{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9975002408027649,
        "class": 2,
        "threshold": 0.9975002408027649
      }
    ],
    "prob": 0.99750024,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.99750024,
        "class": 2
      },
      {
        "m": "az/vbs",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99750024,
    "analyzed_at": "2026-05-30T16:43:44Z"
  },
  "path": "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₃(AsCXe)H₂(Os₂Po₂)",
        "x": 76,
        "ff": {
          "m": {
            "file": {
              "size": 181370.0,
              "entropy": 5.32,
              "size_bytes": 181370.0
            },
            "text": {
              "digit_ratio": 0.05,
              "space_count": 2988.0,
              "total_lines": 434.0,
              "char_entropy": 5.32,
              "unique_chars": 123.0,
              "lines_over_200": 37.0,
              "lines_over_500": 10.0,
              "avg_line_length": 415.9,
              "high_byte_ratio": 0.89,
              "lines_over_1000": 10.0,
              "max_line_length": 15861.0,
              "non_ascii_ratio": 0.89,
              "empty_line_ratio": 0.0,
              "last_line_length": 60.0,
              "long_token_count": 39.0,
              "whitespace_ratio": 0.02,
              "most_common_ratio": 0.08,
              "line_length_stddev": 2367.64,
              "repeated_char_sequences": 10.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 48.0,
              "most_common_char_codepoint": 226.0
            }
          },
          "s": [
            [
              2,
              "u8",
              "On Error Resume Next"
            ],
            [
              27,
              "u8",
              "mossily = \"J"
            ],
            [
              15838,
              "u8",
              "mossily = mossily \u0026 \""
            ],
            [
              31701,
              "u8",
              "mossily = mossily \u0026 \"n"
            ],
            [
              63385,
              "u8",
              "mossily = mossily \u0026 \"R"
            ],
            [
              79205,
              "u8",
              "mossily = mossily \u0026 \"X"
            ],
            [
              95025,
              "u8",
              "mossily = mossily \u0026 \"K"
            ],
            [
              110845,
              "u8",
              "mossily = mossily \u0026 \"u"
            ],
            [
              142485,
              "u8",
              "mossily = mossily \u0026 \"y"
            ],
            [
              158305,
              "u8",
              "mossily = Replace(mossily, \""
            ],
            [
              158384,
              "u8",
              "Set docetaxel = CreateObject(\"WScript.Shell\")"
            ],
            [
              158431,
              "u8",
              "Dim qpChNoNb"
            ],
            [
              158445,
              "u8",
              "qpChNoNb=\"                        \"\u0026vbCrLf\u0026_"
            ],
            [
              159005,
              "u8",
              "\"    \u003ctitle\u003eInfinite Content Scrolling\u003c/title\u003e\" \u0026 vbCrLf \u0026 _"
            ],
            [
              159084,
              "u8",
              "\"\u003c!-- font awesome library include 4.7 --\u003e\" \u0026 vbCrLf \u0026 _"
            ],
            [
              159850,
              "u8",
              "\"@import IPIilWAh('https://fonts.googleapis.com/css2?family=Inter:wght@400;700\u0026display=swap'); \" \u0026 vbCrLf \u0026 _"
            ],
            [
              159978,
              "u8",
              "\"/* default light theme */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              160185,
              "u8",
              "\"  --primary-color:"
            ],
            [
              160248,
              "u8",
              "f45b69;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              160271,
              "u8",
              "\"  --secondary-color:"
            ],
            [
              160563,
              "u8",
              "\"/* dark-mode theme */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              160738,
              "u8",
              "\"/* main styles */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              160832,
              "u8",
              "\"  /* background-color: var(--background-color); */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              161376,
              "u8",
              "\"  transition: all 0.5s ease-in-out;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              161559,
              "u8",
              "\"  color: var(--secondary-color);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              162746,
              "u8",
              "\"  box-shadow: 0 2px 4px rgb(0 0 0 / 0.1);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              163291,
              "u8",
              "\".IPIilWAh .card-item .card-IPIilWAh IPIilWAh:last-child{\" \u0026 vbCrLf \u0026 _"
            ],
            [
              163529,
              "u8",
              "\"/* skeleton animation */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              164129,
              "u8",
              "\".skeleton .card-IPIilWAh IPIilWAh{\" \u0026 vbCrLf \u0026 _"
            ],
            [
              164432,
              "u8",
              "\"  animation: skeleton_animation 1s ease-in-out infinite;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              164540,
              "u8",
              "\".skeleton .card-IPIilWAh IPIilWAh:nth-child(2){\" \u0026 vbCrLf \u0026 _"
