{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8383554220199585, "class": 0 } ], "prob": 0.8383554, "class": 0, "models": [ { "m": "az", "prob": 0.8383554, "class": 0 }, { "m": "az/scripts", "prob": 0.19900933, "class": 0 }, { "m": "az/javascript", "prob": 0.57859534, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T19:55:53Z" }, "path": "20170321_1f9962e3782d65de0ca96cc8ea1525a2.js", "raw": { "v": "5", "fs": [ { "f": "O₃(AsSXe₂)H₂(CmPo)", "x": 5, "ff": { "i": [ [ "", "zx" ], [ "", "ZHUL" ], [ "", "tus" ], [ "", "WScript.CreateObject" ], [ "", "ih" ], [ "", "mter" ], [ "", "tjkh" ], [ "", "zn" ], [ "", "kt" ], [ "", "e.open" ], [ "", "e.send" ], [ "", "zhim" ], [ "", "got" ], [ "", "r.indexOf" ], [ "", "ikagdh" ], [ "", "r.split.join" ], [ "", "r.split" ], [ "", "eval" ] ], "m": { "ast": { "max_depth": 27.0, "bind_count": 16.0, "call_count": 8.0, "node_count": 404.0, "target_count": 7.0, "member_depth_max": 3.0, "string_bind_count": 6.0, "string_literal_count": 24.0, "string_concat_chain_max_length": 19.0 }, "file": { "size": 871.0, "entropy": 5.59, "size_bytes": 871.0 }, "text": { "tab_count": 49.0, "digit_ratio": 0.07, "space_count": 62.0, "total_lines": 37.0, "char_entropy": 5.59, "unique_chars": 83.0, "string_density": 0.65, "avg_line_length": 21.59, "max_line_length": 133.0, "empty_line_ratio": 0.11, "last_line_length": 2.0, "long_token_count": 1.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.04, "identifier_density": 1.59, "line_length_stddev": 30.67, "normalized_string_count": 3.95, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 3.0, "most_common_char_codepoint": 34.0, "suspicious_identifier_ratio": 0.19, "normalized_unique_identifiers": 4.99 }, "strings": { "total": 24.0, "avg_length": 10.88, "max_length": 122.0, "avg_entropy": 0.84, "empty_count": 6.0, "total_bytes": 261.0, "entropy_stddev": 1.66, "high_entropy_count": 1.0 }, "identifiers": { "total": 59.0, "avg_length": 4.08, "max_length": 12.0, "min_length": 1.0, "avg_entropy": 1.63, "reuse_ratio": 0.44, "unique_count": 26.0, "length_stddev": 2.89, "sequential_names": 5.0, "single_char_count": 5.0, "single_char_ratio": 0.19, "all_lowercase_ratio": 0.81, "all_uppercase_ratio": 0.04 } }, "s": [ [ 10, "u8", "liveatwispresort.com palmspringsevents.net strannikspace.com yst.orlyreznik.com yosh.truecompassdesigns.net" ], [ 11, "u8", "liveatwispresort.com palmspringsevents.net strannikspace.com yst.orlyreznik.com yosh.truecompassdesigns.net" ], [ 126, "u8", " " ], [ 127, "u8", " " ], [ 141, "u8", "0000001MNtqj3MpxSu1PA98hjRULPNJmuhzpdGHkLRUB8RcsgNju4fJh6NMfHNi8ZIh2QU3-BjUKqGwXezJaZJ15pqMNzo1rqkRZOnF_PfFnN8Q8G6RlNwtnXA" ], [ 142, "u8", "0000001MNtqj3MpxSu1PA98hjRULPNJmuhzpdGHkLRUB8RcsgNju4fJh6NMfHNi8ZIh2QU3-BjUKqGwXezJaZJ15pqMNzo1rqkRZOnF_PfFnN8Q8G6RlNwtnXA" ], [ 277, "u8", "p" ], [ 278, "u8", "p" ], [ 294, "u8", "h" ], [ 295, "u8", "h" ], [ 310, "u8", "S" ], [ 311, "u8", "S" ], [ 382, "u8", "M" ], [ 383, "u8", "M" ], [ 390, "u8", "XML2.XMLHTTP" ], [ 391, "u8", "XML2.XMLHTTP" ], [ 429, "u8", "G" ], [ 430, "u8", "G" ], [ 433, "u8", "E" ], [ 434, "u8", "E" ], [ 437, "u8", "T" ], [ 438, "u8", "T" ], [ 496, "u8", "/" ], [ 497, "u8", "/" ], [ 513, "u8", "t" ], [ 514, "u8", "t" ], [ 578, "u8", "c" ], [ 579, "u8", "c" ], [ 582, "u8", "ounter" ], [ 583, "u8", "ounter" ], [ 600, "u8", "?" ], [ 601, "u8", "?" ], [ 801, "u8", "a" ], [ 802, "u8", "a" ] ], "v": { "source.language": "javascript", "source.imports[0]": "WScript.CreateObject", "source.imports[1]": "ZHUL", "source.imports[2]": "e.open", "source.imports[3]": "e.send", "source.imports[4]": "eval", "source.imports[5]": "got", "source.imports[6]": "ih", "source.imports[7]": "ikagdh", "source.imports[8]": "kt", "source.imports[9]": "mter", "source.strings[0]": "0000001MNtqj3MpxSu1PA98hjRULPNJmuhzpdGHkLRUB8RcsgNju4fJh6NMfHNi8ZIh2QU3-BjUKqGwXezJaZJ15pqMNzo1rqkRZOnF_PfFnN8Q8G6RlNwtnXA", "source.strings[1]": "XML2.XMLHTTP", "source.strings[2]": "liveatwispresort.com palmspringsevents.net strannikspace.com yst.orlyreznik.com yosh.truecompassdesigns.net", "source.strings[3]": "ounter", "source.has_imports": true, "source.imports[10]": "r.indexOf", "source.imports[11]": "r.split", "source.imports[12]": "r.split.join", "source.imports[13]": "tjkh", "source.imports[14]": "tus", "source.imports[15]": "zhim", "source.imports[16]": "zn", "source.imports[17]": "zx" }, "ca": [ [ "WScript.CreateObject", "M" ], [ "WScript.CreateObject", "XML2.XMLHTTP" ], [ "e.open", "" ], [ "e.open", "?" ], [ "e.open", "c" ], [ "e.open", "ounter" ], [ "r.split().join", "a" ] ], "ct": [ "WScript.CreateObject", "e.open", "e.send", "eval", "r.indexOf", "r.split", "r.split().join" ], "id": "javascript", "mc": [ "WScript.CreateObject", "e.open", "e.responseText", "e.send", "r.indexOf", "r.length", "r.split", "r.split().join", "x.length" ] }, "id": 0, "sz": 871, "ts": [ { "c": 0.800000011920929, "d": "WScript marker", "e": [ "WScript" ], "i": "micro-behaviors/process/create/script/wsh::wscript-marker", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8", "l": 1, "m": "B0032" }, { "a": "T1048.