{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 1
      }
    ],
    "prob": 1.0,
    "class": 1,
    "models": [
      {
        "m": "az",
        "prob": 0.6687533,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.7058824,
        "class": 0
      },
      {
        "m": "az/kotlin",
        "prob": 1.0,
        "class": 1
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-15T10:22:20Z"
  },
  "path": "VirusShare_ab1ae58da23007cca77ca606ec964489",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(As₃Xe)",
        "k": {
          "source.imports[0]": "after",
          "source.imports[1]": "calculatePageScrollDistance",
          "source.imports[2]": "callback",
          "source.imports[3]": "clearInterval",
          "source.imports[4]": "expandingGrid",
          "source.imports[5]": "extend",
          "source.imports[6]": "function",
          "source.imports[7]": "getLastSiblingInRow",
          "source.imports[8]": "jQuery",
          "source.imports[9]": "positionSpacer",
          "source.strings[0]": "close-button",
          "source.strings[1]": "spacer",
          "source.strings[2]": "use strict",
          "source.has_imports": true,
          "source.imports[10]": "requestAnimationFrame",
          "source.imports[11]": "resize",
          "source.imports[12]": "scrollSectionIntoView",
          "source.imports[13]": "setInterval",
          "source.imports[14]": "setTimeout",
          "source.imports[15]": "stopExpandedAreaMonitor",
          "source.imports[16]": "syncExpandedAreaWithSpacer",
          "source.imports[17]": "tick"
        },
        "x": 32,
        "id": 0,
        "is": [
          "function",
          "function",
          "function",
          "function",
          "function",
          "function",
          "extend",
          "function",
          "calculatePageScrollDistance",
          "function",
          "requestAnimationFrame",
          "setTimeout",
          "callback",
          "tick",
          "function",
          "function",
          "function",
          "getLastSiblingInRow",
          "after",
          "function",
          "function",
          "stopExpandedAreaMonitor",
          "function",
          "function",
          "setInterval",
          "function",
          "syncExpandedAreaWithSpacer",
          "scrollSectionIntoView",
          "function",
          "function",
          "function",
          "scrollSectionIntoView",
          "stopExpandedAreaMonitor",
          "function",
          "clearInterval",
          "function",
          "function",
          "getLastSiblingInRow",
          "after",
          "resize",
          "function",
          "positionSpacer",
          "syncExpandedAreaWithSpacer",
          "function",
          "function",
          "expandingGrid",
          "jQuery",
          "function",
          "jQuery"
        ],
        "ms": {
          "file": {
            "size": 12172.0
          },
          "text": {
            "tab_count": 881.0,
            "digit_ratio": 0.05,
            "space_count": 817.0,
            "total_lines": 324.0,
            "char_entropy": 5.24,
            "mixed_indent": true,
            "unique_chars": 90.0,
            "import_density": 15.12,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 0.03,
            "avg_line_length": 35.57,
            "high_byte_ratio": 0.0,
            "lines_over_1000": 1.0,
            "max_line_length": 1507.0,
            "non_ascii_ratio": 0.0,
            "empty_line_ratio": 0.13,
            "last_line_length": 3.0,
            "long_token_count": 3.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.19,
            "most_common_ratio": 0.07,
            "line_length_stddev": 86.56,
            "normalized_import_count": 2.72,
            "normalized_string_count": 0.56,
            "repeated_char_sequences": 2.0,
            "suspicious_comment_ratio": 0.03,
            "max_inline_whitespace_run": 1.0
          },
          "imports": {
            "total": 49.0,
            "unique_modules": 18.0,
            "third_party_count": 49.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 10.0,
            "avg_length": 6.6,
            "max_length": 12.0,
            "avg_entropy": 2.15,
            "total_bytes": 66.0,
            "entropy_stddev": 1.15
          },
          "comments": {
            "chars": 1638.0,
            "lines": 55.0,
            "total": 36.0,
            "to_code_ratio": 0.2,
            "url_in_comments": 1.0,
            "high_entropy_comments": 1.0
          },
          "functions": {},
          "identifiers": {}
        },
        "ss": [
          [
            1654,
            "use strict"
          ],
          [
            1655,
            "use strict"
          ],
          [
            3506,
            "#"
          ],
          [
            3507,
            "#"
          ],
          [
            3516,
            "close-button"
          ],
          [
            3517,
            "close-button"
          ],
          [
            3573,
            "spacer"
          ],
          [
            3574,
            "spacer"
          ],
          [
            3594,
            "true"
          ],
          [
            3595,
            "true"
          ]
        ],
        "sz": 12172,
        "ts": [
          {
            "c": 1.0,
            "d": "Regex component marker",
            "e": [
              "isExpanded = false;"
            ],
            "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976",
            "l": 1
          },
          {
            "d": "hide keyword",
            "e": [
              "hide"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::hide",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "DOM write API innerHTML or appendChild",
            "e": [
              "appendChild"
            ],
            "i": "objectives/impact/ui/delivery::dynamic-ad-injection-dom-api-a",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "sync"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-storage-proxy-ops--rx-16",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Triple Date retrieval (AST)",
            "e": [
              "Date"
            ],
            "i": "objectives/anti-analysis/timing/jitter::js-triple-date-ast",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript undefined literal",
            "e": [
              "undefined"
            ],
            "i": "metadata/lang/scripted::undefined-literal",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "\"store\" doc cue (storage instruction)",
            "e": [
              "store"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript many imported modules",
            "e": [
              "imports.unique_modules = 134.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::js-many-import-modules",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Large import graph base64 context",
            "e": [
              "imports.unique_modules = 134.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1497.001",
            "c": 0.75,
            "d": "Compares value against undefined string",
            "e": [
              "== 'undefined'"
            ],
            "i": "objectives/anti-analysis/environment-detect/wsh::env-check-undefined-compare",
            "l": 1,
            "m": "B0003"
          },
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Deep function nesting",
            "e": [
              "functions.max_nesting_depth = 6.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::deep-nesting",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "match"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-data--rx-25",
            "l": 1
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "filter"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-core--rx-6",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Package references CHANGES",