            ],
            [
              164669,
              "u8",
              "\".skeleton .card-IPIilWAh IPIilWAh:last-child{\" \u0026 vbCrLf \u0026 _"
            ],
            [
              164849,
              "u8",
              "\"@keyframes skeleton_animation {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              165492,
              "u8",
              "\"  \u003c/section\u003e\" \u0026 vbCrLf \u0026 _"
            ],
            [
              165909,
              "u8",
              "\"Infinite IPIilWAh scrolling is a design pattern that continuously loads IPIilWAh as the user scrolls \" \u0026 vbCrLf \u0026 _"
            ],
            [
              166027,
              "u8",
              "\"towards the end of the IPIilWAh. It avoids pagination and increases user engagement. In this example, we have \" \u0026 vbCrLf \u0026 _"
            ],
            [
              166154,
              "u8",
              "\"an infinite amount of quotations that loads as you continuously scroll to the end.\" \u0026 vbCrLf \u0026 _"
            ],
            [
              166360,
              "u8",
              "\"const IPIilWAh = document.querySelector(\"\".TOIfbkbR\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              167248,
              "u8",
              "\"// set up intersection IPIilWAh \" \u0026 vbCrLf \u0026 _"
            ],
            [
              167469,
              "u8",
              "\"let IPIilWAh = (entries, IPIilWAh) =\u003e {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              167611,
              "u8",
              "\"    if(entry.IPIilWAhntersectionRatio \u003e= 1){\" \u0026 vbCrLf \u0026 _"
            ],
            [
              167689,
              "u8",
              "\"      // update IPIilWAh\" \u0026 vbCrLf \u0026 _"
            ],
            [
              167791,
              "u8",
              "\"      console.log(IPIilWAh)\" \u0026 vbCrLf \u0026 _"
            ],
            [
              167973,
              "u8",
              "\"      IPIilWAh.unobserve(entry.target);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              168327,
              "u8",
              "\"    return new Promise((resolve, reject) =\u003e {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              168557,
              "u8",
              "\"          response.json().then(res =\u003e {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              168613,
              "u8",
              "\"            IPIilWAh(res.data.length);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              169062,
              "u8",
              "\"  return await IPIilWAh(IPIilWAh);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              169165,
              "u8",
              "\"// Loads a skeleton animations for each pending IPIilWAh\" \u0026 vbCrLf \u0026 _"
            ],
            [
              169292,
              "u8",
              "\"  const IPIilWAh = document.querySelector(\"\".IPIilWAh\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              169533,
              "u8",
              "\"      const IPIilWAh = document.createElement(\"\"li\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              169709,
              "u8",
              "\"      const IPIilWAh = document.createElement(\"\"div\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              169959,
              "u8",
              "\"        const IPIilWAh = document.createElement(\"\"IPIilWAh\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              170038,
              "u8",
              "\"        IPIilWAh.appendChild(IPIilWAh);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              170135,
              "u8",
              "\"      IPIilWAh.appendChild(IPIilWAh);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              170354,
              "u8",
              "\"// Remove skeleton animations on the IPIilWAh \" \u0026 vbCrLf \u0026 _"
            ],
            [
              170482,
              "u8",
              "\"  const IPIilWAh = document.querySelectorAll(\"\".skeleton\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              170559,
              "u8",
              "\"  const IPIilWAh = IPIilWAh.length - dataAmt;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              170786,
              "u8",
              "\"    IPIilWAh.lastChild.remove();  \" \u0026 vbCrLf \u0026 _"
            ],
            [
              171520,
              "u8",
              "\"  const IPIilWAh = document.querySelectorAll(\"\".IPIilWAhending\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              171620,
              "u8",
              "\"  IPIilWAh.observe(IPIilWAh[IPIilWAh.length - 1]);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              171761,
              "u8",
              "\"    for(let IPIilWAh = 0; IPIilWAh \u003c IPIilWAh.length; IPIilWAh++){\" \u0026 vbCrLf \u0026 _"
            ],
            [
              172060,
              "u8",
              "\"      IPIilWAh[1].textContent = data[IPIilWAh].author;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              172469,
              "u8",
              "\"\u003c/html\u003e\u003ca target='_blank' href='https://www.javascriptfreecode.com' style='font-size: 8pt; text-decoration: none'\u003eJavaScript Be"
            ],
            [
              172730,
              "u8",
              "headlines = \""
            ],
            [
              172945,
              "u8",
              "headlines = headlines \u0026 \""
            ],
            [
              173013,
              "u8",
