{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9434438943862915 } ], "prob": 0.9434439, "models": [ { "m": "az", "prob": 0.9434439, "class": 2 }, { "m": "az/scripts", "prob": 0.9501718, "class": 2 }, { "m": "az/batch", "prob": 0.996875, "class": 2 } ], "version": "v17.17", "analyzed_at": "2026-06-01T19:19:09Z" }, "path": "ce9ef8f8911e33156ea04318d991235ea3d6f603ff1f243825773451b175e934.bat", "raw": { "v": "6", "fs": [ { "f": "O₂(AsC)", "x": 37, "ff": { "m": { "file": { "size": 15369.0, "entropy": 5.03, "size_bytes": 15369.0 }, "text": { "digit_ratio": 0.0, "space_count": 1320.0, "total_lines": 295.0, "char_entropy": 5.03, "unique_chars": 75.0, "lines_over_200": 4.0, "lines_over_500": 3.0, "avg_line_length": 50.1, "lines_over_1000": 2.0, "max_line_length": 1158.0, "empty_line_ratio": 0.0, "last_line_length": 51.0, "long_token_count": 10.0, "whitespace_ratio": 0.12, "most_common_ratio": 0.09, "line_length_stddev": 94.8, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 254.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.03 } }, "s": [ [ 0, "u8", "Set Ministry=9" ], [ 16, "u8", "TlEDirectory Bandwidth Challenge Wan Overseas Catholic" ], [ 73, "u8", "LaXGzip Summaries" ], [ 93, "u8", "KwTypically Bluetooth Sf" ], [ 120, "u8", "PZjDiscover Privacy Cherry Trucks United Demands Sentence" ], [ 180, "u8", "IXPairs Ready Pr Ide Robertson Festival Apartments Curtis" ], [ 240, "u8", "RcpSeat Councils Verbal Boundary Rubber Ty Invest Beijing" ], [ 300, "u8", "kzbcHeld Publicity Furthermore Bible Contracting Defend Survive Gi" ], [ 369, "u8", "jIwReproduce Rings Subscriptions" ], [ 404, "u8", "SAguEffectiveness Press Macromedia Recorded Key Reef Ranked" ], [ 466, "u8", "Set Lectures=k" ], [ 482, "u8", "aCGARemind Cookies Ver Accepting Has Plastics Prostores Impressed Refresh" ], [ 558, "u8", "LdeLions Upon Cancelled" ], [ 584, "u8", "JcJIsle Reporters Carrier Phoenix Amy Ultra" ], [ 630, "u8", "JMujClassics Past Meet Drawing Rats Arrangement Murder Desk" ], [ 692, "u8", "tOcISeeing Archive" ], [ 713, "u8", "TWExceptions" ], [ 728, "u8", "Set Complement=I" ], [ 746, "u8", "TMRouters Rocks Arrest Timer Nepal Bag" ], [ 787, "u8", "iTStrip Usb Painful Sox" ], [ 813, "u8", "NxYXi Spelling Cas Opponents Integral Supplied Commissions" ], [ 874, "u8", "CYFlickr Hawaii Whats Hiking Siemens Johnson Remarkable Community Column" ], [ 949, "u8", "neVFriendship Uncle Engines Dish Telescope Homeless" ], [ 1003, "u8", "kiNOwn Celebrities Necessary Analog Herald Treatments Peers Classroom" ], [ 1075, "u8", "wbYkVertical" ], [ 1090, "u8", "lPLingerie Scenarios Crap Viruses" ], [ 1126, "u8", "WTPerson Mel Message Butler Doctor Cst Oo Commissioners Fbi" ], [ 1188, "u8", "Set Changes=/" ], [ 1203, "u8", "cQUXTreaty Wash Beaver Departure Unauthorized Harbour" ], [ 1259, "u8", "vNAdaptation Herein Compiled" ], [ 1290, "u8", "yBwNudity Hampshire Took Columnists Remain Neighbor Spin Occupational Supporters" ], [ 1373, "u8", "wYThreads Directed Expired Cn Walking Sections Passport" ], [ 1431, "u8", "icKANut Rides Charts Patent App Cumshot Gilbert Solving Drew" ], [ 1494, "u8", "Set Medium=M" ], [ 1508, "u8", "kmcdBeside Greatest Saints Manufacturing Breeding" ], [ 1560, "u8", "SsRemote Global" ], [ 1578, "u8", "bZPhenomenon Retained" ], [ 