{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.8505155,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.7714286,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-15T01:26:51Z"
  },
  "path": "dab0bc1333b18f05d31702b0d59c99ca76a65365c94836c9d58269e09e418dc0.ps1",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(AsEr)",
        "k": {
          "source.strings[0]": "\r\n[DllImport(\"kernel32.dll\")]\r\npublic static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);\r\n[DllImport(\"kernel32.dll\")]\r\npublic static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);\r\n"
        },
        "x": 68,
        "id": 0,
        "ms": {
          "file": {
            "size": 3226.0
          },
          "text": {
            "digit_ratio": 0.48,
            "space_count": 42.0,
            "total_lines": 17.0,
            "char_entropy": 4.37,
            "unique_chars": 73.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 0.24,
            "avg_line_length": 187.76,
            "lines_over_1000": 1.0,
            "max_line_length": 2506.0,
            "empty_line_ratio": 0.35,
            "last_line_length": 48.0,
            "long_token_count": 1.0,
            "most_common_char": "0",
            "whitespace_ratio": 0.02,
            "most_common_ratio": 0.19,
            "line_length_stddev": 581.74,
            "normalized_string_count": 0.97,
            "max_inline_whitespace_run": 1.0
          },
          "strings": {
            "total": 4.0,
            "avg_length": 177.0,
            "max_length": 349.0,
            "avg_entropy": 3.58,
            "total_bytes": 708.0,
            "entropy_stddev": 1.26
          },
          "comments": {},
          "functions": {},
          "identifiers": {}
        },
        "ss": [
          [
            13,
            "\r\n[DllImport(\"kernel32.dll\")]\r\npublic static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, ui"
          ],
          [
            13,
            "\r\n[DllImport(\"kernel32.dll\")]\r\npublic static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, ui"
          ],
          [
            422,
            "Win32"
          ],
          [
            422,
            "Win32"
          ]
        ],
        "sz": 3226,
        "ts": [
          {
            "a": "T1055",
            "c": 0.8399999737739563,
            "d": "kernel32 DLL import in script",
            "e": [
              "kernel32.dll"
            ],
            "i": "objectives/evasion/process/injection/runtime::ps-kernel32-dllimport",
            "l": 4,
            "m": "B0033"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Architecture keyed encoded blob value",
            "e": [
              "0x41,0x51,0x41,0x50,0x52,0x48,0x31,0xd2,0x51,0x65,0x48,0x8b,0x52,0x60,0x56,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.7799999713897705,
            "d": "PowerShell type accelerator syntax",
            "e": [
              "[Math]::"
            ],
            "i": "metadata/lang/scripted::type-accelerator",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.6000000238418579,
            "d": "No comments in PowerShell script",
            "e": [
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-no-comments",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 2506.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Suspicious long PowerShell line",
            "e": [
              "text.max_line_length = 2506.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::ps-suspicious-single-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Low identifier reuse ratio",
            "e": [
              "identifiers.reuse_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::low-identifier-reuse",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.6000000238418579,
            "d": "No comments in code",
            "e": [
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Minified/compressed code (multiple indicators)",
            "e": [
              "text.whitespace_ratio = 0.02",
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code",
            "l": 2,
            "m": "B0032"
          }
        ],
        "sha": "dab0bc1333b18f05d31702b0d59c99ca76a65365c94836c9d58269e09e418dc0",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-12/dab0bc1333b18f05d31702b0d59c99ca76a65365c94836c9d58269e09e418dc0.ps1",
        "type": "powershell"
      }
    ],
    "tv": "08128"
  }
}