{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.8892989158630371
      }
    ],
    "prob": 0.8892989,
    "models": [
      {
        "m": "az",
        "prob": 0.8892989,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.64733726,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 0.99159664,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-01T03:47:29Z"
  },
  "path": "VirusShare_b6b6a6ed5a25cc20f4da4227d923fda3",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(CAs)",
        "x": 34,
        "ff": {
          "i": [
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "myWidth"
            ],
            [
              "",
              "myHeight"
            ],
            [
              "",
              "Results"
            ],
            [
              "",
              "Results"
            ],
            [
              "",
              "n_result"
            ],
            [
              "",
              "n_result"
            ],
            [
              "",
              "window.__CF$cv$params"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 14.0,
              "bind_count": 10.0,
              "call_count": 2.0,
              "node_count": 771.0,
              "member_count": 8.0,
              "identifier_count": 54.0,
              "member_depth_max": 3.0,
              "string_literal_count": 17.0,
              "array_literal_max_length": 2.0
            },
            "file": {
              "size": 2757.0,
              "entropy": 5.63,
              "size_bytes": 2757.0
            },
            "text": {
              "tab_count": 23.0,
              "digit_ratio": 0.07,
              "space_count": 215.0,
              "total_lines": 73.0,
              "char_entropy": 5.63,
              "mixed_indent": 1.0,
              "unique_chars": 91.0,
              "lines_over_200": 1.0,
              "string_density": 0.23,
              "avg_line_length": 36.77,
              "max_line_length": 435.0,
              "empty_line_ratio": 0.16,
              "last_line_length": 7.0,
              "long_token_count": 3.0,
              "whitespace_ratio": 0.11,
              "most_common_ratio": 0.06,
              "identifier_density": 2.21,
              "line_length_stddev": 58.58,
              "encoded_string_ratio": 0.06,
              "normalized_string_count": 1.99,
              "suspicious_string_ratio": 0.12,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0,
              "suspicious_identifier_ratio": 0.13,
              "normalized_unique_identifiers": 8.72
            },
            "binds": {
              "count": 10.0
            },
            "calls": {
              "count": 2.0
            },
            "binary": {
              "overall_entropy": 5.63
            },
            "source": {
              "function_count": 4.0
            },
            "members": {
              "count": 8.0
            },
            "strings": {
              "total": 17.0,
              "url_count": 1.0,
              "avg_length": 39.29,
              "max_length": 253.0,
              "path_count": 1.0,
              "avg_entropy": 3.48,
              "hex_strings": 1.0,
              "total_bytes": 668.0,
              "entropy_stddev": 1.18,
              "high_entropy_count": 1.0,
              "embedded_code_candidates": 2.0
            },
            "comments": {
              "chars": 68.0,
              "lines": 4.0,
              "total": 4.0,
              "to_code_ratio": 0.06
            },
            "functions": {
              "count": 4.0,
              "avg_params": 0.75,
              "max_params": 3.0,
              "length_stddev": 4.92,
              "avg_name_length": 5.5,
              "no_params_count": 3.0,
              "avg_length_lines": 9.5,
              "max_length_lines": 18.0,
              "min_length_lines": 6.0,
              "avg_param_name_length": 6.0,
              "density_per_100_lines": 5.48,
              "code_in_functions_ratio": 0.52
            },
            "identifiers": {
              "count": 54.0,
              "total": 161.0,
              "avg_length": 5.98,
              "max_length": 18.0,
              "min_length": 1.0,
              "avg_entropy": 2.09,
              "reuse_ratio": 0.34,
              "unique_count": 54.0,
              "length_stddev": 3.59,
              "sequential_names": 7.0,
              "single_char_count": 7.0,
              "single_char_ratio": 0.13,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.02,
              "all_lowercase_ratio": 0.72,
              "all_uppercase_ratio": 0.02
            }
          },
          "s": [
            [
              31,
              "u8",
              "REFRESH"
            ],
            [
              32,
              "u8",
              "REFRESH"
