{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.9591549, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T09:34:07Z" }, "path": "90eefdabd6f33de39071d4bfd540654bfdc60bff3198d5637f82e10b0cabd01d.vbe", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 36, "ff": { "m": { "file": { "size": 911377.0, "entropy": 5.05, "size_bytes": 911377.0 }, "text": { "tab_count": 68.0, "digit_ratio": 0.24, "space_count": 18876.0, "total_lines": 1.0, "char_entropy": 5.05, "unique_chars": 100.0, "escape_density": 0.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 911377.0, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 911377.0, "non_ascii_ratio": 0.0, "null_byte_count": 1.0, "last_line_length": 911377.0, "long_token_count": 1994.0, "whitespace_ratio": 0.02, "most_common_ratio": 0.09, "octal_escape_count": 3.0, "non_printable_ratio": 0.02, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 50.0 } }, "s": [ [ 871, "u8", "ojIBP(S_.!@#@\u0026PP,~?" ], [ 1636, "u8", "`obj_5vpb`Ce`r\u0026+fO\u0026 21\u0026lcc2ffF2 Wcf**+2 f,2+\u0026F\u0026X*2\u0026 f{2 f%2{2cf+\u0026O\u0026vW\u00262{\u0026Z\u0026X\u00262\u0026+*l\u0026G2+\u0026y\u0026c2+f%2 2%fv**2vf*2" ], [ 1677, "xor", "B\\EH(H6D\\HN" ], [ 1780, "u8", "fl\u0026v20\u0026lc 2+f!2\u0026W f f12vfc2" ], [ 1920, "u8", "f\u00262v2*fv*f2vfv2" ], [ 1956, "xor", "H!HN\\B\\EH(HEH(HE" ], [ 2112, "u8", "f*2G2\u0026fvfq2cf 2" ], [ 2560, "u8", "fc2v2,fcf02 f!2" ], [ 2788, "u8", "AGfFc+FvAGWE#BP$sz" ], [ 3342, "u8", "hKmd3v!#@#@\u0026~P,PAH((#~\u0026(t5_@#@\u0026,P~~IHZ6/,qp}Iu@#@\u0026~,P,rZw5;~qo}eC@#@\u0026~~,P?" ], [ 9818, "u8", "f\u00262G2\u0026f\u0026ff2vfc2" ], [ 9930, "u8", "\u00262\u0026Xf2\u0026\u0026rb#*##@#@\u00263x9PwEUmOrKx@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026U;(PHwjon`*@#@\u0026~P,PF|gMpc*@#@\u0026,~P,@#@\u0026,~~PGksPt9FiGPlPUnY,}BF`" ], [ 15467, "xor", "HH\\:HEH)\\6" ], [ 15631, "u8", "2cfG2" ], [ 16095, "xor", "\\6HVHDH9HED" ], [ 16555, "xor", "HH\\:HEH)\\6" ], [ 16757, "u8", "f\u00262G2*fGf02*fG2" ], [ 16885, "u8", "f\u00262v2%f\u0026fX2vf,2" ], [ 17589, "u8", "f\u00262v2%fGf02v*F2*\u00262\u0026**l\u0026v*" ], [ 17893, "u8", "\u0026y\u0026{fW\u0026v20\u00262\u0026\u00262Xf!2\u00262%f\u0026f02\u0026fG2{\u0026l\u0026{f+\u0026cf*2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*fF2c2Ffcfq2*fF2*\u00268\u0026{f8\u0026cf*2cfF2*2Ff+c8\u0026G2%2*\u0026O\u0026*" ], [ 18690, "xor", ")\\DHVHDDEH" ], [ 20277, "u8", "fF2c2Ffcfq2cfF2*\u00268\u0026*f8\u0026cfq2vfG2" ], [ 