{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/scripts", "prob": 0.48895434, "class": 0 }, { "m": "az/javascript", "prob": 0.43715847, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T08:18:11Z" }, "path": "e76751c74f219b9023cb75af324be212ead5bac17ce38267904597360304dacd.js", "raw": { "v": "5", "fs": [ { "f": "O₂(AsC)", "x": 3, "ff": { "i": [ [ "", "superString" ], [ "", "xmlDOM" ], [ "", "WSH.CreateObject.createElement" ], [ "", "WSH.CreateObject" ], [ "", "xmlDOM.dataType" ], [ "", "xmlDOM.text" ], [ "", "superString.replace" ], [ "", "comObject" ], [ "", "WSH.CreateObject" ], [ "", "comObject.Type" ], [ "", "comObject.Open" ], [ "", "comObject.Write" ], [ "", "comObject.Position" ], [ "", "comObject.Type" ], [ "", "comObject.CharSet" ], [ "", "eval" ], [ "", "comObject.ReadText" ] ], "m": { "ast": { "max_depth": 8.0, "bind_count": 9.0, "call_count": 8.0, "node_count": 230.0, "member_count": 12.0, "identifier_count": 5.0, "member_depth_max": 3.0, "string_literal_count": 21.0 }, "file": { "size": 18470.0, "entropy": 5.76, "size_bytes": 18470.0 }, "text": { "digit_ratio": 0.1, "space_count": 22.0, "total_lines": 12.0, "char_entropy": 5.76, "unique_chars": 78.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 1.75, "avg_line_length": 1537.33, "lines_over_1000": 1.0, "max_line_length": 18028.0, "last_line_length": 30.0, "long_token_count": 1.0, "whitespace_ratio": 0.0, "most_common_ratio": 0.05, "identifier_density": 1.42, "line_length_stddev": 4972.15, "normalized_string_count": 6.06, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 86.0, "normalized_unique_identifiers": 1.39 }, "binds": { "count": 9.0 }, "calls": { "count": 8.0 }, "members": { "count": 12.0 }, "strings": { "total": 21.0, "avg_length": 865.1, "max_length": 18007.0, "avg_entropy": 2.62, "total_bytes": 18167.0, "entropy_stddev": 1.03, "very_long_strings": 1.0, "high_entropy_count": 1.0 }, "identifiers": { "count": 5.0, "total": 17.0, "avg_length": 6.6, "max_length": 11.0, "min_length": 3.0, "avg_entropy": 2.48, "reuse_ratio": 0.29, "unique_count": 5.0, "length_stddev": 3.01, "all_lowercase_ratio": 0.2, "all_uppercase_ratio": 0.2 } }, "s": [ [ 18047, "u8", "CreateObject" ], [ 18048, "u8", "CreateObject" ], [ 18063, "u8", "microsoft.xmldom" ], [ 18064, "u8", "microsoft.xmldom" ], [ 18083, "u8", "createElement" ], [ 18084, "u8", "createElement" ], [ 18100, "u8", "mko" ], [ 18101, "u8", "mko" ], [ 18116, "u8", "dataType" ], [ 18117, "u8", "dataType" ], [ 18130, "u8", "bin.base64" ], [ 18131, "u8", "bin.base64" ], [ 18152, "u8", "text" ], [ 18153, "u8", "text" ], [ 18174, "u8", "replace" ], [ 18175, "u8", "replace" ], [ 18192, "u8", "A" ], [ 18193, "u8", "A" ], [ 18219, "u8", "CreateObject" ], [ 18220, "u8", "CreateObject" ], [ 18235, "u8", "adodb.stream" ], [ 18236, "u8", "adodb.stream" ], [ 18263, "u8", "Type" ], [ 18264, "u8", "Type" ], [ 18273, "16", "1" ], [ 18289, "u8", "Open" ], [ 18290, "u8", "Open" ], [ 18311, "u8", "Write" ], [ 18312, "u8", "Write" ], [ 18327, "u8", "nodeTypedValue" ], [ 18328, "u8", "nodeTypedValue" ], [ 18358, "u8", "Position" ], [ 18359, "u8", "Position" ], [ 18372, "16", "0" ], [ 18388, "u8", "Type" ], [ 18389, "u8", "Type" ], [ 18398, "16", "2" ], [ 18414, "u8", "CharSet" ], [ 18415, "u8", "CharSet" ], [ 18427, "u8", "us-ascii" ], [ 18428, "u8", "us-ascii" ], [ 18455, "u8", "ReadText" ], [ 18456, "u8", "ReadText" ] ], "v": { "file.stem": "e76751c74f219b9023cb75af324be212ead5bac17ce38267904597360304dacd", "file.basename": "e76751c74f219b9023cb75af324be212ead5bac17ce38267904597360304dacd.js", "source.language": "javascript", "source.imports[0]": "WSH.CreateObject", "source.imports[1]": "WSH.CreateObject.createElement", "source.imports[2]": "comObject", "source.imports[3]": "comObject.CharSet", "source.imports[4]": "comObject.Open", "source.imports[5]": "comObject.Position", "source.imports[6]": "comObject.ReadText", "source.imports[7]": "comObject.Type", "source.imports[8]": "comObject.Write", "source