1602, "u8", "rnkqNails Summit Ones Proposals Ni Horn Regulatory Ensemble" ], [ 1664, "u8", "cFEn Regulated Improving" ], [ 1691, "u8", "FfdJet Zen Mental Simple Michael Legs Beatles Involvement Lawyers" ], [ 1759, "u8", "SdMountain" ], [ 1772, "u8", "JmDirt Tits Growing Immediately Certain" ], [ 1814, "u8", "SIVVKarma Irs Cloudy" ], [ 1837, "u8", "Set Tokyo=Z" ], [ 1850, "u8", "EdPBeside Fields" ], [ 1869, "u8", "PVElevation Dem Quick Max Rochester" ], [ 1907, "u8", "iwLeo Angels Story Preservation" ], [ 1941, "u8", "UEoiSubmitted" ], [ 1957, "u8", "cYjFPrecisely Euro Clinton Michel" ], [ 1993, "u8", "Set Ca=2" ], [ 2003, "u8", "dCContacts Funding Mass Join" ], [ 2034, "u8", "imEmission Region Officers Spencer Detect Lane" ], [ 2083, "u8", "uOSufficient" ], [ 2098, "u8", "hnXxSpecs Suits Stated" ], [ 2123, "u8", "xGzInter Graduated Secondary Notebooks" ], [ 2164, "u8", "CCVVegetation Submissions Republic Steam" ], [ 2207, "u8", "IzStructures" ], [ 2222, "u8", "bIReceived Highlighted" ], [ 2247, "u8", "Set Challenges=e" ], [ 2265, "u8", "gHlBuilder Dept Horrible Scoring Bottle Glow Letters Desert Legislature" ], [ 2339, "u8", "YUBetting Pct Island Rows Considers" ], [ 2377, "u8", "zCvReject Empirical Phrases Games Instruments Garbage Assignments Drew Disco" ], [ 2456, "u8", "eMHoldem Draw Methods Yrs L" ], [ 2486, "u8", "JiKCopper Explorer Lakes" ], [ 2513, "u8", "Set President=N" ], [ 2530, "u8", "pRPreferred Exposed Predict Kid" ], [ 2564, "u8", "qeTAndrews Pumps Query Isa Float" ], [ 2599, "u8", "emIntroductory Tape Tyler Restriction Salon Annually" ], [ 2654, "u8", "bePowerful Fitted Continuity Back Fathers Princeton Argued Combined Referral" ], [ 2733, "u8", "uZbMBlowjobs Worldsex Method" ], [ 2764, "u8", "YaHkRapidly Vibrator Horizontal Types" ], [ 2804, "u8", "HnZBetter Composition Blink Specialists Palestine Genetics Sacred Endless Warcraft" ], [ 2889, "u8", "KBIdentical Confirm Love Pontiac Arising" ], [ 2932, "u8", "LrFCarrier" ], [ 2945, "u8", "Set Rich=w" ], [ 2957, "u8", "huGEven" ], [ 2967, "u8", "waCache Disturbed Fixes Commit Volunteer" ], [ 3010, "u8", "xsAVLime Dean Guys" ], [ 3031, "u8", "EqgUCenturies Vp Backed Edinburgh Z" ], [ 3069, "u8", "pskGreatest Instruments Bedford Parents" ], [ 3111, "u8", "cKgGym Crucial Puzzles Pack Squad Born Summer" ], [ 3159, "u8", "LNEnsemble Steps Canal Superb Happy" ], [ 3197, "u8", "Set Claimed=l" ], [ 3212, "u8", "pbArabic Bolt Boot Login Sb" ], [ 3242, "u8", "EZbRecorded Litigation Keith Disorders Huge Extended Dated Common Candle" ], [ 3317, "u8", "bDLMarketing" ], [ 3332, "u8", "kjCreated Paperback Bios" ], [ 3359, "u8", "VoLou Evil Expand Hybrid Impaired Raleigh" ], [ 3403, "u8", "FDParticle Nitrogen Welcome" ], [ 3433, "u8", "Set Specific=X" ], [ 3449, "u8", "eYwnAdministered Williams Instance Council" ], [ 3494, "u8", "NjhCreek Moses Beverly Sleeps Senegal Trades" ], [ 3541, "u8", "KwMgLip Crack" ], [ 3557, "u8", "GhxhAppliances Exports Tables Production Decrease Liechtenstein Fatal" ], [ 3629, "u8", "ktYrUniversities Bra Attack Leon" ], [ 3664, "u8", "weFlight" ], [ 3675, "u8", "fljmRoyalty Nerve Birth Fm Worker Knives Nam" ], [ 3722, "u8", "KxEgXp Jc Verizon Safer Creation Same" ], [ 3762, "u8", "yGyFreebsd" ], [ 3775, "u8", "MKMunicipal Latina Wx Affected" ], [ 3808, "u8", "Set