{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T16:48:12Z" }, "path": "439ced4ecb8a528711f7de9863709d1bd7fa394480f71f4bae37fee4f5936d68.vbe", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 35, "ff": { "m": { "file": { "size": 912401.0, "entropy": 5.05, "size_bytes": 912401.0 }, "text": { "tab_count": 66.0, "digit_ratio": 0.22, "space_count": 18540.0, "total_lines": 1.0, "char_entropy": 5.05, "unique_chars": 100.0, "escape_density": 0.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 912401.0, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 912401.0, "non_ascii_ratio": 0.0, "null_byte_count": 1.0, "last_line_length": 912401.0, "long_token_count": 2010.0, "whitespace_ratio": 0.02, "most_common_ratio": 0.09, "octal_escape_count": 2.0, "non_printable_ratio": 0.02, "unicode_escape_count": 6.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 38.0 } }, "s": [ [ 140, "u8", "xq/@#@\u0026?+O~U" ], [ 1346, "u8", "#~x,fJH}!`*@#@\u0026~,PPFeG}FP{~dCP;S@#@\u0026P,P,@#@\u0026,P~P@#@\u0026~~,Pk,xPZ@#@\u0026,~~PGW," ], [ 2450, "u8", "UYUY.k\todcr]" ], [ 2641, "xor", "\\EH(H6HEH_" ], [ 2657, "u8", "\u0026W\u0026 WXfv2*2Gf%f" ], [ 6535, "xor", "EHDH(DVH6\\" ], [ 7534, "xor", "o%*qo/ob/bobo" ], [ 8302, "xor", "o%*qo/ob/bobo" ], [ 8461, "xor", "\\HD9(\\DH(HE" ], [ 8646, "xor", "/%o6o%/boc" ], [ 8653, "xor", "EHD9(\\DH\\H" ], [ 8706, "url", "2c\u0026{fW\u00261\u0026+fO\u0026*2F2vc8\u0026W*\u00262Gf,f12*\u00262f*2!\u0026FfX\u00262\u0026O\u0026X\u0026{f+\u0026q\u0026F*F2c*q2*\u00260flcq\u00262fy\u0026*2 2c\u00262\u0026+f 2Gfc2vf02\u0026\u00262f*2!\u00262f0\u00262\u0026R\u0026f\u0026{fF\u0026X\u0026Ffv2cf*2c" ], [ 10704, "url", "2G2c\u0026F\u0026WfF2cfF2cfq2*\u00268f*WF\u0026Wfq\u00262\u0026Z\u0026*\u0026{fW\u0026q\u0026+f,f+2v\u0026{fl\u0026*\u0026Wf8\u0026{2G2c\u0026F\u0026WfF2vf,f+2v\u0026Ffv2 \u0026Wfq\u0026W\u0026O\u0026*\u00260fW\u0026q\u0026+*\u00262cf+2c\u0026qf+\u0026*\u0026Wf8\u0026f2c2c" ], [ 12022, "url", "fW\u0026q\u0026Wf 2cfq2c\u0026qfW\u0026q\u0026Wf2\u0026{2G2c\u0026l\u0026Wf 2GfG2cff2c\u00268fc2F\u0026Wfq\u0026W\u00268\u0026*\u0026qfW\u0026q\u0026WfF2cfq2v\u0026{f+\u0026+\u0026Wf8\u0026f2,\u0026F\u0026WfF2Gf!2cf+2c\u00268fv2c\u0026Wfq\u0026W\u0026l\u0026*\u0026{fW" ], [ 12976, "xor", "oqoco8/%oxo%/" ], [ 