{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.9380215, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T04:26:15Z" }, "path": "06c65f739f2caafef049167ba5536b5b1bf6cd82a7b645b7b960182d7a48012e.vbe", "raw": { "v": "5", "fs": [ { "f": "O(Asâ‚‚)Md", "x": 37, "ff": { "m": { "file": { "size": 1303042.0, "entropy": 4.94, "size_bytes": 1303042.0 }, "text": { "tab_count": 102.0, "digit_ratio": 0.19, "space_count": 19176.0, "total_lines": 1.0, "char_entropy": 4.94, "unique_chars": 100.0, "escape_density": 0.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 1303042.0, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 1303042.0, "non_ascii_ratio": 0.0, "null_byte_count": 1.0, "last_line_length": 1303042.0, "long_token_count": 3549.0, "whitespace_ratio": 0.01, "most_common_ratio": 0.08, "octal_escape_count": 2.0, "non_printable_ratio": 0.01, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 33.0 } }, "s": [ [ 4, "u8", "+ETA" ], [ 1423, "u8", "fc2v2\u0026fGff2 f\u00262" ], [ 1617, "u8", "fc2v2\u0026fGff2cf\u00262" ], [ 1969, "xor", "+.624:h1 2" ], [ 6978, "u8", "cjYMI" ], [ 7239, "xor", "kejf?/,#kr9q" ], [ 7325, "xor", "9H6/\\WENE9H" ], [ 8557, "xor", "6r6#,f9\u0026ar#\u0026jr" ], [ 8676, "xor", "H:HEDVHE9H\\NH4HEDN\\NDH\\N" ], [ 9028, "xor", "\\BHED6HEH(H" ], [ 9362, "xor", "\u0026r#\u0026f9\u0026arf\u00261rff" ], [ 9893, "xor", "6H4DVHE\\O\\NH4H" ], [ 9958, "xor", "f,\u00269f;rjr6#,f9\u0026ar" ], [ 10153, "xor", "4HE\\O\\NH4H" ], [ 10217, "xor", "4HE\\O\\NH4H" ], [ 10537, "xor", "4HE\\O\\NH4H" ], [ 10665, "xor", "9HE\\O\\)H4H" ], [ 10793, "xor", "4HE\\O\\NH4H" ], [ 11050, "xor", "H69H\\DH\\HED" ], [ 11177, "xor", "4HE\\O\\NH4H" ], [ 11497, "xor", "4HE9D\\DH\\HE" ], [ 11588, "xor", "\\DHED6HEH9HEH:" ], [ 11625, "xor", "4HE\\O\\NH4H" ], [ 11945, "xor", "4HE\\O\\NH4H" ], [ 12164, "xor", "9DHED6HEH!H" ], [ 12178, "xor", "\u0026kf;f9\u0026er6j" ], [ 12914, "xor", "f9\u0026ar#\u0026lr6j" ], [ 13138, "xor", "\u0026r#1f9\u0026ar#\u0026qr6f?\u00269f" ], [ 13222, "xor", "f9\u00269f;rar6#kf" ], [ 13350, "xor", "f,\u0026rfkrarf#" ], [ 13396, "xor", "fjf9\u0026ar#\u0026?r" ], [ 13542, "xor", "f,\u0026rfkrarf#" ], [ 13554, "xor", "f9\u0026ar#jjr6j?r" ], [ 13642, "u8", "\u0026+clJ@#@\u0026~~,Puj\"jr,'~]" ], [ 14212, "u8", "DbOnSbx" ], [ 14550, "u8", "\u0026CZd`*@#@\u0026,P~P@#@\u0026~~,PfbhPhKfnp~),?" ], [ 15397, "u8", "*r#@#@\u0026,PP~uwr\\sv" ], [ 16322, "xor", "\"0I62=:0?6" ], [ 19280, "xor", "frfarj\u0026#r#r" ], [ 20298, "u8", "fO\u0026c2f\u0026Wc*2ffc2GWFfvff2v*\u00262" ], [ 20383, "xor", "D\\)D(\\6HEH6" ], [ 20674, "u8", "c2\u0026Xc8\u0026XfR\u0026*Wq\u0026Wcc2ff*2\u00262 fvf+2Gf!2X\u0026y\u0026XfR\u0026vf*2v*F2X2vfW\u0026F\u0026v2*2*\u0026+\u0026X\u0026y\u0026XfF\u0026*Wq\u00262\u0026!2***2*2%f**q2\u0026fF2*\u0026+\u0026XfR\u0026**q2Gf,2{2%fW\u0026W\u0026c2,2" ], [ 20972, "xor", "f6\u0026\u0026r6\u0026er\u0026r" ], [ 21110, "u8", "W\u0026f+cW\u0026v2\u00262X\u00268\u0026X\u0026y\u0026XfF\u0026*Wq\u00262\u0026!2***2*2%f**q2\u0026fF2*\u0026+\u0026XfR\u0026**q2Gf,2{2%fW\u0026W\u0026c2,2" ], [ 21484, "xor", "f6\u0026jr6\u0026lr\u0026ra\u0026" ], [ 21548, "xor", "fj\u0026\u0026rf\u0026arj" ], [ 