21237, "u8", "fc2c2FfcfX2cfG2*\u00268\u0026{f2\u0026cf+2GfG2" ], [ 24309, "u8", "f 2c2Ff\u0026f*2*fG2" ], [ 24357, "u8", "\u00262\u0026{f+\u0026cWX\u00262\u0026!2Xf%2c2Ffcfq2cfF2*\u00268\u0026*f8\u0026cfq2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*fF2cWcfc*q2c**2*\u00268\u0026*f8\u0026cfq2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*" ], [ 24693, "u8", "f 2vW\u0026fvf02cfG2X\u0026R\u0026" ], [ 25282, "xor", "(\\DHVHDDEH" ], [ 27253, "u8", "f 2c2Ffcfq2cfF2*\u00268\u0026Xfy\u0026cff2cfF2*2FfW\u00268\u0026c2*2" ], [ 27306, "xor", "EH)\\EH(HH\\" ], [ 27573, "u8", "f 2c2Gf\u0026fX2*f\u00262" ], [ 27701, "u8", "f 2G2vfv*f2cfG2" ], [ 28309, "u8", "2cfF\u0026O\u0026*2v2f\u0026y\u0026X\u0026l\u0026{fl\u0026c21\u0026l\u0026G2X*F2*2%f\u0026fX2*f\u00262" ], [ 28597, "u8", "f 2G2Gfc*X2*f%2" ], [ 28613, "u8", "\u00268\u0026*fl\u0026c*X2Gf%2X2%f+\u0026+\u0026*2v2f\u0026y\u0026X\u0026O\u0026{fl\u0026c2" ], [ 28827, "xor", "HH\\O\\6H(H6" ], [ 28969, "u8", "*2\u0026\u00262X\u0026l\u0026G2X*F2c2%f*f" ], [ 29557, "u8", "fc2*2cf\u0026fX2Gf,2" ], [ 29669, "u8", "\u0026W\u0026{*8\u0026vWf\u00262\u0026\u00262Xf*2GWFfcfq2*fF2*\u00268\u0026*f8\u0026cf+2cfF2*2FfF\u0026F\u0026\u00262c2*\u00262\u0026*cW\u0026{fl\u0026c2q\u0026+cF2**\u00262G2%fcfX2cfc2*\u00262\u0026" ], [ 30741, "u8", "2*fF\u0026F\u0026\u00262,2f\u0026y\u0026X\u00268\u0026Xf2\u0026c2q\u0026l\u0026F2*fF2*2%fcfq2cfF2*\u00268\u0026*f8\u0026cfq2*fF2*2FfW\u0026+\u0026c2F2*\u00268\u0026*\u00268\u0026{fW\u0026*2" ], [ 31000, "xor", "(HEHH\\D\\DH" ], [ 31781, "u8", "c2\u0026*f8\u0026cW+\u0026l\u0026 2*fF2c2 fcfq2vfG2*\u0026y\u0026Xf+\u0026cff2v*v2*2*fW\u00268\u0026c2F2X\u00268\u0026*\u0026y\u0026Xfy\u0026c2f\u0026+cv2*f*2c2Ffcfq2*fF2*\u0026y\u0026{f2\u0026cf12cf 2*2FfW\u00268\u0026*2F2*\u00268\u0026*" ], [ 32042, "xor", "EHH\\DHEH)\\D" ], [ 32853, "u8", "2Gfl\u00262\u0026c2*2{\u0026F\u0026*\u0026y\u0026*f+\u0026v2{\u0026l\u0026F2*fF2c2%fc**2cfF2*\u0026R\u0026*fy\u0026cfX2cfF2*2,fW\u0026l\u0026*2*2*c2\u0026" ], [ 33185, "u8", "cl\u0026*\u0026l\u0026*f2\u0026c21\u0026+\u0026G2*fF2c2Ff\u0026f*2Gf%2*\u0026y\u0026*fR\u0026Gff2*fF2*2FfW\u00268\u0026c2F2{\u0026F\u0026*\u00268\u0026ff8\u0026c2f\u0026+cv2*f*2c2 fcfX2cfF2*\u00268\u0026*fF\u0026Gf{2*f 2*2%f+\u00262\u0026G2G2" ], [ 33321, "u8", "fF\u0026*21\u0026+\u0026G2*fc2G2%fcff2v*v2*\u0026l\u0026*fy\u0026cfq2vf,2*2 fWc+\u0026c2*2*\u0026O\u0026" ], [ 33577, "u8", "fW\u0026\u00262*\u0026F\u0026G2*f 2c2%fcf12*f 2*\u0026y\u0026*fy\u0026v*" ], [ 