16428, "xor", "/xo%obo/o//bobo" ], [ 17032, "xor", "H6HED\\HD9D\\" ], [ 17516, "xor", "c8o%obo6*c/%o" ], [ 18028, "xor", "/xo%obo/o//bobo" ], [ 18348, "xor", "c8o%obo/ob/%oxo" ], [ 18540, "xor", "c8o%obo6*//" ], [ 19524, "xor", "oy/%oyob/bo" ], [ 19632, "xor", "*qo/o//bobo" ], [ 19661, "xor", "9HD9(\\HH\\HE" ], [ 22314, "xor", "ob/2o%oqoco8/" ], [ 23175, "xor", "9HEHEDEHD\\B\\DH" ], [ 23916, "xor", "cbo%oqoco8/" ], [ 24042, "xor", "ob/2o%oqoco8/" ], [ 24263, "xor", "9HEH9DEHD\\D\\" ], [ 25101, "xor", "EHD\\B\\DHVH(" ], [ 25735, "xor", "9H6H9DEHD\\D\\" ], [ 27786, "url", "\u00262fl\u0026*2F2c\u00268\u0026WfF2v*v2cf+2c\u00268fv2c\u0026Wfq\u0026W\u0026l\u0026*\u0026{fW\u0026q\u0026FfG2v*f2c\u0026qfW\u0026q\u0026Wf8\u0026*2,2c\u0026R\u0026WfF2Gf*2cfq2v\u0026Ffv2\u0026\u0026Wf0\u0026W\u00268\u0026*\u0026qfW\u0026q\u0026Ff,2c*X2c\u0026qfW\u0026q" ], [ 28524, "xor", "/8ob*0oc*6/" ], [ 28662, "url", "fW\u0026q\u0026+*\u00262cf+2v\u0026{f+\u0026f\u0026Wf8\u0026*2*2c\u0026F\u0026WfF2\u0026f\u00262cf+2c\u00268fv2c\u0026Wfq\u0026l\u0026O\u0026*\u0026{fW\u0026q\u0026Ffv2cf+2G\u0026{fl\u0026X\u0026l*8\u0026*2F2c\u00268\u0026WfF2Gf,fq2*\u00268fv2 \u0026Wfq\u0026W\u0026O\u0026*\u00260fW" ], [ 29296, "xor", "oboco2/boco" ], [ 30448, "xor", "*%o/ob/bobo" ], [ 30919, "xor", "EHDHED\\HD9D\\" ], [ 30989, "xor", "9HD9(\\HH\\HE" ], [ 31309, "xor", "EHD\\N\\)H(HE" ], [ 31495, "xor", "EHDHED\\HD9D\\HHVH" ], [ 31720, "xor", "\\NH9D6HEH9H" ], [ 31852, "xor", "/xo%obo/o//bobo" ], [ 32108, "xor", "c8o%obo/ob/%oxo" ], [ 32135, "xor", "EHEH(DVH6\\" ], [ 32202, "xor", "HED\\HD9D\\DH(HE" ], [ 32970, "xor", "HED\\HD9D\\DH(HE" ], [ 33068, "xor", "/xo%obo/ob/%o" ], [ 33284, "xor", "o2/bo/obcqo6" ], [ 33320, "xor", "\\NHED6H9HEH6H" ], [ 33671, "xor", "EHDHED\\HD9D\\" ], [ 34407, "xor", "D9(HEDEH9HEHDH" ], [ 34476, "xor", "/xo%obo/o//bobo" ], [ 34608, "xor", "o0oco6/bocobc" ], [ 34736, "xor", "o0oco6/bocobc" ], [ 34860, "xor", "/xo%oboco2/%*8o" ], [ 35056, "xor", "*qo/ob/%oco" ], [ 35308, "xor", "/6o%*qo6*c/bobo" ], [ 35372, "xor", "/6o%*qo6*c/bobo" ], [ 36336, "xor", "obo/ob/%oxo" ], [ 36578, "u8", "2vcWfv2 \u0026Ff" ], [ 36813, "xor", "9HD9(\\HH\\HE" ], [ 36999, "xor", "EHDHEDVH6\\" ], [ 37319, "xor", "EHEH9D9H6\\N\\" ], [ 37517, "xor", "4HD9D\\HH\\HE" ], [ 