21660, "xor", "\u00266\u0026jr6\u0026erj#,f" ], [ 21846, "u8", "* 2c2%fvf*2Gf!2X\u0026y\u0026" ], [ 21920, "xor", "\\)D(\\DHEHD" ], [ 22032, "u8", "\u00262\u0026!2***2*2%f**q2v*c2" ], [ 22060, "xor", "f6\u0026kr6\u0026er\u0026r" ], [ 22252, "xor", "f6\u0026jr6\u0026lr\u0026ra\u0026" ], [ 22570, "u8", "*8\u0026c*f2Gf%2*2,fl\u00262\u0026*2!2{\u0026l\u0026f\u0026O\u0026XfF\u0026v2q\u0026FcF2**F2*2%f**q2\u0026f 2*\u0026y\u0026*f2\u0026vf+2Gfc2" ], [ 22578, "xor", "\u0026erjrl\u0026,frfjrar;f,f\u0026f" ], [ 22642, "xor", "\u0026#r?re\u0026rfrfjrar\u0026f" ], [ 22646, "u8", "2%f2\u00262\u0026*2!2f\u0026R\u0026f\u0026R\u0026ffF\u0026G2X\u0026F\u0026v2*fc2c2Ffcfq2cfF2*\u00268\u0026*f8\u0026cfq2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*\u00268\u0026Xf8\u0026c2q\u0026F\u0026F2*fc2c2Ffcfq2v*F2{\u0026R\u0026*fO\u0026cfq2cfF2*" ], [ 25612, "xor", "f#r1frfarj\u0026" ], [ 29068, "xor", "f6r1fkfer\u0026\u0026" ], [ 29676, "xor", "fj\u0026?r6\u0026fr;ra\u0026" ], [ 30316, "xor", "f6\u00261rf\u0026ar\u0026rj\u0026,f" ], [ 30470, "u8", "cy\u0026XfW\u0026cW*\u00262\u0026 2Xf*2GWFf*f12\u0026fF2*\u0026l\u0026ffy\u0026c*X2\u0026f\u00262*2,fl\u0026F\u0026*2!2{\u0026l\u0026X\u0026+\u0026ffy\u0026v2q\u0026F\u0026v2Xf 2*2vfvfX2v*\u00262{\u0026W\u0026ffZ\u0026*f12Gf!2{2%f+cW\u0026*2,2f\u00268\u0026*" ], [ 30668, "xor", "f6rjfrfar;\u0026erjr" ], [ 30735, "xor", "\u0026frfar\u0026\u0026ar6" ], [ 30922, "u8", "*2\u0026cWf\u0026FcF2Xfv2\u00262 f*f12Gf,2X\u0026+\u0026ff2\u0026vf+2G*F2X2vf+cW\u0026*2*2{\u0026l\u0026f\u0026Z\u0026XfF\u0026*Wq\u00262\u0026!2***2*2%fvfX2*fc2{\u0026R\u0026*fF\u0026cfq2cfF2*2Ffl\u00268\u0026vW 2*\u00268\u0026*\u00268\u0026*" ], [ 31234, "u8", "c2\u0026*cl\u0026Xf+\u0026*Wq\u0026+cF2**F2*2%fvf*2Gfv2*cl\u0026XfR\u0026**q2*f\u00262X2vfl\u0026F\u0026v2 2{\u0026Z\u0026X\u0026y\u0026" ], [ 31388, "xor", "\u0026jj1rf\u0026arj#,f" ], [ 31558, "u8", "c2\u0026*fF\u0026v2+\u0026+\u0026,2Xfv2c2%f*fX2vfG2{\u0026F\u0026*f2\u0026vf+2vf%2*WFfW\u0026R\u0026v2c2f\u00268\u0026X\u0026+\u0026" ], [ 31782, "u8", "c2\u0026*fF\u0026vf+2Gf,2f2,f2\u0026y\u0026*2,2{c8\u0026f\u00268\u0026*fF\u0026c21\u0026F\u0026\u00262*f,2*2%f**q2v* 2*\u0026+\u0026XfF\u0026**q2*f\u00262X2vf2\u0026y\u0026*2,2{\u0026O\u0026X\u0026+\u0026ff2\u0026v2+\u0026FcF2Xfv2vWcf*fX2Gf*2*" ], [ 32150, "u8", "* 2*2%f*f*2c*\u00262*\u00268\u0026Xf8\u0026cfq2*fF2*2FfW\u00268\u0026c2F2{c8\u0026X\u0026+\u0026ffy\u0026*21\u0026F\u0026!2X*F2vW*fvff2v*\u00262*cl\u0026" ], [ 32598, "u8", "* 2*2%f*f*2c*\u00262*\u00268\u0026Xf8\u0026cfq2*fF2*2FfW\u00268\u0026c2F2*\u00268\u0026f\u0026R\u0026ff8\u0026*20\u0026+c\u00262***2vWcfvf+2vf%2X\u0026y\u0026ff2\u0026vff2Gf*2" ], [ 32667, "xor", "#\u00266\u0026kr6\u0026er" ], [ 33282, "u8", "c8\u0026f\u0026l\u0026XfF\u0026*21\u00262\u0026!2***2vW*fvf+2c*F2f\u0026O\u0026ff8\u0026*f02v*\u00262*W*f2\u00262\u0026v2 2{\u0026F\u0026*cl\u0026XfR\u0026v2q\u0026W\u0026*2***2G2%f*f02vfv2X\u0026+\u0026ffy\u0026*f12Gf*2*2vfW\u0026F\u0026v2c2{" ], [ 33370, "xor", "re\u0026j\u0026pr6\u00266r" ], [ 33580, "xor", "fjj1rf\u0026arj" ], [ 33622, "u8", "fG2c2vfcfq2cfF2*\u00268\u0026" ], [ 33794, "u8", "cl\u0026f\u0026l\u0026XfF\u0026v2q\u00262\u0026!2Xf 