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "live" ], "i": "objectives/supply-chain/recon-exfil/dns::dns-lookup-with-canary-domain--rx-6", "l": 1, "m": "E1041" }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "ADODB.Stream Open method call", "e": [ ".open(" ], "i": "micro-behaviors/fs/write/stream::adodb-open", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "XMLHTTP/WinHTTP COM ProgID reference", "e": [ "XMLHTTP" ], "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-com-progid-text", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "join(" ], "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4", "l": 1 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "JavaScript static key string assignment", "e": [ "= \"liveatwispresort.com palmspringsevents.net strannikspace.com yst.orlyreznik.com yosh.truecompassdesigns.net\"" ], "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Decoded property function alias", "e": [ "var tjkh = x[i]" ], "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias", "l": 1, "m": "B0032" }, { "a": "T1059.005", "c": 0.800000011920929, "d": "WScript.CreateObject call", "e": [ "WScript.CreateObject(" ], "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-createobject-dup", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ").join" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12", "l": 1, "m": "B0032" }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for (var i=0; i\u003cx.length; i++)\r\n{\t\r\n\tvar e = WScript.CreateObject(\"M\"+tus+\"XML2.XMLHTTP\");\r\n\ttry\r\n\t{..." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ "\nfor (" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "a": "T1027", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "c": 0.8199999928474426, "d": "JavaScript substring search call", "e": [ "indexOf(" ], "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "l": 2 }, { "c": 0.949999988079071, "d": "eval/new Function call (flatted tamper fragment)", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 37.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.949999988079071, "d": "JavaScript or TypeScript basename", "e": [ "20170321_1f9962e3782d65de0ca96cc8ea1525a2.js" ], "i": "metadata/lang/source::js-ts-source-basename", "l": 2 }, { "c": 0.699999988079071, "d": "Single character string concatenation pattern", "e": [ "\"+\"E\"+" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::single-char-concat-pattern", "l": 3 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170321_1f9962e3782d65de0ca96cc8ea1525a2.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.800000011920929, "d": "Variable-based split with token delimiter", "e": [ ".split(m)" ], "i": "objectives/anti-static/obfuscation/string/conceal::js-var-split-marker", "l": 2 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "send" ], "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ ".split(" ], "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "eval() function call (raw)", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::js-eval-raw", "l": 3 }, { "c": 1.0, "d": "Tiny XMLHTTP fragment (variant 2)", "e": [ ".XMLHT" ], "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2", "l": 1 }, { "c": 0.699999988079071, "d": "JavaScript file under 5KB", "e": [ "20170321_1f9962e3782d65de0ca96cc8ea1525a2.js" ], "i": "metadata/file/text/metrics::javascript-small-file-5k", "l": 1 }, { "a": "T1195.002", "c": 0.75, "d": "eval() with dynamic argument", "e": [ "eval" ], "i": "objectives/supply-chain/hidden-payload/staging::eval-function-call-arg", "l": 3 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "eval on decoded variable", "e": [ "eval(ikagdh)" ], "i": "objectives/execution/interpreter/eval/dynamic::array-eval-variable", "l": 3 }, { "c": 0.699999988079071, "d": "Access to HTTP response body (.responseText)", "e": [ ".responseText" ], "i": "micro-behaviors/communications/http/client/response-body::response-text", "l": 3 }, { "c": 0.800000011920929, "d": "WScript.Shell string fragment (WScrip/WScr)", "e": [ "WScr" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-1", "l": 1 }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(e)\r\n\t{\r\n\t}" ], "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors", "l": 1 }, { "c": 0.8999999761581421, "d": "String split to array assignment", "e": [ "split" ], "i": "micro-behaviors/data/string/split::js-split-string-array", "l": 2 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(e)\r\n\t{\r\n\t}" ], "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty", "l": 1, "m": "B0024" } ], "sha": "d716f065f0d45d5884b018c2b13fc9b9b6039f56a8049cdb674907da369f60fb", "path": "20170321_1f9962e3782d65de0ca96cc8ea1525a2.js", "type": "javascript" } ], "tv": "cf883" } }