38413, "xor", "VH6\\D\\DH(HE" ], [ 38512, "xor", "obo6*c/%o6obc" ], [ 38978, "u8", "2c\u0026Xf+\u0026*\u0026+*+\u0026" ], [ 39303, "xor", "EHEHED\\HD9(\\" ], [ 39693, "xor", "VHD9(\\DH(HE" ], [ 39754, "xor", "HED\\H69(\\DHEH" ], [ 40014, "xor", "HD9(\\HH\\HE" ], [ 40167, "xor", "D9(HEDEH9HEH" ], [ 40615, "xor", "D\\BHEDEH\\H" ], [ 40717, "xor", "4H6\\N\\DHEHE" ], [ 41322, "xor", "obc/o%o0o/ob/bobo" ], [ 41708, "xor", "c8o%oboco2/%obo" ], [ 41741, "xor", "VHD9(\\DH(HE" ], [ 41928, "xor", "H_HED\\HD9(\\" ], [ 42160, "xor", "*qo6*b/bo/o" ], [ 42317, "xor", "EHD9D\\DH(H" ], [ 44045, "xor", "\\HD9D\\HH4HE" ], [ 44135, "xor", "D9(HED6H\\H" ], [ 45517, "xor", "EHD9D\\HH\\HE" ], [ 45831, "xor", "EHDHEDVH6\\" ], [ 46000, "xor", "oboco2/boco" ], [ 46900, "u8", "cqfW\u0026q\u0026FfG2cfq2c\u0026qfWcX\u0026Wf2\u0026" ], [ 48272, "url", "2\u00262c\u0026y\u0026WfF2GfF2cfq2v\u0026Ffc2F\u0026Wfq\u0026l\u0026l\u0026*\u0026+fW\u0026q\u0026+f,2cfq2*\u0026qfW\u0026q\u0026Wf8\u0026X2*2c\u0026y\u0026WfF2vf,fq2v\u0026Ffc2F\u0026Wfq\u0026WcW\u0026*\u0026+fW\u0026q\u0026lf\u00262cfq2v\u0026{fW\u0026q\u0026Wf8\u0026*2*" ], [ 48845, "xor", "9H6\\(\\DHEH9" ], [ 49260, "xor", "/bo%oqoco//" ], [ 52406, "url", "fW\u0026q\u0026Ff!2c*q2c\u0026qfl\u0026{\u0026WfF\u0026f2!2v\u0026y\u0026WfF2Gf,*f2c\u00268f*2\u0026\u0026Wf{\u0026WcW\u0026*\u0026qfW\u0026q\u0026Wf*2cf+2c\u0026qfW\u0026X\u0026W*8\u0026X2,2G\u0026y\u0026WfF2vf,f" ], [ 52807, "xor", "9HEH9DVH6\\B\\" ], [ 52972, "xor", "c8ob*bo6*6/" ], [ 53326, "xor", "HD\\(\\)HEH9" ], [ 53538, "url", "2G\u0026FfcWc\u0026W*q\u0026W\u00268\u0026X\u0026{fW\u0026q\u00262f*2cf02*\u0026qfWcf\u0026W*2\u0026X2*2v\u0026l\u0026WfF2Gf,f*2*\u00268fc2v\u0026W**\u00262\u0026W\u0026XcqfW\u0026q\u0026W*F2cf*2c\u0026qfW\u0026X\u0026W*W\u0026{2\u00262ccy\u0026WfF2Gf,f*2c\u00268" ], [ 54023, "xor", "9HEH9DVH6\\B\\" ], [ 54132, "url", "\u0026+fW\u0026q\u0026Ff,ff2G\u0026{f2\u0026*\u0026W*8\u0026{2G2*\u0026F\u0026WfF2Gf!2cff2v\u0026Ff\u00262\u0026\u0026Wff\u0026+c+\u0026X\u00260fW\u0026q\u0026+f,ff2v\u0026{fW\u0026+\u0026WfF\u0026X2*2*\u0026W\u0026WfF2Gf,fq2*\u00268f\u00262!