2*2%f**q2*fc2f\u0026l\u0026" ], [ 33930, "u8", "*l\u0026v2f\u0026F\u0026v2Xf 2*2%fvfq2v* 2X\u0026+\u0026" ], [ 34422, "u8", "W\u0026f2\u00262\u0026*2*2{c8\u0026*\u00268\u0026Xf8\u0026c2q\u0026W\u0026F2*f 2c2Ffcfq2GfG2f\u0026W\u0026*f2\u0026c**2Gf*2*2Ff+c8\u0026cW\u00262{\u0026R\u0026*\u0026l\u0026*fW\u0026c2f\u0026+c\u00262Xf 2*2%f*f12Gf\u00262*\u0026y\u0026XfR\u0026vf+2v*\u00262X" ], [ 35030, "u8", "fc2*2%f**q2Gfc2*\u0026+\u0026" ], [ 35462, "u8", "\u0026R\u0026ffy\u0026*Wq\u0026F\u0026!2**F2*2%fvfX2GfG2f\u0026O\u0026ffy\u0026*fq2*f\u00262*2Ffl\u00268\u0026c2F2X\u0026R\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*fF2*2Ffcfq2cfv2*\u00268\u0026*f8\u0026cfq2Gfc2X2vfW\u0026F\u0026v2F2*\u0026W\u0026*" ], [ 35626, "xor", "\u0026xf#\u00261r#\u0026erjr" ], [ 35982, "xor", "9EH9H(\\DDN\\" ], [ 36458, "u8", "fR\u0026cfX2cfF2*2FfW\u00268\u0026c2 2" ], [ 37546, "u8", "fO\u0026cfX2cf 2" ], [ 38398, "xor", "\\D\\6HEHDHVH" ], [ 38474, "u8", "fF\u0026c20\u0026W\u0026F2ffc2v2%fcfq2c**2*\u0026l\u0026" ], [ 38524, "xor", "f#rerjf9f?#9f" ], [ 38794, "u8", "fF\u0026c2+\u0026Wcv2*fF2c2Ffcf12cfc2f\u0026W\u0026*f8\u0026cf02cf 2*2FfW\u00262\u0026c2 2*\u00262\u0026f\u0026W\u0026Xf8\u0026G2q\u0026W\u0026F2** 2v2%fcfq2vfG2" ], [ 39370, "u8", "fF\u0026c2q\u0026W\u0026\u00262{fG2v2%fcfq2*f,2*\u0026O\u0026Xfy\u0026cf+2cf%2" ], [ 39830, "u8", "* 2vWcfcfX2cf 2" ], [ 39914, "u8", "fF\u0026cfX2cf 2" ], [ 39968, "u8", "2cfG2" ], [ 41035, "xor", "VHD\\EH9H(\\D" ], [ 42374, "u8", "cy\u0026**+\u0026c2q\u0026F\u0026\u00262*f 2G2Gf*f12cfF2f\u0026Z\u0026*f2\u0026cfq2G*F2*2 fl\u00268\u0026v2c2*\u00268\u0026f\u0026R\u0026*fF\u0026c2q\u0026l\u0026c2Xfv2c2cfcfq2cfF2f\u0026Z\u0026*fR\u0026cfq2GfG2*2FfF\u0026F\u0026v2*2*\u00268\u0026{" ], [ 43308, "xor", "f#\u00261rf\u0026ar?re\u0026,f" ], [ 43318, "u8", "2%fl\u0026R\u0026*WF2X\u0026l\u0026f\u0026O\u0026*f+\u0026v2*\u0026+c\u00262***2c2%fcfq2\u0026f!2X\u0026+\u0026ff2\u0026vf+2\u0026f*2*2vfW\u0026F\u0026*2c2" ], [ 43612, "xor", "\u00266\u0026kr6\u0026er?#rfj\u0026" ], [ 43760, "u8", "2v*\u00262{2%f+cW\u0026*2,2{\u0026Z\u0026X\u0026y\u0026XfR\u0026*21\u0026F\u0026G2ffF2\u00262 fvf+2cfc2X\u0026y\u0026XfR\u0026**q2*fc2*2 fW\u00268\u0026v2c2{\u00262\u0026X\u0026+\u0026XfR\u0026*21\u0026+cc2Xfv2c2Gf*f+2vfv2X\u0026y\u0026XfR\u0026**q" ], [ 43974, "u8", "c2\u0026XfR\u0026*2*\u0026+c\u00262X*F2*2%f*f12*fc2f\u0026O\u0026*f+\u0026vf*2v*\u00262*W*fW\u0026R\u0026c2F2f\u0026Z\u0026" ], [ 44098, "u8", "c2\u0026*cl\u0026Xf+\u0026v2X\u0026Wc*2Xfv2vWcfvf*2vf%2*cl\u0026ff8\u0026*f02\u0026f!2X2vf2\u0026y\u0026*WF2*\u00268\u0026X\u00268\u0026ff2\u0026*21\u0026+c\u00262{f%2*2Gf**q2*fc2*\u0026y\u0026*f8\u0026vf*2v*F2X2vf+cW\u0026v2F2{" ], [ 44123, "xor", "#\u00266\u0026jr6\u0026erj#,f\u0026\u0026xfj\u0026prf\u0026ar" ], [ 44332, "xor", "f6\u0026kr6\u0026er?re\u0026" ], [ 44342, "u8", "2%fW\u0026l\u0026*WF2" ], [ 44380, "xor", "\u00266\u0026jr6\u0026er\u0026fxf?j" ], [ 44426, "u8", "*l\u0026v2+\u0026+c\u00262ff*2\u00262 fvf+2GfG2f\u00268\u0026ffy\u0026vf+2v*F2*2 fF\u0026F\u0026v2\u00262{\u0026O\u0026X\u0026+\u0026*fF\u0026v2f\u0026F\u0026\u00262Xfv2c2Gf*ff2v*\u00262f\u00268\u0026XfF\u0026vfq2\u0026f!2f2*fl\u0026F\u0026v2c2X\u00262\u0026*\u0026y\u0026{" ], [ 