34178, "xor", "K\\DH9HDDEH" ], [ 34313, "u8", "fF\u0026*fX2*fF2f2%fW\u00268\u0026c2G2X\u0026y\u0026*\u00268\u0026*fy\u0026c2q\u0026+\u0026,2*f 2G2!fcf*2*f,2*\u0026l\u0026*fy\u0026cfX2cfF2*2,fW\u0026F\u0026G2G2*\u00268\u0026*\u0026W\u0026*fy\u0026c21\u0026W\u0026F2*f,2c2vf\u0026fT2c**2" ], [ 34889, "u8", "fF\u0026*fX2*fF2{2%fW\u00268\u0026c2G2X\u0026y\u0026" ], [ 34981, "u8", "cy\u0026*f8\u0026cW+\u0026+\u0026%2*fF2*2 fcff2v*v2*\u0026l\u0026*fW\u0026vff2*fF2*2\u0026fF\u00262\u0026c2,2X\u0026y\u0026*\u00268\u0026*fR\u0026*2q\u0026W\u0026F2** 2*2\u0026fcfX2GfG2*\u0026y\u0026*fl\u0026v*+2v*c2*2*fW\u0026y\u0026v2\u00262*\u00268\u0026*" ], [ 35562, "xor", "9HH\\DHEH)\\D" ], [ 36277, "u8", "f\u00262c2Ffcfq2\u0026fF2X\u0026y\u0026*f8\u0026cfq2vfG2" ], [ 36981, "u8", "f\u00262c2%fcfq2cfF2*\u00268\u0026{fO\u0026c*X2cfF2*2FfW\u00268\u0026\u00262c2*\u00262\u0026*\u00268\u0026{fl\u0026c2q\u0026+\u0026G2**\u00262c2Ff*fq2cf%2*\u00268\u0026{fl\u0026cf+2*fF2X2,fW\u00268\u0026*2F2*\u0026R\u0026*\u00268\u0026{*8\u0026c2+\u0026l\u0026F2" ], [ 38057, "xor", "DEH)\\DH9HN\\D" ], [ 38197, "u8", "fc2GWFfv*f2\u0026f 2Xc8\u0026" ], [ 39257, "xor", "H9HH\\B\\DHEH" ], [ 39338, "xor", "4HD\\EH9HK\\" ], [ 39349, "u8", "fc2vW\u0026fc*X2*fv2" ], [ 39797, "u8", "fc2*2\u0026fcf+2GfG2" ], [ 39861, "u8", "f 2c2cf\u0026fX2*f\u00262" ], [ 40181, "u8", "f 2vW f\u0026fX2*fG2" ], [ 40745, "u8", "*2\u0026G20\u0026+cc2Xf,2v2%f\u0026fX2*fG2X\u0026y\u0026" ], [ 40821, "u8", "f 2cW*fvf*2v*c2" ], [ 40987, "xor", "HH\\O\\6H(H6" ], [ 42037, "u8", "f 2G2,fc*X2*fG2" ], [ 42933, "u8", "f*2cW*fcf+2vfG2" ], [ 43125, "u8", "f\u00262*2vf\u0026f12cfv2" ], [ 43445, "u8", "fF2*2cfcf+2vfG2" ], [ 43701, "u8", "f 2G2,fcf+2cfv2" ], [ 44021, "u8", "fF2v2,f\u0026f12v* 2" ], [ 44085, "u8", "f 2c2Ffcf12*f%2Xc8\u0026" ], [ 44185, "xor", "HEHH\\B\\6HEH" ], [ 44569, "xor", "H9HH\\B\\DHEH6" ], [ 44970, "xor", "4HD\\EH9HK\\" ], [ 44981, "u8", "f\u00262vW\u0026fc*X2cfG2" ], [ 45045, "u8", "fc2G2*fv*f2cf*2" ], [ 45656, "xor", "(HEHH\\(\\DH" ], [ 45685, "u8", "f 2G2vfcf+2*f%2" ], [ 45813, "u8", "f\u00262c2Ff\u0026fT2v*c2" ], [ 45941, "u8", "fF2v2%f\u0026fq2\u0026f!2X\u0026R\u0026ffZ\u0026*f" ], [ 45976, "xor", "9HVHH\\O\\6H(H6" ], [ 46069, "u8", "f 2c2cfvf*2\u0026f\u00262" ], [ 46261, "u8", "f 2vW\u0026f\u0026fX2\u0026f 2" ], [ 46442, "xor", "(HD\\EH9HH\\D" ], [ 46645, "u8", "fF2vW fcf+2GfG2Xc8\u0026{fl\u0026v*f2v*c2" ], [ 46744, "xor", "(HEHD\\N\\DHEHDHVH" ], [ 