Mixer=v" ], [ 3821, "u8", "ZFrFinland Creating Forty Brochure Mini Respective Is Allan" ], [ 3883, "u8", "ZAYnPete Chase Kidney Worthy Wound San Retailer They Leading" ], [ 3946, "u8", "UEAcer Thumbzilla Stocks" ], [ 3973, "u8", "oiWjDirectories Wr Manager Nuts Refrigerator Psi Singing Growth" ], [ 4039, "u8", "BBTractor" ], [ 4051, "u8", "Set Ups=P" ], [ 4062, "u8", "GfybDepending Cure Weekends Kick Internet Calculations Airline" ], [ 4127, "u8", "sRPork Roman Them Laser Individually" ], [ 4166, "u8", "eetAppeared" ], [ 4180, "u8", "rotQueue War Meal Stress Solar Sauce Colour Administrative Ro" ], [ 4244, "u8", "ugEGale Realistic Press Workstation Hostel Central Applies Overview" ], [ 4314, "u8", "Set Mate=O" ], [ 4326, "u8", "ezConsultants Strengthening Tons Falling Fun Client" ], [ 4380, "u8", "ePPurposes Thick Nature Tale Referenced Teams Dimensional Root Ireland" ], [ 4453, "u8", "MdBarbie Receiving Vbulletin Trademarks Bearing Highlighted Established" ], [ 4527, "u8", "OcDTours Pest Scoop Tion Hearts Justin Evidence Undergraduate" ], [ 4591, "u8", "gBCoPike Winners Jefferson More Beneath Surgical Targets Colors Songs" ], [ 4663, "u8", "chkJoke Fund Uk Kate Affiliate Attached" ], [ 4705, "u8", "Set Slow=V" ], [ 4717, "u8", "TePGirl Walked Sessions Constant" ], [ 4752, "u8", "MpNCameron Contests Exception" ], [ 4784, "u8", "WMRpChurch Discretion Pools Initially Fighter" ], [ 4832, "u8", "eByImage" ], [ 4843, "u8", "FBfLabeled Costs Alive Hang Airline" ], [ 4881, "u8", "eUiRecognized Clocks Examine" ], [ 4912, "u8", "Set California=d" ], [ 4930, "u8", "gzURelates Types Only Instrumental Cheap" ], [ 4973, "u8", "HydQPortfolio Alert Determining Ignore Load" ], [ 5019, "u8", "ObHkEnemy Bob Oasis Sys Courts Wesley Words Ant" ], [ 5069, "u8", "kGPurchasing Milf Namibia Miscellaneous Devon Cigarette Sum" ], [ 5131, "u8", "DsLeAug Preserve" ], [ 5150, "u8", "Set Milk=Q" ], [ 5162, "u8", "WjdOthers Links Stat Drawn Pb Pine Burton Donor Namibia" ], [ 5220, "u8", "egSwap Ultram Dangerous Longest Employment" ], [ 5265, "u8", "fkYzRef Champion Easter Hitachi Import Ralph" ], [ 5312, "u8", "zbUndo Aware Rat West Lets Consumers Shareware" ], [ 5361, "u8", "MvSurveys Lose Sing Over Fund Wicked Orbit Installations Affected" ], [ 5429, "u8", "IigCGenetics Promotes Sons Sur Worldsex" ], [ 5471, "u8", "ROWSMb School My Kathy Treasurer" ], [ 5506, "u8", "XDOlder Involved Scores Awesome Reliance Poly Trips Hollywood" ], [ 5570, "u8", "Set Amp=Y" ], [ 5581, "u8", "vvqQIra" ], [ 5591, "u8", "vdeNRouge Suit Hosts Spirituality Sur Luke Shelter Implementation" ], [ 5659, "u8", "LJTr Trade Reunion Cached Est Representative Handjob Relating" ], [ 5723, "u8", "WruRoller Gg Influences Finest Level Definition Sizes" ], [ 5779, "u8", "EqldArtistic Textiles Cz Songs Requiring Quarterly Responsibilities Cambridge" ], [ 5859, "u8", "pKMuPanasonic Additionally Country Stand Sells Essentially" ], [ 5920, "u8", "Set Atmospheric=" ], [ 5939, "u8", "atJr Style Adjustments Expert Thomas Meant Shower" ], [ 5991, "u8", "KAACollege Flexibility Forums Paths Succeed Configured Released Neutral" ], [ 6065, "u8", "IpSCode Hayes Academy Ruled" ], [ 6095, "u8", "MTMtThirty Broad Mouse" ], [ 6120, "u8", "oWTba Bye Landing Gdp Planet Included" ], [ 6160, "u8", "Set