{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.022744754, "rte": "az", "prob": 0.022744754 }, { "cls": 0, "raw": 0.03005001, "rte": "az/scripts", "prob": 0.03005001 }, { "cls": 0, "raw": 0.0013783872, "rte": "az/batch", "prob": 0.0013783872 } ], "prob": 0.022744754, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.02274475432932377 } ], "version": "v18.18", "analyzed_at": "2026-06-10T04:58:10Z" }, "path": "InstallerOfficeV14d.cmd", "raw": { "v": "7", "tv": "46abf", "files": [ { "id": 0, "mol": "O(As)H(Db)", "sha": "e03b47617a84ce41ce1bf7e745f37e2cab946461a7abf2c42874b4e7ee5222d5", "fact": { "id": "batch", "met": { "ast": { "max_depth": 13.0, "call_count": 228.0, "node_count": 2878.0, "identifier_count": 59.0, "string_literal_count": 127.0 }, "file": { "size": 17899.0, "entropy": 5.27, "size_bytes": 17899.0 }, "text": { "digit_ratio": 0.1, "space_count": 1703.0, "total_lines": 418.0, "char_entropy": 5.27, "unique_chars": 85.0, "escape_density": 0.17, "lines_over_200": 6.0, "string_density": 0.3, "ascii_art_lines": 4.0, "avg_line_length": 40.83, "max_line_length": 308.0, "empty_line_ratio": 0.14, "last_line_length": 9.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.08, "identifier_density": 0.82, "line_length_stddev": 51.27, "octal_escape_count": 15.0, "unicode_escape_count": 15.0, "normalized_string_count": 6.21, "repeated_char_sequences": 4.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 6.0, "trailing_whitespace_lines": 2.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 6.78 }, "calls": { "count": 228.0 }, "binary": { "overall_entropy": 5.27 }, "strings": { "total": 127.0, "avg_length": 28.08, "max_length": 83.0, "path_count": 1.0, "avg_entropy": 3.87, "total_bytes": 3566.0, "entropy_stddev": 0.6 }, "identifiers": { "count": 59.0, "total": 343.0, "avg_length": 7.59, "max_length": 16.0, "min_length": 1.0, "avg_entropy": 2.39, "reuse_ratio": 0.17, "unique_count": 59.0, "length_stddev": 3.76, "has_digit_ratio": 0.46, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.02, "all_lowercase_ratio": 0.31, "numeric_suffix_count": 11.0 } }, "str": [ [ 90, "u8", "%windir%\\system32\\reg.exe" ], [ 150, "u8", "%windir%\\system32\\find.exe" ], [ 211, "u8", "%windir%\\system32\\findstr.exe" ], [ 273, "u8", "%temp%\\*.burf" ], [ 294, "u8", "%temp%\\*.burf" ], [ 318, "u8", "%~dp0" ], [ 327, "u8", "%windir%\\system32\\reg.exe" ], [ 361, "u8", "HKU\\S-1-5-19" ], [ 953, "u8", "%windir%\\system32\\reg.exe" ], [ 987, "u8", "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\Environment" ], [ 1091, "u8", "amd64" ], [ 1151, "u8", "%ProgramFiles%\\Microsoft Office\\Office14\\OSPP.VBS" ], [ 1408, "u8", "%ProgramFiles(x86)%\\Microsoft Office\\Office14\\OSPP.VBS" ], [ 1553, "u8", "%windir%\\system32\\reg.exe" ], [ 1587, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\Common\\InstallRoot" ], [ 1725, "u8", "%windir%\\system32\\reg.exe" ], [ 1759, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\14.0\\Common\\InstallRoot" ], [ 2046, "u8", "%offpath%\\addins\\otkloadr_x64.dll" ], [ 2159, "u8", "%offpath%\\addins\\otkloadr.dll" ], [ 