44524, "xor", "f6\u00261rf\u0026ar\u0026rj\u0026,f" ], [ 44572, "xor", "\u00266\u00261rf\u0026arj#,f" ], [ 44716, "xor", "f6\u0026kr6\u0026erj" ], [ 45066, "u8", "*W\u0026v2+\u0026+c\u00262**F2*2%f**q2v*c2X\u0026+\u0026" ], [ 45206, "u8", "*\u00262*2%f*f*2cfF2*cW\u0026ff2\u0026**q2Gf*2" ], [ 45238, "u8", "W\u0026fW\u0026F\u0026v2c2f\u0026Z\u0026X\u0026+\u0026ffy\u0026*2X\u0026+c\u00262X*F2*2%f*f12*fc2f\u0026O\u0026*fF\u0026vf*2\u0026fF2*2vfW\u0026l\u0026c2F2{c8\u0026" ], [ 45322, "u8", "*W\u0026v2+\u0026F\u0026!2Xf 2c2%fvf*2v*\u00262*cl\u0026ff8\u0026*f02\u0026f!2X2vf2\u0026y\u0026*WF2*\u00268\u0026*cW\u0026ff2\u0026*Wq\u0026F\u0026*2" ], [ 45488, "u8", "2v*\u00262{2%f+cW\u0026*2,2" ], [ 45506, "u8", "\u0026R\u0026f\u0026l\u0026XfF\u0026*2+\u0026+\u0026v2Xf 2*2%f**q2G*F2*\u0026y\u0026{fF\u0026vff2v*\u00262X2 f2\u0026y\u0026v2 2*cl\u0026" ], [ 45942, "u8", "2%fW\u0026F\u0026c2F2{c8\u0026X\u0026+\u0026ffy\u0026*21\u0026F\u0026,2Xfv2\u00262\u0026fvf+2G*F2X\u0026+\u0026" ], [ 45983, "xor", "E\\)D(\\6HEH" ], [ 46308, "xor", "r?#rf\u0026\u00269f6\u0026\u0026r6\u0026erj" ], [ 46363, "xor", "f\u0026#j\u0026rf\u0026ar" ], [ 46406, "u8", "c2\u0026XfF\u0026*2*\u0026W\u0026F2**c2*2%f**q2v*F2" ], [ 46556, "xor", "\u0026jj1rf\u0026arj#,f" ], [ 46594, "u8", "c2\u0026*cl\u0026XfF\u0026v2q\u00262\u0026 2**F2*2%f**q2*fc2f\u0026l\u0026ffy\u0026vf+2Gf!2X2 fl\u0026R\u0026*2,2" ], [ 46662, "u8", "c2\u0026*fF\u0026v2+\u0026F\u0026G2*f 2*2%f*fq2Gf*2*cW\u0026XfF\u0026vfq2G*F2*2vf+cW\u0026*2F2{\u00262\u0026*\u0026+\u0026XfF\u0026v2*\u0026FcF2" ], [ 46863, "xor", "1f,fer?jfrjre\u0026j\u0026jr#\u0026" ], [ 46870, "u8", "*\u00262*2%f*f*2cfF2*cW\u0026XfR\u0026**q2v*F2" ], [ 46924, "xor", "HD\\6HEHB\\6" ], [ 47690, "u8", "fF\u0026v2f\u0026+c\u00262Xf 2*2%fvf*2GfG2f\u00268\u0026ffy\u0026vf+2cfc2f2,fW\u0026+\u0026v2c2" ], [ 48394, "u8", "*W\u0026v2+\u0026+c\u00262***2c2%fcfq2Gf,2X\u0026+\u0026*fF\u0026**q2Gf!2XWFf2\u00262\u0026v2 2{\u0026O\u0026*\u0026y\u0026*f+\u0026v2*\u0026+cF2Xfv2vWcfvfq2vf,2f\u0026O\u0026ffZ\u0026vff2Gfc2*WFf2\u00262\u0026v2 2*\u0026F\u0026" ], [ 48668, "xor", "\u0026jj1rj\u0026er?#rf" ], [ 48778, "u8", "*y\u0026v2f\u0026+c\u00262Xf 2*2%fvf*2GfG2f\u00268\u0026ffy\u0026vf+2cfc2f2,fl\u0026+\u0026v2 2*\u00268\u0026*\u0026O\u0026XfR\u0026*Wq\u0026+c 2" ], [ 48970, "u8", "*W\u0026v2*\u0026F\u0026v2**F2c2%f*fX2\u0026f!2*cl\u0026XfF\u0026**q2GfF2*WFf2\u0026y\u0026*2c2{\u0026F\u0026*\u0026y\u0026XfR\u0026*2q\u0026+\u0026v2ffF2c2Gfcfq2Gf%2f\u0026l\u0026XfF\u0026vfq2c*c2f2*fl\u00262\u0026v2 2" ], [ 49226, "u8", "*W\u0026v2+\u0026WcF2Xf 2\u00262 fvf+2v*v2X\u0026y\u0026XfR\u0026**q2c**2*2 f+\u0026F\u0026v2 2f\u00262\u0026f\u0026O\u0026*fF\u0026*Wq\u00262\u0026!2Xfv2c2%fvfq2*fc2f\u0026O\u0026*f+\u0026**q2v* 2*2vfW\u0026F\u0026c2F2{\u0026l\u0026X\u0026+\u0026" ], [ 49628, "xor", "\u00266\u0026jr6\u0026erj#xf" ], [ 49962, "u8", "*W\u0026vfX2Gf!2{2%fl\u0026F\u0026*2,2" ], [ 50732, "xor", "fjj1rf\u0026arj" ], [ 51116, "xor", "fj\u0026jr6\u0026er?re\u0026,f" ], [ 51126, "u8", "2%fl\u0026R\u0026*WF2" ], [ 51282, "xor", "far?