Vegetation=1" ], [ 6178, "u8", "XFEds Size Pool Ci Vendors" ], [ 6207, "u8", "iQKMParticle Block Biography Buf Introduce Lucia Dual" ], [ 6263, "u8", "EILOFoam" ], [ 6274, "u8", "AYeaScan Diet Definition Scuba Hearing Crimes Vietnamese" ], [ 6333, "u8", "DquCemetery Flow Strips Drive Modeling Explained Jun Technology Virgin" ], [ 6406, "u8", "wRAngle Only Shadows Vibrators Crown Columns" ], [ 6453, "u8", "swZxEntire Providing Der Mongolia Paypal Fabric Minnesota Macintosh" ], [ 6523, "u8", "Set Roses=a" ], [ 6536, "u8", "mLWHJackie Reveal Reads Curve Hamburg Dakota" ], [ 6583, "u8", "FiJSpending Funeral Occupational Bus" ], [ 6622, "u8", "nchDel Equal Equivalent Reasonably Interior Engage" ], [ 6675, "u8", "xVfjMaintenance Compromise Supervision" ], [ 6716, "u8", "hoBarbara Fallen Paxil Hopefully Wb" ], [ 6754, "u8", "LooAAltered Engage Physiology Against" ], [ 6794, "u8", "obRibbon Blowjob Icq Wed Poor Standings Imposed Assembled Ended" ], [ 6860, "u8", "MSEnterprise" ], [ 6875, "u8", "Set Visitors=u" ], [ 6891, "u8", "ETRepairs Recording Casa Pad" ], [ 6922, "u8", "EgWGStyles Projector Shortcuts Discovered Guns" ], [ 6971, "u8", "HaYLosing Tries How Wild Harmful Pentium" ], [ 7014, "u8", "LsReflect Regards Ear Breaking Develops" ], [ 7063, "u8", "AvOAppointment Arch Standing" ], [ 7094, "u8", "Set Tips=m" ], [ 7106, "u8", "WGfSlovakia Engineers Christian Dan Dear Folding Material Nathan" ], [ 7173, "u8", "OuProfessionals Actively Funeral Granny" ], [ 7215, "u8", "gTqwPast Permission Formed Nirvana Gif" ], [ 7256, "u8", "MWQuEngland Hottest Realtors Shaft Mitsubishi Str Refrigerator Agents Translate" ], [ 7338, "u8", "qlFlash Speaks Lyrics Correction Protocol Percent" ], [ 7390, "u8", "fPsISupporters Outdoor Weblog Reads Store" ], [ 7434, "u8", "YqGroove Motors Particles Mx" ], [ 7465, "u8", "ciBlowjob Courses Participant Informed Recipient Developing Math Editing Lord" ], [ 7545, "u8", "Set Crop=W" ], [ 7557, "u8", "JAyEngineer" ], [ 7571, "u8", "kNfrAmazing" ], [ 7585, "u8", "lXTested Opera Hyundai" ], [ 7610, "u8", "FfBrochures Adjust Architectural Cart Generators Holy Ignored" ], [ 7674, "u8", "qQRemain Technological Jpeg Mlb Eat Mining" ], [ 7719, "u8", "Set Constantly=6" ], [ 7737, "u8", "woFhEmma Ellen Guarantee Titled Scenario" ], [ 7780, "u8", "OxQZDevelopmental" ], [ 7800, "u8", "RsSAnytime Creator Ministers Information Avg Roses Exams" ], [ 7859, "u8", "TwkPennsylvania Vermont Hampton Seminar Nine Beach" ], [ 7912, "u8", "ecTft Submitted" ], [ 7930, "u8", "rAAAc" ], [ 7938, "u8", "wRfGraduated Ppm" ], [ 7957, "u8", "Set Bears=U" ], [ 7970, "u8", "tDVMarketing Sandwich Coalition Alot Perfectly Innocent Vs Rev" ], [ 8035, "u8", "QdExports Ps Blacks Actively Documents Sewing Enjoying Suggestions" ], [ 8104, "u8", "pOaRBreast" ], [ 8117, "u8", "SFXEnjoyed Accidents Even Mode Terrace Isle Subscriptions Mostly" ], [ 8184, "u8", "FQWebsites" ], [ 8197, "u8", "rYCrap Dicke Dresses Displaying Arrest Cool Focuses Acne Sign" ], [ 8261, "u8", "Set Consumption=." ], [ 8280, "u8", "bUFIsland Lingerie Existing Granny Login Bulgaria Sensors Uses" ], [ 8345, "u8", "QtaNLt Vanilla Careers Lyrics" ], [ 8377, "u8", "aJESenators Visual Mil" ], [ 8402, "u8", "gkNeedle Princeton Crash" ], [ 8429, "u8", "AOMsn Integrating Biodiversity