0026guro=x%2By8DZA7ybAFzOBjEMQerJP7bxs%2FVNDXZWPz7UIyE88C1CS2Dw3Yb0mfUSo%2BHdHV\u0026", "source.strings[14]": "http://icloudinfo.ru.com/rg-erdr.php?_rpo=t nhFexEw\u0026_rdm=WJav34WBQv.N3.JvV", "source.strings[15]": "http://icloudinfo.ru.com/rg-erdr.php?_rpo=t nhFexEw\u0026_rdm=WJav34WBQv.N3.JvV\u0026p=5f95%7C%40%7C5f95%7C%40%7CWJav34WBQv.N3.JvV%7C%40%7CfB%7C%40%7C%7C%40%7CZzAZAzFHF%7C%40%7Czbb%7C%40%7C39%7C%40%7C19c4NW4cGtAtAtzEGAATHbGG%7C%40%7Ct+nAGL7EI%7C%40%7CT+7hEEpub\u0026ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt%2FAZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng%2BgY9kDULC2XAGJVVgeDgGGBg5Mcl8%2BOV8099if7jA7uoo7IOmDKqJBQwQnJ%2FLu2XRRYGJlSx0iBl7Xc0dI7ZLdCW3I%3D\u0026t=nfrm", "source.strings[16]": "isframesetenabled=1; path=/;", "source.strings[17]": "text/html; charset=UTF-8", "source.strings[18]": "text/javascript", "source.strings[19]": "viewport", "source.strings[20]": "width=device-width" }, "x": 4, "id": 0, "is": [ "document.cookie", "document.cookie" ], "ms": { "file": { "size": 1889.0 }, "text": { "tab_count": 12.0, "digit_ratio": 0.11, "space_count": 40.0, "total_lines": 10.0, "char_entropy": 6.03, "mixed_indent": true, "unique_chars": 89.0, "import_density": 20.0, "lines_over_200": 4.0, "lines_over_500": 1.0, "string_density": 4.4, "avg_line_length": 187.1, "max_line_length": 627.0, "last_line_length": 18.0, "long_token_count": 3.0, "most_common_char": "t", "whitespace_ratio": 0.04, "most_common_ratio": 0.05, "identifier_density": 7.2, "line_length_stddev": 216.68, "encoded_string_ratio": 0.07, "normalized_import_count": 0.63, "normalized_string_count": 13.91, "max_inline_whitespace_run": 2.0, "suspicious_identifier_ratio": 0.4, "normalized_unique_identifiers": 12.94 }, "imports": { "total": 2.0, "unique_modules": 1.0, "third_party_count": 2.0, "third_party_ratio": 1.0 }, "strings": { "total": 44.0, "url_count": 6.0, "avg_length": 46.0, "max_length": 443.0, "avg_entropy": 3.06, "total_bytes": 2024.0, "entropy_stddev": 1.66, "high_entropy_count": 6.0, "url_encoded_strings": 3.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 72.0, "avg_length": 10.23, "max_length": 44.0, "min_length": 1.0, "avg_entropy": 2.24, "reuse_ratio": 0.6, "unique_count": 43.0, "length_stddev": 12.3, "has_digit_ratio": 0.35, "sequential_names": 7.0, "base64_like_names": 10.0, "single_char_count": 6.0, "single_char_ratio": 0.14, "high_entropy_count": 9.0, "high_entropy_ratio": 0.21, "all_lowercase_ratio": 0.42, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 5.0 } }, "ss": [ [ 22, "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrfIMFkSaoTSqKmC+BrghK0CpDHc0MuVzmMHin8LIORhpXbped+iYhSnZurWnEO0zcKcVIrzp026LVc5pMB9bUCAwEAAQ==" ], [ 23, "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrfIMFkSaoTSqKmC+BrghK0CpDHc0MuVzmMHin8LIORhpXbped+iYhSnZurWnEO0zcKcVIrzp026LVc5pMB9bUCAwEAAQ==" ], [ 273, "Content-Type" ], [ 274, "Content-Type" ], [ 296, "text/html; charset=UTF-8" ], [ 297, "text/html; charset=UTF-8" ], [ 342, "viewport" ], [ 343, "viewport" ], [ 361, "width=device-width" ], [ 362, "width=device-width" ], [ 399, "X-UA-Compatible" ], [ 400, "X-UA-Compatible" ], [ 425, "IE=EmulateIE7" ], [ 426, "IE=EmulateIE7" ], [ 454, "text/javascript" ], [ 455, "text/javascript" ], [ 494, "isframesetenabled=1; path=/;" ], [ 495, "isframesetenabled=1; path=/;" ], [ 566, "text/javascript" ], [ 567, "text/javascript" ], [ 588, "http://a.rmgserving.com/rmgjsc/zcFilters.js?1" ], [ 589, "http://a.rmgserving.com/rmgjsc/zcFilters.js?1" ], [ 658, "text/javascript" ], [ 659, "text/javascript" ], [ 698, "browser_width=" ], [ 699, "browser_width=" ], [ 780, "browser_height=" ], [ 781, "browser_height=" ], [ 898, "100%,*" ], [ 899, "100%,*" ], [ 919, "no" ], [ 920, "no" ], [ 931, "0" ], [ 932, "0" ], [ 948, "0" ], [ 949, "0" ], [ 966, "http://icloudinfo.ru.com/?ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt%2FAZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng%2BgY9kDULC2XAGJ" ], [ 967, "http://icloudinfo.ru.com/?ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt%2FAZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng%2BgY9kDULC2XAGJ" ], [ 1351, "#ffffff" ], [ 1352, "#ffffff" ], [ 1366, "#000000" ], [ 1367, "#000000" ], [ 1387, "http://icloudinfo.ru.com/rg-erdr.php?_rpo=t nhFexEw\u0026_rdm=WJav34WBQv.N3.JvV\u0026p=5f95%7C%40%7C5f95%7C%40%7CWJav34WBQv.N3.JvV%7C%40%7" ], [ 1388, "http://icloudinfo.ru.com/rg-erdr.php?_rpo=t nhFexEw\u0026_rdm=WJav34WBQv.N3.JvV" ], [ 954, "url", "\u003cframe src=\"http://icloudinfo.ru.com/?ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt/AZ9nhXi7Bh5RNvVQQHqKMaBFh0AxbmMGMXng+gY9kD" ], [ 1378, "url", "\u003ca href=\"http://icloudinfo.ru.com/rg-erdr.php?_rpo=t nhFexEw\u0026_rdm=WJav34WBQv.N3.JvV\u0026p=5f95|@|5f95|@|WJav34WBQv.N3.JvV|@|fB|@||@|" ] ], "sz": 1889, "ts": [ { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003ca href=\"http://icloudinfo.ru.com/rg-erdr.php?_rpo=t nhFexEw\u0026_rdm=WJav34WBQv.N3.JvV\u0026p=5f95|@|5f95|@|...", "\u003cframe src=\"http://icloudinfo.ru.com/?ga=wzxfuFA00vdh79nBYTBstHWQ0JyZTBnkdTgFHSfQttYt/AZ9nhXi7Bh5RNv..." ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 7.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1528", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "html" ], "i": "objectives/credential-access/cloud/token::oauth-redirect-with-target-email--rx-10", "l": 1 }, { "c": 1.0, "d": "DOM or CSS size property", "e": [ "width" ], "i": "micro-behaviors/ui/window/manage/dom::size-prop", "l": 1 }, { "a": "T1539", "c": 0.75, "d": "Reads browser cookies via document.cookie", "e": [ "document.cookie" ], "i": "micro-behaviors/communications/http/cookies::document-cookie-read", "l": 3, "m": "C0002" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code UA token", "e": [ "-UA-" ], "i": "objectives/anti-analysis/geofencing/region/country-code-d::country-code-ua", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 10.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 627.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Content-Type" ], "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-21", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "info" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-4", "l": 1 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://icloudinfo.ru.com/rg-erdr.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 10.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "a": "T1204.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "enable" ], "i": "objectives/execution/lure/video-meeting::meeting-device-permission-lure--rx-5", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(exception){}" ], "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "VirusShare_5536dce1033c5a088ce0eb6ae4340de5" ], "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.03" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(exception){}" ], "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors", "l": 1 }, { "a": "T1071", "c": 0.75, "d": "URL ending in PHP endpoint", "e": [ "http://icloudinfo.ru.com/rg-erdr.php?" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::php-url", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "\u003cframe src=\"http://icloudinfo.ru.com/?ga \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 } ], "sha": "c0739780e3dacc8b58ea74c7cfee15d4b8e8b767b07fb06e591329325d3ffbc3", "path": "VirusShare_5536dce1033c5a088ce0eb6ae4340de5", "type": "javascript" } ], "tv": "529a0" } }