{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9975002408027649,
        "class": 2,
        "threshold": 0.9922832250595093
      }
    ],
    "prob": 0.99750024,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.99750024,
        "class": 2
      },
      {
        "m": "az/scripts",
        "prob": 0.99918854,
        "class": 2
      },
      {
        "m": "az/batch",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9922832,
    "analyzed_at": "2026-05-31T01:03:50Z"
  },
  "path": "f1744e6fe16fd0ef564400f3ea64a60b4b1609264ccfd9badef00a1617473002.bat",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As₂)Md",
        "x": 40,
        "ff": {
          "m": {
            "file": {
              "size": 151966.0,
              "entropy": 5.94,
              "size_bytes": 151966.0
            },
            "text": {
              "digit_ratio": 0.14,
              "space_count": 229.0,
              "total_lines": 16.0,
              "char_entropy": 5.94,
              "unique_chars": 90.0,
              "lines_over_200": 7.0,
              "lines_over_500": 3.0,
              "avg_line_length": 9495.88,
              "lines_over_1000": 3.0,
              "max_line_length": 123266.0,
              "last_line_length": 161.0,
              "long_token_count": 22.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.07,
              "line_length_stddev": 29790.22,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 65.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "%SAUCSKSJAI%@%SAUCSKSJAI%e%SAUCSKSJAI%c%SAUCSKSJAI%h%SAUCSKSJAI%o%SAUCSKSJAI% %SAUCSKSJAI%o%SAUCSKSJAI%f%SAUCSKSJAI%f%SAUCSKSJAI"
            ],
            [
              131,
              "u8",
              "%CVYQ%s%CVYQ%e%CVYQ%t%CVYQ%l%CVYQ%o%CVYQ%c%CVYQ%a%CVYQ%l%CVYQ% %CVYQ%e%CVYQ%n%CVYQ%a%CVYQ%b%CVYQ%l%CVYQ%e%CVYQ%d%CVYQ%e%CVYQ%l%C"
            ],
            [
              593,
              "u8",
              "%HJYN%s%HJYN%e%HJYN%t%HJYN% \"OAG=\u0026\u0026 %HJYN%e%HJYN%x%HJYN%i%HJYN%tXEGZGPTVCZZCOINNKGSIMYFMLMULGJ\""
            ],
            [
              690,
              "u8",
              "%FOXG%s%FOXG%e%FOXG%t%FOXG% \"SII=%FOXG%n%FOXG%o%FOXG%t%FOXG% %XEGZGPTVCZZCOINNKGSIMYFMLMULGJFOXG%d%FOXG%e%FOXG%f%FOXG%i%FOXG%n%X"
            ],
            [
              902,
              "u8",
              "%UMNF%i%UMNF%f%UMNF% %SII:XEGZGPTVCZZCOINNKGSIMYFMLMULGJ=% (%RTF:XEGZGPTVCZZCOINNKGSIMYFMLMULGJ=%%0 %OAG:XEGZGPTVCZZCOINNKGSIMYF"
            ],
            [
              1042,
              "u8",
              "::TOhG8ldzTb9RpCfXlZfkekEs6CvXkk33a+G0FbRZXruMH/IZebI/Fb+vzZmk43aQf0HwWeL/k8IlJzoAkPxQAK3OJWfnWl9w72P4p/fqn5GsM4teCrdFsDL42WJiJN"
            ],
            [
              124310,
              "base64",
              "function Invoke-SysRoutine {\r\n    [CmdletBinding()]\r\n    param ("
            ],
            [
              144498,
              "u8",
              "%UFKP%s%UFKP%e%UFKP%t%UFKP% \"TII=%UFKP%W%UFKP%i%UFKP%n%UFKP%XEGZGPTVCZZCOINNKGSIMYFMLMULGJd%UFKP%o%UFKP%w%UFKP%s%UFKP%P%XEGZGPTV"
            ],
            [
              144991,
              "u8",
              "%EAQBPOX%s%EAQBPOX%e%EAQBPOX%t%EAQBPOX% GEV=C:\\Windows\\SysWOW64\\%TII:XEGZGPTVCZZCOINNKGSIMYFMLMULGJ=%"
            ],
            [
              145094,
              "u8",
              "%LMBVG%i%LMBVG%f%LMBVG% %LMBVG%n%LMBVG%o%LMBVG%t%LMBVG% %LMBVG%e%LMBVG%x%LMBVG%i%LMBVG%s%LMBVG%t%LMBVG% %GEV% (%LMBVG%s%LMBVG%e%"
            ],
            [
              145267,
              "u8",
              "set \"ZDU=;pXOFDAowXOFDAerXOFDAshXOFDAelXOFDAl XOFDA-wXOFDA hXOFDAidXOFDAdeXOFDAn;XOFDA$bXOFDAatXOFDAPaXOFDAthXOFDA_vXOFDAarXOFDA"
            ],
            [
              151558,
              "u8",
              "set \"ZDU=%ZDU:XOFDA=%\""
            ],
            [
              151582,
              "u8",