Inside Far Manga Daniel" ], [ 8486, "u8", "ZhPlains Prison Cookies Tournaments" ], [ 8524, "u8", "hpDoctors Location Hungary Volkswagen Applied Loose Rat Just" ], [ 8587, "u8", "xiTaught Republicans Controller Mb Bacteria Maria" ], [ 8639, "u8", "Set Theories=3" ], [ 8655, "u8", "wJEscorts Partners Nirvana Locator Alternative Pour Households Visits Wm" ], [ 8730, "u8", "AkiAquarium Tuition Nutrition Arthur Zu" ], [ 8772, "u8", "RICVPermission Spell Rainbow Fr Sole" ], [ 8811, "u8", "jSnHTruck Consultant Innovation Marriott" ], [ 8854, "u8", "pFhjGuests Moisture Knock Wanted Refurbished Wrote Afford Usb Cable" ], [ 8924, "u8", "tJwStartup Pty Neil China" ], [ 8952, "u8", "hzJSAbstracts Heads Nicholas Inner Routes Performed" ], [ 9006, "u8", "S%Challenges%t%Atmospheric%%Medium%x%Amp%H%Amp%%Tips%b%Crop%t%Ups%yrjx%Lectures%JArjsH%Ups%A%Mate%%Medium%y%Ups%%Rich%Lq=D%Chall" ], [ 9163, "u8", "JADiscussions Cyber Grounds" ], [ 9193, "u8", "RkFe Aboriginal Epinions Delivery Clause Barnes Profiles Deviation Nav" ], [ 9266, "u8", "S%Challenges%t%Atmospheric%%Ups%%Amp%jJiJpo%Mate%%Tokyo%BtL%Medium%c%Visitors%q%Bears%%Lectures%%Lectures%%Bears%%Mate%K%Califor" ], [ 9415, "u8", "YGLStatistics Waiting Expires Govt Millions Clothes Italia" ], [ 9476, "u8", "QqBMpeg Journals" ], [ 9495, "u8", "rWInteractions" ], [ 9512, "u8", "SsNLiz Respond Listings" ], [ 9538, "u8", "FPTerrorist Marie Mailing Gene Hundred Rna Inquiry" ], [ 9591, "base64", "17\u0003y؜jם" ], [ 9635, "u8", "t%Roses%s%Lectures%%Claimed%ist%Atmospheric%|%Atmospheric%fin%California%str%Atmospheric%%Changes%%Complement%%Atmospheric%\"%Ric" ], [ 10188, "u8", "CWoTalked Legendary Contracts Barriers" ], [ 10229, "u8", "QHcZEnclosed" ], [ 10244, "u8", "DeyEncountered Jonathan Furnishings Rapids Judgment Impossible Spokesman" ], [ 10319, "u8", "FDHPlacement Court Disney Rings Referenced Committed Perspective" ], [ 10386, "u8", "kJESInquiry" ], [ 10400, "u8", "S%Challenges%t%Atmospheric%%Changes%%Roses%%Atmospheric%A%Visitors%c%Lectures%%Claimed%%Roses%n%California%=%Theories%%Theories%" ], [ 10559, "u8", "WZzPilot" ], [ 10570, "u8", "trDTales Idea Planes Populations" ], [ 10605, "u8", "fpUSandra Regardless Madness Tiny Green Gotta Dean" ], [ 10658, "u8", "FUBAllen Amended Few Muslim Nursery Commerce" ], [ 10705, "u8", "teuConsecutive Enjoying" ], [ 10731, "u8", "t%Roses%s%Lectures%%Claimed%ist%Atmospheric%|%Atmospheric%fin%California%str%Atmospheric%%Changes%%Complement%%Atmospheric%\"%Ros" ], [ 11891, "u8", "lCDuncan Popularity" ], [ 11913, "u8", "LGHalifax Bikini Worldcat Ports Hugo Berkeley Jacob" ], [ 11967, "u8", "ePHall Expressions Beside Subcommittee By Nominations Sight Promote" ], [ 12037, "u8", "BsFClosely" ], [ 12050, "u8", "c%Tips%%California%%Atmospheric%%Changes%c%Atmospheric%%Tips%%California%%Atmospheric%%Auckland%" ], [ 12148, "u8", "xFRbHands Motorcycle Competing" ], [ 12181, "u8", "pUHPerform Amp Cf Learning Influences Singapore Switches Intelligent Forbidden" ], [ 12262, "u8", "fin%California%str%Atmospheric%%Changes%%Slow%%Atmospheric%\"S%Claimed%otS%Visitors%p%Challenges%riorF%Challenges%%Roses%t%Visito" ], [ 12527, "u8", "zqCustody Atomic Knock Thereafter Lesser Guests Boot Baseball