2284, "u8", "%ProgramFiles%\\Microsoft Office\\Office15\\OSPP.VBS" ], [ 2541, "u8", "%ProgramFiles(x86)%\\Microsoft Office\\Office15\\OSPP.VBS" ], [ 2686, "u8", "%windir%\\system32\\reg.exe" ], [ 2720, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\Common\\InstallRoot" ], [ 2858, "u8", "%windir%\\system32\\reg.exe" ], [ 2892, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Common\\InstallRoot" ], [ 3179, "u8", "%offpath%\\addins\\otkloadr_x64.dll" ], [ 3292, "u8", "%offpath%\\addins\\otkloadr.dll" ], [ 3417, "u8", "%ProgramFiles%\\Microsoft Office\\Office16\\OSPP.VBS" ], [ 3668, "u8", "%ProgramFiles(x86)%\\Microsoft Office\\Office16\\OSPP.VBS" ], [ 3807, "u8", "%windir%\\system32\\reg.exe" ], [ 3841, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\16.0\\Common\\InstallRoot" ], [ 3979, "u8", "%windir%\\system32\\reg.exe" ], [ 4013, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\16.0\\Common\\InstallRoot" ], [ 4294, "u8", "%offpath%\\addins\\otkloadr_x64.dll" ], [ 4407, "u8", "%offpath%\\addins\\otkloadr.dll" ], [ 4559, "u8", "%temp%\\offpath.burf" ], [ 4663, "u8", "%windir%\\system32\\reg.exe" ], [ 4697, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 4843, "u8", "%windir%\\system32\\reg.exe" ], [ 4877, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 4982, "u8", "%windir%\\system32\\reg.exe" ], [ 5016, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\14.0\\Common\\ProductVersion" ], [ 5399, "u8", "%windir%\\system32\\reg.exe" ], [ 5433, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 5579, "u8", "%windir%\\system32\\reg.exe" ], [ 5613, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 5718, "u8", "%windir%\\system32\\reg.exe" ], [ 5752, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Common\\ProductVersion" ], [ 6060, "u8", "%windir%\\system32\\reg.exe" ], [ 6094, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\16.0\\Common\\ProductVersion" ], [ 6240, "u8", "%windir%\\system32\\reg.exe" ], [ 6274, "u8", "hklm\\SOFTWARE\\Microsoft\\Office\\16.0\\Common\\ProductVersion" ], [ 6379, "u8", "%windir%\\system32\\reg.exe" ], [ 6413, "u8", "hklm\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\16.0\\Common\\ProductVersion" ], [ 6669, "u8", "%loc%" ], [ 6682, "u8", "%temp%\\prodver.burf" ], [ 7197, "u8", "%windir%\\system32\\findstr.exe" ], [ 7235, "u8", "kb2687455" ], [ 7247, "u8", "%temp%\\update1.burf" ], [ 7294, "u8", "%windir%\\system32\\findstr.exe" ], [ 7332, "u8", "superseded" ], [ 7345, "u8", "%temp%\\update1a.burf" ], [ 7589, "u8", "%windir%\\system32\\findstr.exe" ], [ 7627, "u8", "kb2817430" ], [ 7639, "u8", "%temp%\\update2.burf" ], [ 7686, "u8", "%windir%\\system32\\findstr.exe" ], [ 7724, "u8", "superseded" ], [ 7737, "u8", "%temp%\\update2a.burf" ], [ 7981, "u8", "%windir%\\system32\\findstr.exe" ], [ 8019, "u8", "kb2817430" ], [ 8031, "u8", "%temp%\\update3.burf" ], [ 8078, "u8", "%windir%\\system32\\findstr.exe" ], [ 8116, "u8", "superseded" ], [ 8129, "u8", "%temp%\\update3a.burf" ], [ 8503, "u8", "%windir%\\system32\\reg.exe" ], [ 8537, "u8", "hklm\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products" ], [ 