\u0026W**\u0026l\u00268\u0026*\u0026+fW\u0026q" ], [ 54252, "xor", "cco%oqocob/" ], [ 54279, "xor", "9HEH9DVH6\\B\\" ], [ 54343, "xor", "9HEH9DVH6\\B\\" ], [ 54727, "xor", "9HEH9DVH6\\B\\" ], [ 54791, "xor", "9HEH9DVH6\\B\\" ], [ 54855, "xor", "9HEH9DVH6\\B\\" ], [ 55175, "xor", "9HEH9DVH6\\B\\" ], [ 55284, "url", "\u0026+fW\u0026q\u0026W*F2cfq2v\u0026{fW\u0026+\u0026W*8\u0026X2,2cc2\u0026WfF2vf,f*2v\u0026FfcWF\u0026W*q\u0026l\u0026O\u0026*cffW\u0026q\u0026l*F2cf*2v\u0026{fW\u0026+\u0026W*8\u0026X2,2cc2\u0026WfF2cf 2cf*2v\u0026Ffc2 \u0026W*q\u0026l\u0026O\u0026*cf" ], [ 55303, "xor", "9HEH9DVH6\\B\\" ], [ 55367, "xor", "9HEH9DVH6\\B\\" ], [ 55431, "xor", "9HEH9DVH6\\B\\" ], [ 55495, "xor", "9HEH9DVH6\\B\\" ], [ 55943, "xor", "9HEH9DVH6\\B\\" ], [ 56775, "xor", "9HEH9DVH6\\B\\" ], [ 57068, "xor", "/co%o%ocob/" ], [ 57192, "xor", "\\(HED6HEH(HD" ], [ 57294, "xor", "H6\\D\\DHEH9" ], [ 57642, "xor", "obcco%oqoc*6/" ], [ 57742, "xor", "H6\\D\\DHEH9" ], [ 58090, "xor", "obc/o%oqoco" ], [ 58348, "xor", "cco%oqocoy/" ], [ 58567, "xor", "9HEH9DVH6\\B\\" ], [ 59434, "xor", "ob/yo%oqoco" ], [ 60167, "xor", "(HEH9DVHD\\B\\" ], [ 60234, "url", "\u0026Wf2\u0026X2F2cc+\u0026WfF2*f 2cf12v\u0026FfvW*\u0026Wf0\u0026l\u00268\u0026*\u0026{fW\u0026q\u0026lf 2cf12v\u0026{f+cf\u0026WfO\u0026*2*2ccW\u0026WfF2Gf,f12v\u0026FfvWF\u0026Wf1\u00262\u0026R\u0026*cXfW\u0026q\u0026lf 2cf12v\u0026{f+\u00260\u0026W" ], [ 60524, "xor", "/8ob*boco//" ], [ 61228, "xor", "cco%oqo6ob/" ], [ 61610, "xor", "H9DEH\\H4HDH" ], [ 62892, "xor", "/yob*bo/ox/" ], [ 63146, "xor", "H9DEH\\H4HDH" ], [ 63239, "xor", "9HEH9DVH6\\D\\" ], [ 63404, "xor", "c8o%oqo2*8/" ], [ 65101, "xor", "VHD\\(\\DHVHE" ], [ 65353, "xor", "6HEDEHD\\B\\" ], [ 65706, "xor", "obccob*bo2ox/" ], [ 66284, "xor", "cbob*boco8/" ], [ 67244, "xor", "cbob*boco8/" ], [ 68242, "xor", "\\DH9HED(\\D" ], [ 69680, "xor", "oqoco8/%oyo" ], [ 70029, "xor", "VHD\\(\\DHVHE" ], [ 70314, "xor", "o%/xob*boco8/" ], [ 71432, "xor", "HEH(DVHD\\N\\" ], [ 71784, "xor", "\\(H9DEH9HVH6H" ], [ 73415, "xor", "9HEHEDEHD\\(\\DHVH9" ], [ 74476, "xor", "cbob*boco8/" ], [ 74924, "xor", "cbob*boco8/" ], [ 75368, "xor", "\\(HEDEHEH(H" ], [ 75820, "xor", "/8ob*boco//" ], [ 76912, "xor", "oqoco8/%oxo" ], [ 78256, "xor", "oqoco8/%oxo" ], [ 78568, "xor", "9(H9DEH\\H4H6H" ], [ 79247, "xor", "4H:\\O\\OH4H4" ], [ 79311, "xor", "4H:\\O\\OH4H4" ], [ 79375, "xor", "4H:\\O\\OH4H4" ], [ 