\u0026#rjre\u0026j\u0026qr" ], [ 51286, "u8", "fc2*2%f*f12Gf,2X\u0026y\u0026" ], [ 51362, "xor", "\u0026arj#,f\u0026\u0026rf6\u0026kr" ], [ 52006, "u8", "c2\u0026ffy\u0026*fX2\u0026f!2f2*fl\u0026F\u0026*WF2{\u0026Z\u0026{\u0026R\u0026ffy\u0026*2q\u0026+\u0026v2Xf 2*2%f**q2G*F2*\u0026y\u0026Xf8\u0026**q2\u0026fc2X2vf+cW\u0026cW\u00262{\u0026W\u0026X\u0026+\u0026*fF\u0026v2q\u0026W\u0026F2Xf*2vWcfvf*2Gfv2f" ], [ 52016, "xor", "rf\u0026ar\u0026rj\u0026,f" ], [ 52572, "xor", "\u00266\u0026jr6\u0026erjf9f" ], [ 52699, "xor", "j\u00266\u0026kr6\u0026erjf9f" ], [ 52778, "xor", "\u0026xfjj1rf\u0026ar" ], [ 52938, "u8", "*l\u0026*21\u0026F\u0026!2**F2c2%fvf*2\u0026f!2*\u0026+\u0026*fl\u0026vf*2v*F2X2vfW\u0026R\u0026*WF2{\u0026+\u0026*c8\u0026*fR\u0026*2X\u00262\u0026*2{f%2vWcf*f12Gfc2X\u0026+\u0026ffy\u0026vff2G*F2*2vfW\u0026l\u0026c2F2" ], [ 53008, "xor", "frfjr;\u0026er6" ], [ 53226, "xor", "\u0026xfjj1rf\u0026ar" ], [ 53334, "u8", "*\u00262c2%fvf+2vf,2f\u00268\u0026XfF\u0026**q2G*F2*W*fl\u0026R\u0026*2F2*\u00268\u0026X\u0026l\u0026*fF\u0026v2*\u00262\u0026F2**F2*2Gfvfq2Gf,2X\u0026y\u0026*fR\u0026vf*2cf 2f2*f2\u0026y\u0026v2 2{\u0026Z\u0026X\u0026y\u0026ff2\u0026*21\u0026+c\u00262{" ], [ 53664, "xor", "\\)D(\\DHEHD" ], [ 53706, "u8", "*W\u0026v2f\u00262\u0026!2Xf 2*2%f*fq2Gf*2X\u0026+\u0026*fF\u0026**q2v* 2" ], [ 53834, "u8", "*W\u0026v2f\u00262\u0026!2Xf 2*2%f*fq2Gf 2*c8\u0026ff2\u0026vf+2\u0026f\u00262X2vfl\u0026F\u0026v2 2" ], [ 53936, "u8", "2cfF2X2*fW\u0026F\u0026v2c2f\u00268\u0026*c8\u0026XfF\u0026v2q\u0026F\u0026,2Xf 2c2%fvf*2cf 2{\u0026W\u0026" ], [ 53996, "xor", "f6\u0026\u0026r6\u0026er\u0026r" ], [ 54038, "u8", "*\u00262c2%fvf+2vf,2f\u00268\u0026XfF\u0026**q2G*F2*W*fl\u0026R\u0026*2F2*\u00268\u0026X\u0026l\u0026*fF\u0026v2*\u00262\u0026F2**F2*2Gfvfq2Gf,2X\u0026y\u0026*fR\u0026vf*2cf 2" ], [ 54134, "u8", "2%f2\u0026y\u0026*WF2f\u00268\u0026f\u0026O\u0026" ], [ 54354, "xor", "far?\u0026er#rj\u0026#\u00261r6jfr" ], [ 54934, "u8", "fc2*2Gfvf*2vf,2X\u0026+\u0026*fF\u0026*f+2cfF2X2*fW\u0026F\u0026v2c2f\u00268\u0026*c8\u0026XfF\u0026v2q\u0026F\u0026,2Xf 2c2%fvf*2cf 2X\u0026+\u0026*fF\u0026**q2Gfv2*W*f+cy\u0026v2\u00262" ], [ 55106, "u8", "c2\u0026X\u0026y\u0026*fl\u0026c2q\u0026+c\u00262Xf 2*2%fvf*2vf,2" ], [ 55276, "xor", "f6\u0026jrf\u0026arjr6\u0026" ], [ 55370, "u8", "*l\u0026*21\u0026F\u0026!2**F2c2%fvf*2\u0026f!2*\u0026+\u0026*fl\u0026**q2Gf!2X2vf2\u00262\u0026*2 2*\u00268\u0026X\u0026l\u0026*fF\u0026v2*\u00262\u0026F2**F2*2Gfvfq2Gf,2X\u0026y\u0026*fR\u0026vf*2cf 2X2 fl\u0026F\u0026*WF2f\u0026Z\u0026*\u0026+\u0026" ], [ 55516, "xor", "\u0026jj1r#\u0026erj#xf" ], [ 55563, "xor", "(HD\\EH9H(\\6" ], [ 55631, "xor", "1frfarj\u00266r6" ], [ 55660, "xor", "fjj1r#\u0026erj" ], [ 56010, "u8", "*y\u0026v2f\u0026F\u0026v2Xf 2*2%fvfq2v* 2X\u0026+\u0026*fl\u0026cfq2v*\u00262*W*f+cl\u0026v2\u00262" ], [ 56714, "u8", "*W\u0026v2f\u00262\u0026F2Xf 2c2%fvf+2\u0026fF2*cl\u0026ffZ\u0026*f02\u0026f!2X2vf2\u0026y\u0026v2\u00262*\u00268\u0026X\u0026l\u0026" ], [ 56778, "u8", "*W\u0026v2f\u00262\u0026F2Xf 2c2%fvf+2\u0026fF2*cl\u0026ffZ\u0026*f02\u0026f!2X2vf2\u0026y\u0026*WF2*\u00268\u0026X\u0026l\u0026" ], [ 