{
  "ml": {
    "l": 0,
    "v": "6",
    "fs": [
      {
        "l": 0,
        "id": 0,
        "prob": 1.0
      }
    ],
    "prob": 1.0,
    "models": [
      {
        "m": "az",
        "prob": 0.9434439,
        "class": 2
      },
      {
        "m": "az/scripts",
        "prob": 0.9949893,
        "class": 2
      },
      {
        "m": "az/javascript",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-01T18:20:00Z"
  },
  "path": "d7cbf75edd0d663a89b4fb21bfb477cc957f98521fac9fa502d65c4e3c424253.js",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O₂(As₂C)",
        "x": 70,
        "ff": {
          "m": {
            "file": {
              "size": 3144353.0,
              "entropy": 4.71,
              "size_bytes": 3144353.0
            },
            "text": {
              "digit_ratio": 0.0,
              "space_count": 981.0,
              "total_lines": 972.0,
              "char_entropy": 4.71,
              "unique_chars": 79.0,
              "lines_over_200": 972.0,
              "lines_over_500": 972.0,
              "avg_line_length": 3232.93,
              "lines_over_1000": 972.0,
              "max_line_length": 1109170.0,
              "last_line_length": 1845.0,
              "long_token_count": 1953.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.04,
              "line_length_stddev": 36044.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0
            },
            "binary": {
              "overall_entropy": 4.71
            }
          },
          "s": [
            [
              788746,
              "xor",
              "228.254.7.7"
            ]
          ],
          "v": {
            "file.stem": "d7cbf75edd0d663a89b4fb21bfb477cc957f98521fac9fa502d65c4e3c424253",
            "file.basename": "d7cbf75edd0d663a89b4fb21bfb477cc957f98521fac9fa502d65c4e3c424253.js",
            "source.strings[0]": "228.254.7.7"
          },
          "id": "javascript"
        },
        "id": 0,
        "sz": 3144353,
        "ts": [
          {
            "a": "T1565.001",
            "c": 0.8500000238418579,
            "d": "mwti (MicroWorld eScan parent)",
            "e": [
              "mwti"
            ],
            "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-6",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.8500000238418579,
            "d": "JScript loader with high entropy comments",
            "e": [
              "\n//fbbehbdetqeuspxmlhddvilepmwqdiyeewahlwvzykkgdofqxderdapzrvplbljdcathqjtzdyzluopvyxatdozbujprftlcqhaqpeisuebfrccicohquerzzbhmw"
            ],
            "i": "objectives/command-and-control/dropper/execution/script-dropper::obfuscated-jscript-signed-entropy-loader",
            "l": 4
          },
          {
            "c": 0.30000001192092896,
            "d": "secret keyword",
            "e": [
              "secret"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::secret",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "Desal"
            ],
            "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-76",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "d7cbf75edd0d663a89b4fb21bfb477cc957f98521fac9fa502d65c4e3c424253.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "c": 0.9200000166893005,
            "d": "Large minified JavaScript bundle",
            "e": [
              "text.max_line_length = 1109170.00"
            ],
            "i": "metadata/library/structure::js-large-minified-bundle",
            "l": 2
          },
          {
            "d": "overflow keyword",
            "e": [
              "overflow"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::overflow",
            "l": 1
          },
          {
            "a": "T1048.003",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "live"
            ],
            "i": "objectives/supply-chain/recon-exfil/dns::dns-lookup-with-canary-domain--rx-6",
            "l": 1,
            "m": "E1041"
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "info"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-4",
            "l": 1
          },
          {
            "a": "T1005",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "kdbx"
            ],
            "i": "objectives/collection/stealer/tactics::office-secret-extension-list--rx-5",
            "l": 1,
            "m": "B0028"
          },
          {
            "a": "T1204.001",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "allow"
            ],
            "i": "objectives/execution/lure/video-meeting::meeting-device-permission-lure--rx-6",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 972.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "warn"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-5",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Function constructor keyword",
            "e": [
              "Function"
            ],
            "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 1109170.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1005",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "ovpn"
            ],
            "i": "objectives/collection/stealer/tactics::office-secret-extension-list--rx-6",
            "l": 1,
            "m": "B0028"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 1845.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 0.949999988079071,
            "d": "A single line exceeds 50,000 characters",
            "e": [
              "text.max_line_length = 1109170.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/runtime::high-max-line-length",
            "l": 1
          },
          {
            "a": "T1555",
            "c": 1.0,
            "d": "FakeWallet ciyu parameter",
            "e": [
              "ciyu"
            ],
            "i": "well-known/malware/stealer/fakewallet::exfil-param-ciyu",
            "l": 1,
            "m": "B0028"
          },
          {
            "a": "T1539",
            "c": 0.800000011920929,
            "d": "Filters vwo/vis_opt cookies to evade analytics",
            "e": [
              "vwo"
            ],
            "i": "objectives/collection/stealer/browser::cookie-filter-vwo-vis-opt",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Medium minified JavaScript line",
            "e": [
              "text.max_line_length = 1109170.00"
            ],
            "i": "metadata/library/structure::js-medium-minified-line",
            "l": 1
          },
          {
            "a": "T1195.002, T1059.007",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "wmic"
            ],
            "i": "objectives/supply-chain/hidden-payload/runtime::worker-host-serial-assessment--rx-14",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "d7cbf75edd0d663a89b4fb21bfb477cc957f98521fac9fa502d65c4e3c424253.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8799999952316284,
            "d": "Single-line packed JavaScript loader profile",
            "e": [
              "text.max_line_length = 1109170.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::single-line-packed-loader-metrics",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "JS/TS line exceeds 1 MB",
            "e": [
              "text.max_line_length = 1109170.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-megabyte-single-line",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8799999952316284,
            "d": "Multiple source lines exceed 1000 chars",
            "e": [
              "text.lines_over_1000 = 972.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-layout",
            "l": 4,
            "m": "B0032"
          }
        ],
        "sha": "d7cbf75edd0d663a89b4fb21bfb477cc957f98521fac9fa502d65c4e3c424253",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-11/d7cbf75edd0d663a89b4fb21bfb477cc957f98521fac9fa502d65c4e3c424253.js",
        "type": "javascript"
      }
    ],
    "tv": "961ce"
  }
}