79439, "xor", "4H:\\O\\OH4H4" ], [ 79503, "xor", "4H:\\O\\OH4H4" ], [ 79567, "xor", "4H:\\O\\OH4H4" ], [ 79631, "xor", "4H:\\O\\OH4H4" ], [ 79695, "xor", "4H:\\O\\OH4H4" ], [ 79759, "xor", "4H:\\O\\OH4H4" ], [ 79823, "xor", "4H:\\O\\OH4H4" ], [ 79887, "xor", "4H:\\O\\OH4H4" ], [ 79951, "xor", "4H:\\O\\OH4H4" ], [ 80015, "xor", "4H:\\O\\OH4H4" ], [ 80079, "xor", "4H:\\O\\OH4H4" ], [ 80143, "xor", "4H:\\O\\OH4H4" ], [ 80207, "xor", "4H:\\O\\OH4H4" ], [ 80271, "xor", "4H:\\O\\OH4H4" ], [ 80335, "xor", "4H:\\O\\OH4H4" ], [ 80399, "xor", "4H:\\O\\OH4H4" ], [ 80463, "xor", "4H:\\O\\OH4H4" ], [ 80527, "xor", "4H:\\O\\OH4H4" ], [ 80591, "xor", "4H:\\O\\OH4H4" ], [ 80655, "xor", "4H:\\O\\OH4H4" ], [ 80719, "xor", "4H:\\O\\OH4H4" ], [ 80783, "xor", "4H:\\O\\OH4H4" ], [ 80847, "xor", "4H:\\O\\OH4H4" ], [ 80911, "xor", "4H:\\O\\OH4H4" ], [ 80975, "xor", "4H:\\O\\OH4H4" ], [ 81039, "xor", "4H:\\O\\OH4H4" ], [ 81103, "xor", "4H:\\O\\OH4H4" ], [ 81167, "xor", "4H:\\O\\OH4H4" ], [ 81295, "xor", "4H:\\O\\OH4H4" ], [ 81359, "xor", "4H:\\O\\OH4H4" ], [ 81423, "xor", "4H:\\O\\OH4H4" ], [ 81487, "xor", "4H:\\O\\OH4H4" ], [ 81551, "xor", "4H:\\O\\OH4H4" ], [ 81615, "xor", "4H:\\O\\OH4H4" ], [ 81679, "xor", "4H:\\O\\OH4H4" ], [ 82188, "u8", "\u0026WfF\u0026X2G2\u0026\u0026+\u0026lfv2%fG2*f*2c\u0026+f*2v\u0026Wf{\u00262\u0026F\u0026X\u0026" ], [ 82191, "xor", "(H6\\)\\HHEH" ], [ 82348, "xor", "ob/6*bobo/o2cbo6o0/" ], [ 82380, "u8", "cWfy\u0026f2G2F\u0026+cWfv2*fv2%f" ], [ 82684, "u8", "cWf 2cf{2v\u0026" ], [ 83023, "xor", "(HE\\)\\DHEHE" ], [ 83664, "xor", "H:\\O\\OH4H4" ], [ 84047, "xor", "EH:\\O\\HH(H4" ], [ 84216, "u8", "fZ\u0026T\u0026Rfv2!fT2!\u0026TfZ\u0026T\u0026ZfZ\u0026T2!2*\u0026+\u0026Zf!Wcfv2!fT2F\u0026+f!2!clf*\u0026Z\u0026Z\u0026*\u0026{fZ\u0026T\u00262fv2!fT2*\u0026{fZ\u0026T\u0026Wf+\u0026T2!Wv\u0026+\u0026Zf!2 fG2!fT2!\u0026lf!2!\u00268fT\u0026Z\u0026Z\u0026{\u0026T" ], [ 84239, "xor", "4H:\\O\\DHEH4" ], [ 84367, "xor", "4H:\\O\\DHEH4" ], [ 84424, "u8", "fZ\u0026TcWf+\u0026T2!2*\u0026+\u0026Zf!2%fv2!fT2!\u0026Zf!2!