56842, "u8", "*W\u0026v2f\u00262\u0026!2***2*2%fvfq2v**2X\u0026+\u0026" ], [ 56886, "u8", "W\u0026fl\u0026F\u0026v2c2{\u0026F\u0026X\u0026+\u0026*fF\u0026*2+\u0026+c\u00262**F2*2%fvfq2c*c2*\u0026y\u0026Xf8\u0026**q2Gf,2X2 f2\u00262\u0026v2\u00262{\u0026Z\u0026" ], [ 57052, "xor", "\u0026jj1rf\u0026arj#,f" ], [ 57240, "xor", "rfra\u00266\u00261r6j" ], [ 57286, "u8", "c2\u0026*fF\u0026*2*\u0026+c\u00262Xf 2*2%fvfq2Gf,2" ], [ 57318, "u8", "\u0026W\u0026*f+\u0026cfq2v*\u00262f2Ffl\u0026F\u0026*2,2*c+\u0026f\u0026O\u0026*f+\u0026v2*\u0026+c\u00262***2c2%fcfq2v*\u00262{\u0026R\u0026XfF\u0026vfX2\u0026f!2*W*f+c2\u0026v2 2f\u00262\u0026f\u0026O\u0026*fF\u0026*Wq\u00262\u0026!2Xfv2c2%fvfq2*fc2f" ], [ 57772, "xor", "fj\u0026qr6\u0026erj" ], [ 57836, "xor", "fj\u0026qr6\u0026erj" ], [ 58570, "u8", "*l\u0026v2+\u0026WcF2Xf 2*2%f**q2cf%2f\u0026O\u0026*f+\u0026vf*2v*\u00262" ], [ 58715, "xor", "#\u00266\u0026kr6\u0026er" ], [ 58890, "u8", "*W\u0026v2+\u0026F\u0026v2**F2c2%fvfq2v*F2f\u0026l\u0026XfF\u0026vfX2*fc2*2 fW\u00268\u0026*WF2" ], [ 58904, "xor", "r#re\u00266\u00261r6j" ], [ 59344, "u8", "\u0026F\u0026*2XfF2vW*f**q2Gfv2*cl\u0026ff2\u0026vf+2Gf,2*W*fl\u0026F\u0026v2F2*cl\u0026*\u0026y\u0026{fF\u0026*21\u0026F\u0026!2**F2*2%f**q2Gf*2X\u0026+\u0026ffy\u0026*f+2Gf*2*Wcf+cl\u0026v2 2{\u0026+\u0026" ], [ 59638, "u8", "2%f2\u0026y\u0026*2,2*\u00268\u0026*\u0026l\u0026*fF\u0026v2*\u0026+\u0026%2Xf 2c2*fvf*2v*F2X\u0026+\u0026" ], [ 59739, "xor", "#\u00266\u0026kr6\u0026er" ], [ 59915, "xor", "(HD\\EH9H(\\6" ], [ 60044, "xor", "HD\\EH9H(\\D" ], [ 60080, "u8", "2Gf*2X2Ff+cl\u0026*WF2{\u0026+\u0026*cl\u0026ff2\u0026v2+\u0026F\u0026,2***2*2Gfvfq2c**2*\u0026y\u0026Xf8\u0026c**2Gfc2*WFf2\u00262\u0026v2 2*\u0026F\u0026f\u0026O\u0026*f+\u0026v2*\u0026+c\u00262***2c2%fcfq2Gf%2f\u0026Z\u0026" ], [ 60379, "xor", "#\u0026jj1r6\u0026erj#,fj\u0026kfjj1r6\u0026er" ], [ 60520, "xor", "fj\u0026kf#j1r6\u0026er" ], [ 60774, "u8", "c+\u0026*f8\u0026cfq2c**2*2%f+\u0026F\u0026vWc2*\u00268\u0026f\u0026R\u0026" ], [ 62073, "xor", "EH(HD9(\\DHVH" ], [ 62406, "u8", "cy\u0026*f8\u0026c2q\u0026WcF2*fF2v2Gfcfq2cfF2" ], [ 64394, "u8", "f8\u0026c2q\u0026+cF2Xf 2v2Gf*f" ], [ 64458, "u8", "f8\u0026c2q\u0026W\u0026c2Xf 2v2Gf*f" ], [ 66105, "xor", "EH(H)9(\\DHVHD" ], [ 66233, "xor", "EH(HD\\K\\DHEH" ], [ 66602, "u8", "*W\u0026cfq2*f 2*2vf+\u0026F\u0026 Wv2*\u0026y\u0026{\u0026F\u0026*fy\u0026c2q\u0026F\u0026!2*fc2v2Gfcf+2c*F2X\u0026O\u0026**2\u0026cfq2Gf!2*2cfW\u00268\u0026c2*2*c8\u0026X\u0026O\u0026{fy\u0026c2q\u0026WcF2*fv2G2Gf\u0026f12cfG2*\u0026O\u0026{" ], [ 67558, "u8", "cy\u0026*fl\u0026cfq2Gf%2*2%fF\u0026F\u0026c2v2*c8\u0026X\u0026O\u0026" ], [ 67626, "u8", "fy\u0026cfq2**F2*2%fl\u00268\u0026c2\u00262*c2\u0026*\u00268\u0026" ], [ 68088, "xor", "\u0026,fxffrarj#" ], [ 68264, "xor", "f?