            ],
            [
              50,
              "u8",
              "1; URL='http://bitstarz.ga/tds/erpsuoq.cgi?3"
            ],
            [
              101,
              "10",
              "0"
            ],
            [
              109,
              "10",
              "0"
            ],
            [
              117,
              "10",
              "1"
            ],
            [
              125,
              "10",
              "0"
            ],
            [
              146,
              "u8",
              "\"\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src="
            ],
            [
              147,
              "u8",
              "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src="
            ],
            [
              304,
              "u8",
              "background:#ffffff;width:100%;height:100%;"
            ],
            [
              305,
              "u8",
              "background:#ffffff;width:100%;height:100%;"
            ],
            [
              358,
              "u8",
              "https://bitstarz.ga/tds/erpsuoq.cgi?3\u0026txiwy=0\u0026elvmn=0\u0026uheub=1\u0026uaxvl=0\u0026bonus=bitstarz\u0026ask="
            ],
            [
              359,
              "u8",
              "https://bitstarz.ga/tds/erpsuoq.cgi?3"
            ],
            [
              403,
              "10",
              "0"
            ],
            [
              411,
              "10",
              "0"
            ],
            [
              419,
              "10",
              "1"
            ],
            [
              427,
              "10",
              "0"
            ],
            [
              462,
              "u8",
              "#ffffff"
            ],
            [
              463,
              "u8",
              "#ffffff"
            ],
            [
              515,
              "u8",
              "text/javascript"
            ],
            [
              516,
              "u8",
              "text/javascript"
            ],
            [
              645,
              "10",
              "301"
            ],
            [
              663,
              "10",
              "1"
            ],
            [
              668,
              "10",
              "201"
            ],
            [
              680,
              "10",
              "1"
            ],
            [
              697,
              "10",
              "301"
            ],
            [
              715,
              "10",
              "201"
            ],
            [
              727,
              "10",
              "1"
            ],
            [
              756,
              "u8",
              "3?igc.qouspre/sdt/ag.zratstib//:ptth"
            ],
            [
              757,
              "u8",
              "3?igc.qouspre/sdt/ag.zratstib//:ptth"
            ],
            [
              804,
              "u8",
              "+txiwy+"
            ],
            [
              805,
              "u8",
              "+txiwy+"
            ],
            [
              820,
              "u8",
              "+elvmn+"
            ],
            [
              821,
              "u8",
              "+elvmn+"
            ],
            [
              836,
              "10",
              "3035009650"
            ],
            [
              850,
              "10",
              "1"
            ],
            [
              885,
              "u8",
              ";\n\nfunction deurl(s)\n{\n\treturn s.split("
            ],
            [
              886,
              "u8",
              ";\n\nfunction deurl(s)\n{\n\treturn s.split("
            ],
            [
              926,
              "u8",
              ").reverse().join("
            ],
            [
              927,
              "u8",
              ").reverse().join("
            ],
            [
              946,
              "u8",
              ");"
            ],
            [
              986,
              "10",
              "0"
            ],
            [
              1000,
              "10",
              "0"
            ],
            [
              1040,
              "u8",
              "number"
            ],
            [
              1041,
              "u8",
              "number"
            ],
            [
              1727,
              "10",
              "0"
            ],
            [
              1798,
              "10",
              "0"
            ],
            [
              1847,
              "10",
              "0"
            ],
            [
              1937,
              "10",
              "0"
            ],
            [
              2009,
              "10",
              "0"
            ],
            [