\u0026lf" ], [ 84431, "xor", "EH:\\O\\DHEH4" ], [ 84495, "xor", "EH:\\O9HHEH4" ], [ 84559, "xor", "EH:\\O\\BHEH4" ], [ 84623, "xor", "4H:\\O\\OH4H4" ], [ 84751, "xor", "EH:\\O9HH9H4" ], [ 84879, "xor", "EH:\\O\\BHEH4" ], [ 84943, "xor", "(H:\\O\\KHEH4" ], [ 85007, "xor", "9H:\\O9HHEH4" ], [ 85071, "xor", "9H:\\O\\OH4H4" ], [ 85112, "u8", "fZ\u0026Tclf 2!fTWc\u0026" ], [ 85135, "xor", "EH:\\O\\KHEH4" ], [ 85199, "xor", "EH:\\O9DH9H4" ], [ 85263, "xor", "EH:\\O\\BH9H4" ], [ 85391, "xor", "EH:\\O\\BHEH4" ], [ 85519, "xor", "EH:\\O\\KHEH4" ], [ 85583, "xor", "EH:\\O\\BHEH4" ], [ 85752, "u8", "fZ\u0026TcWfv2!fT2F\u0026" ], [ 85775, "xor", "9H:\\O\\BH(H4" ], [ 85839, "xor", "4H:\\O\\(H4H4" ], [ 85903, "xor", "EH:\\O\\DHEH4" ], [ 85967, "xor", "VH:\\O\\OH4H4" ], [ 86095, "xor", "EH:\\O\\BH9H4" ], [ 86159, "xor", "EH:\\O\\NH(H4" ], [ 86223, "xor", "4H:\\O\\OH4H4" ], [ 86287, "xor", "EH:\\O\\HH(H4" ], [ 86352, "xor", "H:\\O\\OH4H4" ], [ 86415, "xor", "EH:\\O\\BHEH4" ], [ 86479, "xor", "9H:\\O\\OH4H4" ], [ 86543, "xor", "4H:\\O\\OH4H4" ], [ 86607, "xor", "4H:\\O\\(H4H4" ], [ 86863, "xor", "4H:\\O\\OH4H4" ], [ 86991, "xor", "4H:\\O\\OH4H4" ], [ 87024, "u8", "\u0026Z\u0026Z\u0026T\u0026TfZ\u0026T\u00268f!2!fT2F\u0026TfZ\u0026T\u0026ZfZ\u0026T2!2!\u0026Z\u0026Zf!2!f!2!fT2!\u0026Zf!2!\u0026ZfT\u0026Z\u0026Z\u0026T\u0026TfZ\u0026T\u0026Zf!2!fT2!\u0026TfZ\u0026T\u0026ZfR\u0026T2!2!\u0026Z\u0026Zf!2!f!2!fT2F\u0026Zf!2!\u0026ZfT" ], [ 87055, "xor", "4H:\\O\\OH4H4" ], [ 87183, "xor", "4H:\\O\\OH4H4" ], [ 87247, "xor", "4H:\\O\\OH4H4" ], [ 87312, "xor", "H:\\O\\OH4H4" ], [ 87375, "xor", "4H:\\O\\OH4H4" ], [ 87439, "xor", "4H:\\O\\OH4H4" ], [ 87503, "xor", "4H:\\O\\OH4H4" ], [ 87567, "xor", "4H:\\O\\OH4H4" ], [ 87631, "xor", "4H:\\O\\OH4H4" ], [ 87695, "xor", "4H:\\O\\OH4H4" ], [ 87759, "xor", "4H:\\O\\OH4H4" ], [ 87823, "xor", "4H:\\O\\OH4H4" ], [ 87887, "xor", "4H:\\O\\OH4H4" ], [ 88143, "xor", "4H:\\O\\OH4H4" ], [ 88207, "xor", "(H:\\O\\OH4H4" ], [ 88268, "u8", "\u0026ZfFcX2 Wc\u0026+\u0026lfv2%fvWcf" ], [ 88338, "u8", "2vW\u0026\u0026lcWfv2*fv2%f" ], [ 88592, "xor", "H:\\O\\OH4H4" ], [ 88655, "xor", "VH:\\O\\OH4H4" ], [ 89016, "u8", "fy\u0026Xclf Wcf" ], [ 89032, "u8", "fW\u0026{\u00262fF\u002612G2\u0026\u0026l\u00262f 2,f\u00262%ff2!\u00262f*2v\u0026Wff\u00262\u00262\u00261\u0026ff8\u0026f\u0026+f\u00262*ff2\u0026\u0026" ], [ 89360, "xor", "HE\\)\\DHEH9" ], [ 89487, "xor", "EH:\\O\\OH4H4" ], [ 89552, "xor", "H:\\O\\OH4H4" ], [ 89615, "xor", "4H:\\O\\OH4H4" ], [ 89764, "u8", "2*\u0026+fc2G\u00262f{\u0026O\u0026F\u0026f\u0026Xf2\u0026+\u0026Of\u00262%ff2!