\u00269f#\u00261r6\u0026erjr" ], [ 69066, "u8", "fy\u0026c2q\u0026lcF2*fF2c2FfcfX2c*F2X\u0026O\u0026" ], [ 70486, "u8", "fG2G2Gfcfq2cfF2*\u00268\u0026*f8\u0026cfq2cfF2" ], [ 70700, "xor", "f#\u00261rf\u0026lr?re\u0026" ], [ 70710, "u8", "2%fF\u0026F\u0026c2F2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2" ], [ 71340, "xor", "f#j1rj\u0026erjr" ], [ 71491, "xor", "9H6HVHDDEH" ], [ 72556, "xor", "f#\u00261rf\u0026er;" ], [ 72726, "u8", "f,2v2%fcf+2cfF2*\u00268\u0026*f8\u0026cfq2cfF2*2,fl\u00262\u0026cWF2*\u00268\u0026*cW\u0026Xf8\u0026c2q\u0026+\u0026v2" ], [ 73004, "xor", "f#\u00261r6\u0026er?" ], [ 73398, "u8", "2%fF\u0026F\u0026c2*2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*f*2c2\u0026fcf*2cfF2*\u0026O\u0026Xf8\u0026cfq2vfv2" ], [ 74083, "xor", "H\\6HVHDDEH" ], [ 74922, "u8", "*W\u0026cff2cfv2{2 fW\u00268\u0026GWF2*\u00268\u0026*\u00268\u0026Xf8\u0026c2q\u0026W\u0026F2*fF2*2Ffcf+2cfF2*\u0026l\u0026*f8\u0026cfq2v*\u00262{2%fW\u00268\u0026G2c2*cW\u0026*cW\u0026*f8\u0026c2q\u0026l\u0026F2*f*2c2Ffcfq2cfF2X\u00268\u0026*" ], [ 78224, "u8", "\u0026W\u0026F2**c2*2cfcfq2\u0026fv2*\u0026W\u0026*f8\u0026cfq2cfF2f2%fl\u0026y\u0026c2\u00262*c8\u0026*\u0026O\u0026" ], [ 78602, "u8", "*W\u0026v2+\u0026F\u0026!2**F2c2%fvf*2*fc2*cl\u0026*f2\u0026cfq2cfF2f2!fW\u00268\u0026c2*2*\u00268\u0026*\u00268\u0026Xf8\u0026c2*\u0026+\u0026G2*f 2c2Ffcfq2 * 2*cl\u0026*f2\u0026cfq2cfF2{2GfW\u00268\u0026\u00262,2*\u00268\u0026*\u00268\u0026*" ], [ 79242, "u8", "fO\u0026c2f\u0026Wc 2*fF2c2Ffcfq2Gfv2f\u0026l\u0026" ], [ 79702, "u8", "f\u00262G2Gfcff2cf 2f\u0026W\u0026XfZ\u0026cf" ], [ 80266, "u8", "fO\u0026c2f\u0026Wc 2*fF2c2Ffcfq2Gf\u00262" ], [ 80330, "u8", "fF\u0026c2q\u0026W\u0026F2*f*2c2 fcfq2cfF2" ], [ 82092, "xor", "f6j1rj\u0026erjr" ], [ 82122, "u8", "fR\u0026v2f\u0026+cc2*f*2v2%f *" ], [ 83020, "xor", "f#rjf,far;\u0026" ], [ 83498, "u8", "*l\u0026cfq2cf*2*Wcf+\u0026R\u0026c2\u00262*\u00268\u0026*\u00268\u0026*f8\u0026*20\u0026F\u0026v2*f 2c2%fcfq2cfF2" ], [ 83558, "u8", "\u00262\u0026{f2\u0026vff2c*F2f2!f+\u0026F\u0026c2\u00262*\u00268\u0026*\u00268\u0026{fF\u0026*2{\u0026F\u0026v2*f 2c2%fcfq2cfF2{\u00262\u0026{f2\u0026vff2cf,2{2Gf+\u0026F\u0026c2\u00262*\u00268\u0026*\u00268\u0026" ], [ 84150, "u8", "2%fF\u0026O\u0026*2G2X\u0026O\u0026" ], [ 84278, "u8", "2%f+\u0026O\u0026c2F2*\u0026F\u0026" ], [ 84694, "u8", "*v2vW*fcff2cfF2*\u00268\u0026{fF\u0026*f*2G*F2{2!fW\u00268\u0026c2F2*\u00268\u0026{\u0026F\u0026*fl\u0026cW+\u0026W\u0026\u00262*fF2c2%fcfq2cfF2*cW\u0026" ], [ 86640, "u8", "2cfF2" ], [ 87382, "u8", "fG2v2,fcfq2vf*2" ], [ 89284, "xor", "fjfxfj\u0026xf#r1fkfer\u0026\u0026er6" ], [ 89430, "u8", "f\u00262v2%fcfq2cfF2" ], [ 89546, "u8", "fF\u0026c20\u0026+cv2Xf,2v2%fcfq2cfF2" ], [ 91030, "u8", "f%2*2%f**q2\u0026f!2f\u0026l\u0026*f2\u0026cfq2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*fF2c2Ffcfq2cfF2" ], [ 92259, "xor", "(\\DHVHDDEH" ], [ 92966, "u8", "\u0026F\u0026**2\u0026cfq2cfF2f2%fyc+\u0026 Wv2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026*2*fF2c2Ffcfq2cfF2*cW\u0026*f8\u0026cfq2*fF2{2Ffl\u0026+\u0026*2cr@#@\u0026,P~P,P~~jbqwFP{PJ2Tf!2!2!f!fT2!f!" ], [ 93133, "xor", "4HO\\:H4HO\\:" ], [ 93197, "xor", "4HO\\:H4HO\\:" ], [ 93261, "xor", "4HO\\:H4HO\\:" ], [ 93325, "xor", "4HO\\:H4HO\\:" ], [ 93389, "xor", "4HO\\:H4HO\\:" ], [ 93453, "xor", "4HO\\:H4HO\\:" ], [ 93517, "xor", "4HO\\:H4HO\\:" ], [ 93581, "xor", "4HO\\:H4HO\\:" ], [ 93645, "xor", "4HO\\:H4HO\\:" ], [ 93709, "xor", "4HO\\:H4HO\\:" ], [ 93773, "xor", "4HO\\:H4HO\\:" ], [ 