              "$sheepberry"
            ],
            [
              177519,
              "u8",
              "mossily"
            ],
            [
              178763,
              "u8",
              "headlines = Replace(headlines, \""
            ],
            [
              178846,
              "u8",
              "ingrian = \""
            ],
            [
              179035,
              "u8",
              "ingrian = ingrian \u0026 \""
            ],
            [
              181229,
              "u8",
              "ingrian = Replace(ingrian, \""
            ]
          ],
          "v": {
            "file.stem": "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb",
            "file.basename": "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs"
          },
          "id": "vbs"
        },
        "id": 0,
        "sz": 181370,
        "ts": [
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x289d8",
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x2963d",
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x299f2",
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x28e2d",
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x2954c",
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x29e00",
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x296ed",
              "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs##plain@0x297e7"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1,
            "el": [
              "embedded@0x289d8:unknown",
              "embedded@0x2963d:unknown",
              "embedded@0x299f2:unknown",
              "embedded@0x28e2d:unknown",
              "embedded@0x2954c:unknown",
              "embedded@0x29e00:unknown",
              "embedded@0x296ed:unknown",
              "embedded@0x297e7:unknown"
            ]
          },
          {
            "c": 1.0,
            "d": "javascript code embedded in string",
            "e": [
              "Detected javascript at offset 0x296ed",
              "Detected javascript at offset 0x297e7",
              "Detected javascript at offset 0x2954c",
              "Detected javascript at offset 0x28e2d",
              "Detected javascript at offset 0x29e00",
              "Detected javascript at offset 0x289d8",
              "Detected javascript at offset 0x2963d",
              "Detected javascript at offset 0x299f2"
            ],
            "i": "metadata/lang/embedded::javascript",
            "l": 2,
            "el": [
              "embedded@0x296ed:0x296ed",
              "embedded@0x297e7:0x297e7",
              "embedded@0x2954c:0x2954c",
              "embedded@0x28e2d:0x28e2d",
              "embedded@0x29e00:0x29e00",
              "embedded@0x289d8:0x289d8",
              "embedded@0x2963d:0x2963d",
              "embedded@0x299f2:0x299f2"
            ]
          },
          {
            "a": "T1059.005",
            "c": 0.75,
            "d": "WScript Run method",
            "e": [
              ".Run \""
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-run",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Destructive delete verb",
            "e": [
              "Remove"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-destructive-delete-verb",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003chtml"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Generates HTML content (DOCTYPE)",
            "e": [
              "\u003c!DOCTYPE html\u003e"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-doctype",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "WScript.Shell object string",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/com/object::wscript-shell-literal",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.9200000166893005,
            "d": "WSH runs hidden window",
            "e": [
              ".Run \"\"\u0026 ingrian \u0026\"\"\"\" \u0026 headlines \u0026 \"\"\"\", 0"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "WScript.Shell object reference",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/process/create/shell/wsh::wscript-shell",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "WSH creates shell object",
            "e": [
              "CreateObject(\"WScript.Shell\""
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-shell-create",
            "l": 4
          },
          {
            "a": "T1059.005",
            "c": 0.8500000238418579,
            "d": "WScript.Shell object creation",
            "e": [
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-shell-create",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 434.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 15861.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Instantiates WScript.Shell object",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/wsh/file::wscript-shell-object",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Shell or CreateObject invocation",
            "e": [
              "CreateObject("
            ],
            "i": "micro-behaviors/process/create/macro/office::shell-or-createobject-call",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 10.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 415.90"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1059.005",
            "c": 0.949999988079071,
            "d": "VBScript WScript.Shell launcher",
            "e": [
              ".Run \"",
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::vbs-powershell-launcher",
            "l": 3
          }
        ],
        "sha": "4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-08/4a1ea61c04eb4a7e33d78ad789833fb157a75e669ea54d14a83b8f7dc9fcf8eb.vbs",
        "type": "vbs"
      }
    ],
    "tv": "ca5ef"
  }
}