            "e": [
              "changes"
            ],
            "i": "metadata/package/documentation::references-changelog-changes",
            "l": 2
          },
          {
            "a": "T1497.001",
            "d": "Multiple Date object creations in proximity",
            "e": [
              "Date"
            ],
            "i": "objectives/anti-analysis/timing/evasion::js-date-loop",
            "l": 1,
            "m": "B0001.032"
          },
          {
            "c": 0.800000011920929,
            "d": "String.fromCharCode fragment (CharCode)",
            "e": [
              "CharCode"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-charcode",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript console object",
            "e": [
              "console"
            ],
            "i": "micro-behaviors/os/console/io::js-console-object",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "DOM write API insertBefore",
            "e": [
              "insertBefore"
            ],
            "i": "objectives/impact/ui/delivery::dynamic-ad-injection-dom-api-b",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 1507.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "remove"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-storage-proxy-ops--rx-14",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Hidden directory path literal",
            "e": [
              ".expanding-container",
              ".expanding-grid"
            ],
            "i": "micro-behaviors/fs/path/location::hidden-dir-literal",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "use strict directive string",
            "e": [
              "use strict"
            ],
            "i": "metadata/package/tooling::use-strict-quote",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DOM or CSS size property",
            "e": [
              "height"
            ],
            "i": "micro-behaviors/ui/window/manage/dom::size-prop",
            "l": 1
          },
          {
            "a": "T1056",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "document"
            ],
            "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5",
            "l": 1
          },
          {
            "a": "T1204.001",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "enable"
            ],
            "i": "objectives/execution/lure/video-meeting::meeting-device-permission-lure--rx-5",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "String.fromCharCode fragment (romChar)",
            "e": [
              "romChar"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-romchar",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "\"to the\" doc cue",
            "e": [
              "to the"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11768",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "String.fromCharCode() assembly",
            "e": [
              "String.fromCharCode("
            ],
            "i": "micro-behaviors/data/encode/charcode::from-char-code",
            "l": 1
          },
          {
            "a": "T1090.004",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "append"
            ],
            "i": "objectives/command-and-control/infrastructure/dns-pin::js-hosts-file-write--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 1.0,
            "d": "Triple Date/Time retrieval (raw)",
            "e": [
              "new Date("
            ],
            "i": "objectives/anti-analysis/timing/jitter::js-triple-date-raw",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Many unique import modules",
            "e": [
              "imports.unique_modules = 134.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1547.015",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "defaults"
            ],
            "i": "objectives/persistence/login/items::defaults-write-loginhook--rx-6",
            "l": 1
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "filter"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-data--rx-24",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "plugin"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::management-id-comparison--rx-10",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "JavaScript Date object construction",
            "e": [
              "new Date"
            ],
            "i": "micro-behaviors/time/query::js-new-date",
            "l": 2
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "match"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-infra--rx-18",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "String.fromCharCode"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/arithmetic::js-rot-n-charcode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "global"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::global-dunder-token--rx-15",
            "l": 1
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "match"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-core--rx-8",
            "l": 1
          },
          {
            "a": "T1565.001",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "request"
            ],
            "i": "objectives/impact/crypto-manipulation/transfer-hijack::provider-request-wrapper--rx-10",
            "l": 1,
            "m": "B0020"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Low string density base64 context",
            "e": [
              "text.string_density = 0.15"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "c": 0.699999988079071,
            "d": "Programmatic anchor click trigger",
            "e": [
              "$closeButton.click()"
            ],
            "i": "objectives/command-and-control/dropper/delivery/html::drive-by-anchor-click",
            "l": 1,
            "m": "F0007"
          },
          {
            "a": "T1552.001",
            "c": 0.8199999928474426,
            "d": "Regex component marker",
            "e": [
              "filter"
            ],
            "i": "objectives/credential-access/env/secrets/filtered-access::env-secret-filter-infra--rx-17",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 324.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Many random-looking source identifier names",
            "e": [
              "identifiers.high_entropy_ratio = 0.28"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Large random variable names (obfuscation)",
            "e": [
              "var calculatePageScrollDistance"
            ],
            "i": "objectives/anti-static/obfuscation/string/array::large-random-variables",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Assigning 'this' (global object) to a variable",
            "e": [
              "clickedLink = this;"
            ],
            "i": "objectives/execution/interpreter/eval/dynamic::js-assign-global-this",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Many no-param functions",
            "e": [
              "functions.no_params_count = 28.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Multi-arity fromCharCode decoder",
            "e": [
              "String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,11"
            ],
            "i": "objectives/anti-static/obfuscation/syntax::js-multi-charcode-decoder",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "javascript code embedded in string",
            "e": [
              "Detected javascript at offset 0x0"
            ],
            "i": "metadata/lang/embedded::javascript",
            "l": 2
          }
        ],
        "sha": "de636c619f3340f6e1e67beaf19e4c5a0215e8b01f5c00498396ecd6d7b78e92",
        "path": "VirusShare_ab1ae58da23007cca77ca606ec964489",
        "type": "kotlin"
      }
    ],
    "tv": "08128"
  }
}