\u0026ffl\u0026" ] ], "v": { "file.stem": "439ced4ecb8a528711f7de9863709d1bd7fa394480f71f4bae37fee4f5936d68", "file.basename": "439ced4ecb8a528711f7de9863709d1bd7fa394480f71f4bae37fee4f5936d68.vbe" }, "id": "vbs" }, "id": 0, "sz": 912401, "ts": [ { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "\u0026Wf2\u0026X2F2cc+\u0026WfF2*f 2cf12v\u0026FfvW*\u0026Wf0\u0026l\u00268\u0026*\u0026{fW\u0026q\u0026lf 2cf12v\u0026{f+cf\u0026WfO\u0026*2*2ccW\u0026WfF2Gf,f12v\u0026FfvWF\u0026Wf1\u00262...", "c8ob*bo6*6/", "2\u00262c\u0026y\u0026WfF2GfF2cfq2v\u0026Ffc2F\u0026Wfq\u0026l\u0026l\u0026*\u0026+fW\u0026q\u0026+f,2cfq2*\u0026qfW\u0026q\u0026Wf8\u0026X2*2c\u0026y\u0026WfF2vf,fq2v\u0026Ffc2F\u0026Wfq\u0026WcW\u0026*\u0026+...", "2G2c\u0026F\u0026WfF2cfF2cfq2*\u00268f*WF\u0026Wfq\u00262\u0026Z\u0026*\u0026{fW\u0026q\u0026+f,f+2v\u0026{fl\u0026*\u0026Wf8\u0026{2G2c\u0026F\u0026WfF2vf,f+2v\u0026Ffv2 \u0026Wfq\u0026W\u0026O\u0026*\u00260fW...", "\u0026+fW\u0026q\u0026Ff,ff2G\u0026{f2\u0026*\u0026W*8\u0026{2G2*\u0026F\u0026WfF2Gf!2cff2v\u0026Ff\u00262\u0026\u0026Wff\u0026+c+\u0026X\u00260fW\u0026q\u0026+f,ff2v\u0026{fW\u0026+\u0026WfF\u0026X2*2*\u0026W\u0026WfF2G...", "fW\u0026q\u0026+*\u00262cf+2v\u0026{f+\u0026f\u0026Wf8\u0026*2*2c\u0026F\u0026WfF2\u0026f\u00262cf+2c\u00268fv2c\u0026Wfq\u0026l\u0026O\u0026*\u0026{fW\u0026q\u0026Ffv2cf+2G\u0026{fl\u0026X\u0026l*8\u0026*2F2c\u00268\u0026WfF...", "co%c6/0c//", "oxo2/0o2*b/?", "*boycbo6*0/", "c8o%oqo2*8/", "/8oq*qo2*8/", "o0/2*bob*co6/%o6*", "oycbo6*0/qo", "ccobo0o2*6/bo6o", "*o6c%o6*0/", "2G\u0026FfcWc\u0026W*q\u0026W\u00268\u0026X\u0026{fW\u0026q\u00262f*2cf02*\u0026qfWcf\u0026W*2\u0026X2*2v\u0026l\u0026WfF2Gf,f*2*\u00268fc2v\u0026W**\u00262\u0026W\u0026XcqfW\u0026q\u0026W*F2cf*2c\u0026qfW..." ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0xeb4a", "0xceec", "0xbc90", "0x29d0", "0xd374", "0x6ff6", "0x4dfac", "0x188b4", "0x21434", "0xf7ac", "0x476b4", "0x1886c", "0x21886", "0x3e6f4", "0x36249", "0xd122" ] }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 912401.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 912401.