              2059,
              "10",
              "0"
            ],
            [
              2142,
              "10",
              "0"
            ],
            [
              2326,
              "u8",
              "text/javascript"
            ],
            [
              2327,
              "u8",
              "text/javascript"
            ],
            [
              2363,
              "u8",
              "__CF$cv$params"
            ],
            [
              2364,
              "u8",
              "__CF$cv$params"
            ],
            [
              2384,
              "u8",
              "6a4444eb2fad6786"
            ],
            [
              2385,
              "u8",
              "6a4444eb2fad6786"
            ],
            [
              2405,
              "u8",
              "ve9ZHBr2JdKNM8R7kBVbgtolDGQTspGE_8uwqYtVAbo-1635257438-0-AXsGPvnfStbBvNZuoEJaKcoikrM86/BWo4HOa1sxuZZvQDXcQbDOI3AV9pu4dWG6Ty1R+BI"
            ],
            [
              2406,
              "u8",
              "ve9ZHBr2JdKNM8R7kBVbgtolDGQTspGE_8uwqYtVAbo-1635257438-0-AXsGPvnfStbBvNZuoEJaKcoikrM86/BWo4HOa1sxuZZvQDXcQbDOI3AV9pu4dWG6Ty1R+BI"
            ],
            [
              2664,
              "16",
              "17843510140"
            ],
            [
              2677,
              "16",
              "138720515845"
            ],
            [
              2693,
              "u8",
              "/cdn-cgi/challenge-platform/h/b"
            ],
            [
              2694,
              "u8",
              "/cdn-cgi/challenge-platform/h/b"
            ]
          ],
          "v": {
            "file.stem": "VirusShare_b6b6a6ed5a25cc20f4da4227d923fda3",
            "file.basename": "VirusShare_b6b6a6ed5a25cc20f4da4227d923fda3",
            "source.language": "javascript",
            "source.imports[0]": "Results",
            "source.imports[1]": "myHeight",
            "source.imports[2]": "myWidth",
            "source.imports[3]": "n_result",
            "source.imports[4]": "window.__CF$cv$params",
            "source.strings[0]": "\"\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=",
            "source.strings[1]": "#ffffff",
            "source.strings[2]": ").reverse().join(",
            "source.strings[3]": "+elvmn+",
            "source.strings[4]": "+txiwy+",
            "source.strings[5]": "/cdn-cgi/challenge-platform/h/b",
            "source.strings[6]": "138720515845",
            "source.strings[7]": "17843510140",
            "source.strings[8]": "1; URL='http://bitstarz.ga/tds/erpsuoq.cgi?3",
            "source.strings[9]": "3035009650",
            "source.has_imports": true,
            "source.strings[10]": "3?igc.qouspre/sdt/ag.zratstib//:ptth",
            "source.strings[11]": "6a4444eb2fad6786",
            "source.strings[12]": ";\n\nfunction deurl(s)\n{\n\treturn s.split(",
            "source.strings[13]": "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=",
            "source.strings[14]": "REFRESH",
            "source.strings[15]": "__CF$cv$params",
            "source.strings[16]": "background:#ffffff;width:100%;height:100%;",
            "source.strings[17]": "https://bitstarz.ga/tds/erpsuoq.cgi?3",
            "source.strings[18]": "https://bitstarz.ga/tds/erpsuoq.cgi?3\u0026txiwy=0\u0026elvmn=0\u0026uheub=1\u0026uaxvl=0\u0026bonus=bitstarz\u0026ask=",
            "source.strings[19]": "number",
            "source.strings[20]": "text/javascript",
            "source.strings[21]": "ve9ZHBr2JdKNM8R7kBVbgtolDGQTspGE_8uwqYtVAbo-1635257438-0-AXsGPvnfStbBvNZuoEJaKcoikrM86/BWo4HOa1sxuZZvQDXcQbDOI3AV9pu4dWG6Ty1R+BIv0xDGbocRt+GUpZXBvn493mUZPV3w9W7ci1Otj4eo4/QAM+OG8zIo1U97RodnGBzsy3NZO61CdUxTBXfL9Yqza7xsneCI9nIt6zQZIkTaCY7bNzd2hFHdKcGUjQ==",
            "source.functions[0]": "Height",
            "source.functions[1]": "Results",
            "source.functions[2]": "Size",
            "source.functions[3]": "Width"
          },
          "ct": [
            "Results"
          ],
          "id": "javascript",
          "mc": [
            "document.body",
            "document.body.clientHeight",
            "document.body.clientWidth",
            "document.documentElement",
            "document.documentElement.clientHeight",
            "document.documentElement.clientWidth",
            "window.innerHeight",
            "window.innerWidth"
          ]
        },
        "id": 0,
        "sz": 2757,
        "ts": [
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-8",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-3",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "Affiliate parameter name",
            "e": [
              "\"REFRESH\" content=\"1; URL='"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/affiliate::affiliate-param-name",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Split to empty-delimiter char array",