Mechanics" ] ], "v": { "file.stem": "ce9ef8f8911e33156ea04318d991235ea3d6f603ff1f243825773451b175e934", "file.basename": "ce9ef8f8911e33156ea04318d991235ea3d6f603ff1f243825773451b175e934.bat" }, "id": "batch" }, "id": 0, "sz": 15369, "ts": [ { "c": 0.8600000143051147, "d": "Batch contains VBScript Set assignment", "e": [ "Set Ministry=" ], "i": "objectives/command-and-control/dropper/execution/batch::batch-vbscript-set-literal", "l": 3 }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "SafeBoot cleanup targets major EDR vendor", "e": [ "sophos" ], "i": "objectives/impact/degrade/edr/teardown::safeboot-edr-vendor--rx-2", "l": 1 }, { "a": "T1105", "c": 0.7799999713897705, "d": "Loader key argument hint", "e": [ " Catholic \r" ], "i": "objectives/command-and-control/dropper/execution/batch::rc4-key-argument-hint", "l": 1 }, { "c": 0.8399999737739563, "d": "Variable assigned l fragment", "e": [ "Claimed=l" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-l-var", "l": 1 }, { "c": 0.8399999737739563, "d": "Variable assigned e fragment", "e": [ "Challenges=e" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-e-var", "l": 1 }, { "a": "T1110.001", "c": 0.4000000059604645, "d": "Weak password master", "e": [ "master" ], "i": "objectives/lateral-movement/brute-force/password::weak-pass-master", "l": 1, "m": "E1110" }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "IwR" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 295.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1036", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "Documents" ], "i": "objectives/evasion/masquerade/file/lure::pdf-search-userprofile--rx-2", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1158.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Batch has long encoded token", "e": [ "text.long_token_count = 10.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token", "l": 1 }, { "a": "T1562.001", "d": "Sophos reference", "e": [ "sophos" ], "i": "objectives/impact/degrade/edr/targeting::sophos-name", "l": 1 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "start" ], "i": "objectives/command-and-control/dropper/execution/batch::keyed-temp-payload-launch--rx-1", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Command fragmented via undefined env vars", "e": [ "%Tips%b%Crop%t%Ups%yr" ], "i": "objectives/anti-static/obfuscation/string/concat::batch-fragmented-command-undefined-vars", "l": 4, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Variable assigned d fragment", "e": [ "California=d" ], "i": "objectives/command-and-control/dropper/execution/batch::del-fragment-d-var", "l": 1 }, { "c": 0.6000000238418579, "d": "Mining string (title case)", "e": [ "Mining" ], "i": "objectives/impact/cryptojacking/miner/context::mining-title", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Adjacent env-var expansion chain", "e": [ "%Bears%%Lectures%%Lectures%%Bears%%Mate%" ], "i": "objectives/anti-static/obfuscation/string/concat::batch-adjacent-expansion-chain", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 2.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" } ], "sha": "ce9ef8f8911e33156ea04318d991235ea3d6f603ff1f243825773451b175e934", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-08/ce9ef8f8911e33156ea04318d991235ea3d6f603ff1f243825773451b175e934.bat", "type": "batch" } ], "tv": "961ce" } }