8626, "u8", "(KB" ], [ 8671, "u8", "%windir%\\system32\\find.exe" ], [ 8703, "u8", "Update" ], [ 8712, "u8", "%temp%\\installed.burf" ], [ 8763, "u8", "%windir%\\system32\\find.exe" ], [ 8795, "u8", "Hotfix" ], [ 8804, "u8", "%temp%\\installed.burf" ], [ 8981, "u8", "%temp%\\installed3.burf" ], [ 9084, "u8", "%windir%\\system32\\findstr.exe" ], [ 9125, "u8", "%temp%\\installed3.burf" ], [ 9150, "u8", "%temp%\\filelist1.burf" ], [ 9225, "u8", "%windir%\\system32\\findstr.exe" ], [ 9266, "u8", "%temp%\\installed3.burf" ], [ 9291, "u8", "%temp%\\filelist2.burf" ], [ 9366, "u8", "%windir%\\system32\\findstr.exe" ], [ 9407, "u8", "%temp%\\installed3.burf" ], [ 9432, "u8", "%temp%\\filelist3.burf" ], [ 9535, "u8", "%temp%\\filelist1.burf" ], [ 9568, "u8", "%temp%\\filelist1.burf" ], [ 9592, "u8", "%temp%\\installer1.burf" ], [ 9633, "u8", "%temp%\\filelist2.burf" ], [ 9666, "u8", "%temp%\\filelist2.burf" ], [ 9690, "u8", "%temp%\\installer2.burf" ], [ 9731, "u8", "%temp%\\filelist3.burf" ], [ 9764, "u8", "%temp%\\filelist3.burf" ], [ 9788, "u8", "%temp%\\installer3.burf" ], [ 9834, "u8", "%temp%\\installer1.burf" ], [ 9940, "u8", "%temp%\\installer2.burf" ], [ 10046, "u8", "%temp%\\installer3.burf" ], [ 10192, "u8", "%temp%\\installer1.burf" ], [ 10269, "u8", "%temp%\\installer2.burf" ], [ 10346, "u8", "%temp%\\installer3.burf" ], [ 10488, "u8", "%temp%\\installer1.burf" ], [ 10657, "u8", "%temp%\\installer2.burf" ], [ 10826, "u8", "%temp%\\installer3.burf" ], [ 11293, "u8", "%installer%" ], [ 12172, "u8", "Please enter your selection\u003e " ], [ 12388, "u8", "%temp%\\*.burf" ], [ 12408, "u8", "%temp%\\*.burf" ], [ 12434, "u8", "%temp%\\opatchinstall*.log" ], [ 12466, "u8", "%temp%\\opatchinstall*.log" ], [ 12504, "u8", "%temp%\\*_MSPLOG.LOG" ], [ 12530, "u8", "%temp%\\*_MSPLOG.LOG" ], [ 13241, "u8", "Please enter your selection\u003e " ], [ 15018, "u8", "%windir%\\system32\\findstr.exe" ], [ 15053, "u8", "kb2687455" ], [ 15065, "u8", "%temp%\\update1.burf" ], [ 15198, "u8", "%windir%\\system32\\findstr.exe" ], [ 15233, "u8", "kb2883095" ], [ 15245, "u8", "%temp%\\update2.burf" ], [ 16502, "u8", "%installer%" ] ], "val": { "file.stem": "InstallerOfficeV14d", "file.basename": "InstallerOfficeV14d.cmd", "source.language": "batch" } }, "find": [ { "ev": [ "if exist \"%temp%\\*.burf\" (" ], "id": "micro-behaviors/fs/path/check::batch-multiple-if-exist-gates", "conf": 0.8199999928474426, "crit": 1, "desc": "Batch multiple file gates" }, { "ev": [ "\u003enul" ], "id": "objectives/command-and-control/dropper/execution/batch::redirect-null", "conf": 0.699999988079071, "crit": 1, "desc": "Redirect output to null" }, { "ev": [ "/quiet" ], "id": "objectives/execution/lolbin/os::msiexec-unattended-switch", "conf": 0.8799999952316284, "crit": 1, "desc": "msiexec unattended install switch" }, { "ev": [ "@echo off" ], "id": "objectives/command-and-control/dropper/execution/batch::echo-off", "conf": 0.6000000238418579, "crit": 1, "desc": "Echo off" }, { "ev": [ "call :title" ], "id": "objectives/command-and-control/dropper/execution/batch::call-label", "conf": 