{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.48895434,
        "class": 0
      },
      {
        "m": "az/batch",
        "prob": 0.28070176,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T01:14:22Z"
  },
  "path": "faefc46e8a09a0e3d86e468d86974096e0f8f5ceeb20135064f2a4c3560bb761.bat",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)H(F₂)",
        "x": 40,
        "ff": {
          "m": {
            "file": {
              "size": 149.0,
              "entropy": 4.93,
              "size_bytes": 149.0
            },
            "text": {
              "digit_ratio": 0.03,
              "space_count": 16.0,
              "total_lines": 11.0,
              "char_entropy": 4.93,
              "unique_chars": 42.0,
              "escape_density": 0.67,
              "avg_line_length": 11.55,
              "max_line_length": 27.0,
              "empty_line_ratio": 0.45,
              "last_line_length": 14.0,
              "whitespace_ratio": 0.26,
              "most_common_ratio": 0.07,
              "line_length_stddev": 11.78,
              "unicode_escape_count": 1.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "@echo off"
            ],
            [
              13,
              "u8",
              "taskkill /f /im AIO.exe"
            ],
            [
              38,
              "u8",
              "timeout /t 2 /nobreak \u003e NUL"
            ],
            [
              69,
              "u8",
              "del C:\\Users\\Public\\AIO.exe"
            ],
            [
              131,
              "u8",
              "DEL \"%~f0\"\u003eNUL"
            ]
          ],
          "v": {
            "file.stem": "faefc46e8a09a0e3d86e468d86974096e0f8f5ceeb20135064f2a4c3560bb761",
            "file.basename": "faefc46e8a09a0e3d86e468d86974096e0f8f5ceeb20135064f2a4c3560bb761.bat"
          },
          "id": "batch"
        },
        "id": 0,
        "sz": 149,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "Binary in Public user folder",
            "e": [
              "Users\\Public\\AIO.exe"
            ],
            "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-public-folder",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "Redirect output to null",
            "e": [
              "\u003eNUL"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::redirect-null",
            "l": 1
          },
          {
            "a": "T1074.001",
            "c": 0.800000011920929,
            "d": "Users\\Public staging directory",
            "e": [
              "Users\\Public\\"
            ],
            "i": "micro-behaviors/fs/file/write/staging::users-public-path",
            "l": 3,
            "m": "E1074"
          },
          {
            "c": 0.800000011920929,
            "d": "Batch self path reference",
            "e": [
              "\"%~f0\""
            ],
            "i": "micro-behaviors/process/info/selfpath::self-path-fragment",
            "l": 1
          },
          {
            "a": "T1497.003",
            "c": 0.699999988079071,
            "d": "Batch timeout delay command",
            "e": [
              "timeout /t 2"
            ],
            "i": "micro-behaviors/time/sleep/interval::batch-timeout-delay",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Echo off",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/execution/batch::echo-off",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 11.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "echo off batch command",
            "e": [
              "@echo off"
            ],
            "i": "objectives/command-and-control/dropper/builder::echo-off-batch",
            "l": 1
          },
          {
            "a": "T1070.004",
            "c": 0.949999988079071,
            "d": "Batch script self-deletion command",
            "e": [
              "DEL \"%~f0\""
            ],
            "i": "micro-behaviors/fs/file/delete::batch-self-delete",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "File deletion using \"del\" command.",
            "e": [
              "del C"
            ],
            "i": "micro-behaviors/fs/file/delete::del-command",
            "l": 3
          },
          {
            "c": 0.550000011920929,
            "d": "Stdout redirected to NUL",
            "e": [
              "\u003e NUL"
            ],
            "i": "micro-behaviors/os/console/io::windows-stdout-to-nul",
            "l": 2
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          }
        ],
        "sha": "faefc46e8a09a0e3d86e468d86974096e0f8f5ceeb20135064f2a4c3560bb761",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-09/faefc46e8a09a0e3d86e468d86974096e0f8f5ceeb20135064f2a4c3560bb761.bat",
        "type": "batch"
      }
    ],
    "tv": "52045"
  }
}