              "%BLIEN%s%BLIEN%e%BLIEN%t%BLIEN% \"WNM=$host.UI.RawUI.XEGZGPTVCZZCOINNKGSIMYFMLMULGJWindowTitle=XEGZGPTVCZZCOINNKGSIMYFMLMULGJ\""
            ],
            [
              151709,
              "u8",
              "echo %WNM:XEGZGPTVCZZCOINNKGSIMYFMLMULGJ=%'%~0'%ZDU:XEGZGPTVCZZCOINNKGSIMYFMLMULGJ=% | %GEV%"
            ],
            [
              151803,
              "u8",
              "%OIB%t%OIB%i%OIB%m%OIB%e%OIB%o%OIB%u%OIB%t%OIB% %OIB%/%OIB%n%OIB%o%OIB%b%OIB%r%OIB%e%OIB%a%OIB%k%OIB% %OIB%/%OIB%t%OIB% %OIB%1%O"
            ]
          ],
          "v": {
            "file.stem": "f1744e6fe16fd0ef564400f3ea64a60b4b1609264ccfd9badef00a1617473002",
            "file.basename": "f1744e6fe16fd0ef564400f3ea64a60b4b1609264ccfd9badef00a1617473002.bat"
          },
          "id": "batch"
        },
        "id": 0,
        "sz": 151966,
        "ts": [
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8999999761581421,
            "d": "Batch has long encoded token",
            "e": [
              "text.long_token_count = 22.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-has-long-token",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive extraction command marker",
            "e": [
              "7Z"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "PowerShell archive download tool marker",
            "e": [
              "iwR"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool",
            "l": 1
          },
          {
            "a": "T1083",
            "c": 0.6600000262260437,
            "d": "C:\\\\Windows\\\\ directory path",
            "e": [
              "C:\\Windows\\SysWOW64\\"
            ],
            "i": "micro-behaviors/fs/path/system::windows-root",
            "l": 2,
            "m": "E1083"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 123266.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "msiexec unattended install switch",
            "e": [
              "/Qn"
            ],
            "i": "objectives/execution/lolbin/os::msiexec-unattended-switch",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Batch extreme line-length bloat",
            "e": [
              "text.avg_line_length = 9495.88"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-extreme-line-bloat",
            "l": 4
          },
          {
            "d": "Windows directory path reference",
            "e": [
              "C:\\Windows"
            ],
            "i": "micro-behaviors/fs/path/system::windows-dir",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "System32 substring reference",
            "e": [
              "System32"
            ],
            "i": "micro-behaviors/fs/path/system::system32-substr",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Batch unusually low whitespace density",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::batch-low-whitespace-density",
            "l": 4
          },
          {
            "a": "T1027,T1112,T1059.001",
            "c": 0.8600000143051147,
            "d": "Batch has near-zero whitespace",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::batch-near-zero-whitespace",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Command fragmented via undefined env vars",
            "e": [
              "%HJXO%r%HJXO%t"
            ],
            "i": "objectives/anti-static/obfuscation/string/concat::batch-fragmented-command-undefined-vars",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.94"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "\u003cbinary data\u003e \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3,
            "el": [
              "offset:124310"
            ]
          }
        ],
        "sha": "f1744e6fe16fd0ef564400f3ea64a60b4b1609264ccfd9badef00a1617473002",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-03/f1744e6fe16fd0ef564400f3ea64a60b4b1609264ccfd9badef00a1617473002.bat",
        "type": "batch"
      }
    ],
    "tv": "52045"
  }
}