93837, "xor", "4HO\\:H4HO\\:" ], [ 93901, "xor", "4HO\\:H4HO\\:" ], [ 93965, "xor", "4HO\\:H4HO\\:" ], [ 94029, "xor", "4HO\\:H4HO\\:" ], [ 94093, "xor", "4HO\\:H4HO\\:" ], [ 94157, "xor", "4HO\\:H4HO\\:" ], [ 94221, "xor", "4HO\\:H4HO\\:" ], [ 94285, "xor", "4HO\\:H4HO\\:" ], [ 94349, "xor", "4HO\\:H4HO\\:" ], [ 94413, "xor", "4HO\\:H4HO\\:" ], [ 94477, "xor", "4HO\\:H4HO\\:" ], [ 94541, "xor", "4HO\\:H4HO\\:" ] ], "v": { "file.stem": "06c65f739f2caafef049167ba5536b5b1bf6cd82a7b645b7b960182d7a48012e", "file.basename": "06c65f739f2caafef049167ba5536b5b1bf6cd82a7b645b7b960182d7a48012e.vbe" }, "id": "vbs" }, "id": 0, "sz": 1303042, "ts": [ { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "37ekfpkx3/391l,", "p93/37/73/7", "OD\\K)6H/46H9/6", "as?733//7r?37/73/kr", "x6/696q;,6", "6/6r6s?,#a", "//73/3ro373//7", "e/61/93s6r;r", "UA\\4JUH9/4\\4", "a,#rk\",/373/373", "2!fZ\u0026Z\u0026FW 2T\u0026R\u00261\u0026Z\u0026Tf8\u0026v2T\u0026Z\u0026*2q* 2!2%f,fT2!f,2X\u0026Z\u0026TfZ\u0026F*+2!f!2!fZ\u00268\u0026*2!2T\u0026Z\u0026qcy\u0026TfR\u0026,2T\u0026Z\u0026,2*f!2!2!...", "OUA\\KJUH4/4\\K", "7a3//73/37/73/x#", "e//73/3xp73/73", "jjekjr3/37/3", "73//7elo/73/3" ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0x5d4fa", "0x59d50", "0x534dd", "0x5d849", "0x61424", "0x600e5", "0x59dff", "0x54ebc", "0x4e955", "0x6439b", "0x4607e", "0x4d894", "0x6684c", "0x59e0e", "0x6343c", "0x585c8" ] }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1303042.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1303042.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 1303042.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Excessively long lines (\u003e1MB)", "e": [ "Detected line(s) exceeding 1MB (potential anti-analysis technique)" ], "i": "objectives/anti-static/excessive-line-length", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "2!fZ\u0026Z\u0026FW 2T\u0026R\u00261\u0026Z\u0026Tf8\u0026v2T\u0026Z\u0026*2q* 2!2%f, \u003curl\u003e", "XRsT!;*RFf+cR%!ZbRTF+c$%wsoows%+*%w!!;*0 \u003curl\u003e", "!f*y%/2wTZl,oTZ!!+9F!0!ZTZ Twcw%sZ!ZT!8! \u003curl\u003e", "X,l!Z T,Tf+?l0Z~!19FsF/TOsT A{wbXy!zvFZv \u003curl\u003e", "R2Z*!l!lT*Z*TZ2\u0026oowsA+3ZR2\u0026;9X*AARsXAX3l \u003curl\u003e", "R:;$%A X{2!?R2TcFqZ2%8 cF!ZT!8!T!G 0qW c \u003curl\u003e", "\u0026Z\u0026TfO\u0026%2T\u0026Z\u0026v2T* 2!2%f,fq2!f,2X\u0026Z\u0026Tf+\u0026! \u003curl\u003e", "!~2T!Z!qT;c\u0026O$%R!sF$T%Z%F\u00260c9XWA0!ZT!Z!$ \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:286846", "offset:816592", "offset:738750", "offset:1151671", "offset:663962", "offset:1228801", "offset:286478", "offset:731043" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ ";/5slh^/90\u0026s5,^MK\u003eE\u003e5KH|Y..M\u003eK\u003eE5E\u003e5'3P: \u003cxor\u003e", "Ng0]6oes7ZZz[:/://.\u003cD0e-\u003cb[%g.]:8/'[8j[c \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3, "el": [ "offset:819958", "offset:457775" ] } ], "sha": "06c65f739f2caafef049167ba5536b5b1bf6cd82a7b645b7b960182d7a48012e", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-08/06c65f739f2caafef049167ba5536b5b1bf6cd82a7b645b7b960182d7a48012e.vbe", "type": "vbs" } ], "tv": "52045" } }