0.4000000059604645, "crit": 1, "desc": "Call local batch label" }, { "ev": [ "\u003enul" ], "id": "micro-behaviors/os/console/io::windows-stdout-to-nul", "conf": 0.550000011920929, "crit": 2, "desc": "Stdout redirected to NUL" }, { "ev": [ "%TEMP%" ], "id": "micro-behaviors/os/env/vars/access::temp-env-var", "conf": 1.0, "crit": 2, "desc": "Contains %TEMP% environment variable string" }, { "ev": [ "echo %installer%" ], "id": "objectives/command-and-control/dropper/builder::echo-percent", "conf": 1.0, "crit": 1, "desc": "echo percent batch pattern" }, { "ev": [ "clipboard" ], "id": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "conf": 0.6000000238418579, "crit": 1, "desc": "Clipboard keyword" }, { "ev": [ "%temp%" ], "id": "micro-behaviors/fs/path/temp::win-temp-env", "conf": 0.699999988079071, "crit": 2, "desc": "Windows %TEMP% or %TMP% environment reference" }, { "ev": [ "prompt" ], "id": "micro-behaviors/data/text/llm/override::llm-instruction-context", "conf": 0.7200000286102295, "crit": 1, "desc": "LLM instruction context" }, { "ev": [ "start" ], "id": "objectives/command-and-control/dropper/execution/batch::keyed-temp-payload-launch--rx-1", "conf": 0.949999988079071, "crit": 1, "desc": "Regex component marker" }, { "ev": [ "InstallerOfficeV14d.cmd" ], "id": "metadata/file/extension::cmd", "conf": 1.0, "crit": 2, "desc": "Windows command script extension" }, { "ev": [ "text.total_lines = 418.00" ], "id": "metadata/file/text/metrics::file-has-30-plus-lines", "conf": 0.8999999761581421, "crit": 1, "desc": "File has 30 or more lines" }, { "ev": [ ":start" ], "id": "micro-behaviors/data/control-flow/loop::batch-label-start", "conf": 0.800000011920929, "crit": 3, "desc": "Batch start label" }, { "ev": [ "Run" ], "id": "objectives/persistence/login/startup/registry::run-value-name", "atk": "T1547.001", "conf": 0.6000000238418579, "crit": 1, "desc": "Run value name string" }, { "ev": [ "@echo off" ], "id": "objectives/command-and-control/dropper/builder::echo-off-batch", "conf": 1.0, "crit": 1, "desc": "echo off batch command" }, { "ev": [ ".dll" ], "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference" }, { "ev": [ " location\r" ], "id": "objectives/command-and-control/dropper/execution/batch::rc4-key-argument-hint", "atk": "T1105", "conf": 0.7799999713897705, "crit": 1, "desc": "Loader key argument hint" }, { "ev": [ "Environment" ], "id": "micro-behaviors/data/text/keywords/env::environment-keyword", "conf": 1.0, "crit": 1, "desc": "\"Environment\" keyword" }, { "ev": [ "office2010check" ], "id": "objectives/anti-static/obfuscation/name-mangling/variables::numeric-infix", "conf": 0.800000011920929, "crit": 4, "desc": "Numeric infix obfuscation (e.g. com0715press)" }, { "ev": [ "clipboard" ], "id": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11763", "conf": 0.8399999737739563, "crit": 1, "desc": "clipboard keyword (doc-context)" }, { "ev": [ ".exe" ], "id": "micro-behaviors/fs/path/extension::exe-dup", "crit": 2, "desc": ".exe extension reference" } ], "path": "InstallerOfficeV14d.cmd", "risk": 34, "size": 17899, "type": "batch" } ] } }