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.9200000166893005, "d": "Security advisory source identifiers", "e": [ "Osv" ], "i": "micro-behaviors/data/text/security/threat-intel::advisory-source-identifiers", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 912401.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "2G\u0026FfcWc\u0026W*q\u0026W\u00268\u0026X\u0026{fW\u0026q\u00262f*2cf02*\u0026qfWcf \u003curl\u003e", "\u003cbinary data\u003e \u003curl\u003e", "2c\u0026{fW\u00261\u0026+fO\u0026*2F2vc8\u0026W*\u00262Gf,f12*\u00262f*2!\u0026F \u003curl\u003e", "2G2c\u0026F\u0026WfF2cfF2cfq2*\u00268f*WF\u0026Wfq\u00262\u0026Z\u0026*\u0026{fW \u003curl\u003e", "ZcX ;0ZZs9fAsAq$F,)fz1;ZTl,+AF;c;q+32y!9 \u003curl\u003e", "\u0026Wf2\u0026X2F2cc+\u0026WfF2*f 2cf12v\u0026FfvW*\u0026Wf0\u0026l\u00268 \u003curl\u003e", "F~f8G{wc8v,+cW)2z2/*F*0qRcGO{bW(+o\u0026WZ2,1 \u003curl\u003e", "fW\u0026q\u0026Wf 2cfq2c\u0026qfW\u0026q\u0026Wf2\u0026{2G2c\u0026l\u0026Wf 2GfG \u003curl\u003e", "fW\u0026q\u0026+*\u00262cf+2v\u0026{f+\u0026f\u0026Wf8\u0026*2*2c\u0026F\u0026WfF2\u0026f\u0026 \u003curl\u003e", "2\u00262c\u0026y\u0026WfF2GfF2cfq2v\u0026Ffc2F\u0026Wfq\u0026l\u0026l\u0026*\u0026+fW \u003curl\u003e", "\u0026+fW\u0026q\u0026Ff,ff2G\u0026{f2\u0026*\u0026W*8\u0026{2G2*\u0026F\u0026WfF2Gf! \u003curl\u003e", "\u00262fl\u0026*2F2c\u00268\u0026WfF2v*v2cf+2c\u00268fv2c\u0026Wfq\u0026W\u0026l \u003curl\u003e", "\u0026+fW\u0026q\u0026W*F2cfq2v\u0026{fW\u0026+\u0026W*8\u0026X2,2cc2\u0026WfF2v \u003curl\u003e", "fW\u0026q\u0026Ff!2c*q2c\u0026qfl\u0026{\u0026WfF\u0026f2!2v\u0026y\u0026WfF2Gf, \u003curl\u003e", "fW0fFs11W%FT{;\u0026f ;/FAq+bA%A;b2XFW;8v)+G2 \u003curl\u003e", "w!*,~3y\u0026{l*Gv!lsZ+\u0026;fX*AA0$l!Z2f2ls*+/XG \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:53538", "offset:445467", "offset:8706", "offset:10704", "offset:634827", "offset:60234", "offset:782494", "offset:12022", "offset:28662", "offset:48272", "offset:54132", "offset:27786", "offset:55284", "offset:52406", "offset:673742", "offset:884379" ] } ], "sha": "439ced4ecb8a528711f7de9863709d1bd7fa394480f71f4bae37fee4f5936d68", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-08/439ced4ecb8a528711f7de9863709d1bd7fa394480f71f4bae37fee4f5936d68.vbe", "type": "vbs" } ], "tv": "176d6" } }