.imports[9]": "eval", "source.strings[0]": "CharSet", "source.strings[1]": "CreateObject", "source.strings[2]": "Position", "source.strings[3]": "ReadText", "source.strings[4]": "adodb.stream", "source.strings[5]": "bin.base64", "source.strings[6]": "createElement", "source.strings[7]": "dataType", "source.strings[8]": "microsoft.xmldom", "source.strings[9]": "nodeTypedValue", "source.has_imports": true, "source.imports[10]": "superString", "source.imports[11]": "superString.replace", "source.imports[12]": "xmlDOM", "source.imports[13]": "xmlDOM.dataType", "source.imports[14]": "xmlDOM.text", "source.strings[10]": "replace", "source.strings[11]": "us-ascii" }, "ct": [ "WSH.CreateObject", "WSH.CreateObject().createElement", "comObject.Open", "comObject.ReadText", "comObject.Write", "eval", "superString.replace" ], "id": "javascript", "mc": [ "WSH.CreateObject", "WSH.CreateObject().createElement", "comObject.CharSet", "comObject.Open", "comObject.Position", "comObject.ReadText", "comObject.Type", "comObject.Write", "superString.replace", "xmlDOM.dataType", "xmlDOM.nodeTypedValue", "xmlDOM.text" ] }, "id": 0, "sz": 18470, "ts": [ { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "DOM createElement string literal", "e": [ "createElement" ], "i": "micro-behaviors/process/create/load/remote-code::js-dom-createelement-literal", "l": 1, "el": [ "0x46a3" ] }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 18028.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.8199999928474426, "d": "JavaScript static key string assignment", "e": [ "= 'dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtRnlJSE4xY0dWeVUzUnlhVzVuSUQwZ0oweDVPR2RSTWpscldsZFJaMWx1YTJka2JEbERUVVJGWjJaRFFsUmlSMnhzWWxkV" ], "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 12.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.949999988079071, "d": "JavaScript or TypeScript basename", "e": [ "e76751c74f219b9023cb75af324be212ead5bac17ce38267904597360304dacd.js" ], "i": "metadata/lang/source::js-ts-source-basename", "l": 2 }, { "c": 0.949999988079071, "d": "eval/new Function call (flatted tamper fragment)", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 12.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 1.0, "d": "JavaScript file basename", "e": [ "e76751c74f219b9023cb75af324be212ead5bac17ce38267904597360304dacd.js" ], "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "l": 1 }, { "c": 1.0, "d": "ADODB.Stream Open method call", "e": [ "['Open'](" ], "i": "micro-behaviors/fs/write/stream::adodb-open", "l": 1 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 2 }, { "c": 1.0, "d": "Obfuscated String method call (String[...])", "e": [ "String[" ], "i": "micro-behaviors/data/source/syntax/keyword::js-obfuscated-string-method", "l": 2 }, { "a": "T1027.013", "c": 0.800000011920929, "d": "Single ≥1024 char encoded blob literal", "e": [ "dHJ5ewp2YXIgbG9uZ1RleHQxID0gImRtRnlJSE4xY0dWeVUzUnlhVzVuSUQwZ0oweDVPR2RSTWpscldsZFJaMWx1YTJka2JEbERUVVJGWjJaRFFsUmlSMnhzWWxkV2VW" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::large-ciphertext-blob-literal", "l": 3, "m": "B0032" }, { "a": "T1555", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "base64" ], "i": "objectives/credential-access/wallet/solana::solana-secretkey-serialization--rx-6", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.76" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "base64" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-multi-line-blob-benign-text--rx-8", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Embedded string exceeds 3000 chars", "e": [ "strings.max_length = 18007.00" ], "i": "objectives/command-and-control/dropper/execution/script-dropper::js-max-string-over-3000", "l": 3 } ], "sha": "e76751c74f219b9023cb75af324be212ead5bac17ce38267904597360304dacd", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-07/e76751c74f219b9023cb75af324be212ead5bac17ce38267904597360304dacd.js", "type": "javascript" } ], "tv": "52045" } }