            "e": [
              ".split(\"\")"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-string-split",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 73.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").reverse"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-11",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8199999928474426,
            "d": "JavaScript static key string assignment",
            "e": [
              "='http://bitstarz.ga/tds/erpsuoq.cgi?3\u0026txiwy=0\u0026elvmn=0\u0026uheub=1\u0026uaxvl=0\u0026bonus=bitstarz\u0026ask='"
            ],
            "i": "micro-behaviors/crypto/symmetric/aes/library::js-static-key-string-assignment",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Plain JavaScript identifier assignment",
            "e": [
              "n_result = n_docel;"
            ],
            "i": "metadata/lang/scripted::plain-js-identifier-assignment",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary number",
            "e": [
              "number"
            ],
            "i": "metadata/file/text/format::vocab-number",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "d": "Join using empty string delimiter",
            "e": [
              ".join(\"\")"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::js-array-join-symbol",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "DOM script element literal",
            "e": [
              "text/javascript",
              "\"\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=",
              "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src="
            ],
            "i": "micro-behaviors/process/create/load/remote-code::js-dom-script-literal",
            "l": 1,
            "el": [
              "0x203",
              "0x92",
              "0x93"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ".split("
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "DOM or CSS size property",
            "e": [
              "width"
            ],
            "i": "micro-behaviors/ui/window/manage/dom::size-prop",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 7.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").reverse"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-2",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.75,
            "d": "DOM script src literal",
            "e": [
              "\"\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src=",
              "\u003e\n\u003cMETA HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\"\u003e\n\u003cscript async src="
            ],
            "i": "micro-behaviors/process/create/load/remote-code::js-dom-script-src-literal",
            "l": 1,
            "el": [
              "0x92",
              "0x93"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              ").reverse"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-7",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": "Five or fewer comment lines in file",
            "e": [
              "comments.lines = 4.00"
            ],
            "i": "metadata/file/text/metrics::few-comment-lines",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTPS protocol prefix",
            "e": [
              "https://"
            ],
            "i": "micro-behaviors/communications/http/message::https-prefix",
            "l": 2,
            "el": [
              "0x166"
            ]
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              ").join"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003chtml"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "d": "Hex byte array literal opening",
            "e": [
              "[0x0"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/hex::hex-byte-array-open",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "String reconstructed via split/join",
            "e": [
              ".split(\"\").reverse().join(\"\")"
            ],
            "i": "objectives/anti-static/obfuscation/string/reconstruct::split-join-reconstruction",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "VirusShare_b6b6a6ed5a25cc20f4da4227d923fda3"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1
          },
          {
            "a": "T1071",
            "c": 0.800000011920929,
            "d": ".ga domain (free)",
            "e": [
              "http://bitstarz.ga/"
            ],
            "i": "objectives/command-and-control/infrastructure/domain/tld::tld-ga",
            "l": 4
          }
        ],
        "sha": "fd1d1a11e25e7f0b6f03353aade20b4f034ff5fdea0c51cc51fd58f22882cb8b",
        "path": "VirusShare_b6b6a6ed5a25cc20f4da4227d923fda3",
        "type": "javascript"
      }
    ],
    "tv": "961ce"
  }
}