46991, "u8", "2\u0026fF2X2%f2\u0026Z\u0026*2v2f\u0026y\u0026Xc8\u0026*f8\u0026v2f\u0026+cc2" ], [ 47029, "u8", "f 2G2!f\u0026fX2\u0026f 2" ], [ 47197, "xor", "\\K\\DH(H6HEH" ], [ 47384, "xor", "(HEHH\\(\\6H(H6" ], [ 47797, "u8", "fc2G2!fGf02*fG2" ], [ 48437, "u8", "fc2v2%fGf02*fG2" ], [ 48757, "u8", "f\u00262c2%fv*f2*f%2X\u0026W\u0026*f8\u0026*fX2cfG2" ], [ 48821, "u8", "fc2c2 f\u0026fX2\u0026f 2" ], [ 48858, "xor", "\\HD9(\\6HEH6" ], [ 48949, "u8", "fc2v2,fv*f2v*c2" ], [ 49141, "u8", "f 2v2%fc*q2v**2X\u0026y\u0026ffZ\u0026*f" ], [ 49183, "xor", "\\DH(H6HEHD" ], [ 49205, "u8", "fc2\u00262Ffc*q2*fG2" ], [ 49816, "xor", "(H4HD\\N\\6HEH" ], [ 50473, "u8", "*2\u0026\u00262X\u0026l\u0026G2X*F2c2%fcf+2*fF2Xc8\u0026ffZ\u0026*f" ], [ 50869, "u8", "fc2c2 f*f+2*fG2Xc8\u0026ffZ\u0026cf" ], [ 51253, "u8", "f 2G2,fc*q2v* 2" ], [ 51829, "u8", "f\u00262v2%fc*q2cf*2Xc8\u0026{f+\u0026vf02cfG2" ], [ 51893, "u8", "fc2\u00262!fGf02*fG2" ], [ 51957, "u8", "f\u00262c2Ff*fX2v*c2" ], [ 52697, "xor", "H9HH\\B\\DHEH" ], [ 52789, "u8", "f 2v2%fvf02*f*2" ], [ 52837, "u8", "\u0026l\u0026Xfl\u0026*2+\u0026l\u0026%2X*F2c2%fcf+2*fF2Xc8\u0026{f2\u0026*f+2v*c2" ], [ 53621, "u8", "fF2GWFfcf" ], [ 53685, "u8", "fc2GWFf\u0026fX2*fG2" ], [ 54042, "xor", "VHH\\B\\DHEH" ], [ 54377, "u8", "*y\u0026*2+\u0026l\u0026G2XfF2c2Ff*fq2*fG2X\u0026O\u0026{f+\u0026Gf02\u0026f!2X2%f+cy\u0026*2 2X\u0026F\u0026X\u0026O\u0026*f8\u0026*2q\u0026l\u0026G2Xf,2G2vfGf02\u0026f!2X\u0026R\u0026{fR\u0026\u0026fT2v*c2" ], [ 54488, "xor", "(HEHD9(\\DH" ], [ 54889, "u8", "fR\u0026v20\u00262\u0026 2Xf,2c2FfcfX2cfG2" ], [ 55128, "xor", "EHEHH\\B\\6HEH6" ], [ 55413, "u8", "f 2c2Gf\u0026f12cfv2" ], [ 55529, "u8", "f+\u0026\u00262q\u0026W\u0026G2*fF2G2%fcfq2v*c2" ], [ 55768, "xor", "EHEHH\\B\\DHEHD" ], [ 58474, "xor", "4HD\\EHEH)\\6" ], [ 58538, "xor", "(HD\\EH9H(\\6" ], [ 58730, "xor", "VHD\\DHEH)\\6" ], [ 58922, "xor", "(HD\\EHEH)\\6" ], [ 58986, "xor", "VHD\\EH9H(\\6" ], [ 59114, "xor", "VHD\\DHEH)\\6" ], [ 59242, "xor", "(HD\\EH9H(\\6" ], [ 59551, "xor", "\\6HEHDHVHD" ], [ 59637, "u8", "f 2c2FfGff2vfF2*\u00268\u0026" ], [ 59754, "xor", "9HD\\EH9H(\\6" ], [ 60489, "u8", "*8\u0026vfq2cfF2*2FfW\u00268\u0026cWc2*cW\u0026*\u00268\u0026**8\u0026*2f\u0026F\u0026G2Xf%2c2Ffc**2cf%2*\u00268\u0026*fW\u0026*ff2cfF2X2\u0026fW\u00268\u0026cWc2*cy\u0026*\u00268\u0026*fW\u0026*2f\u0026W\u0026F2Xf\u00262c2FfGff2c*F2*\u00268\u0026*" ], [ 60714, "xor", "4HD\\EHEH)\\6" ], [ 60745, "u8", "*8\u0026*f+2GfG2X2%fW\u00268\u0026cWc2*\u0026R\u0026*\u00268\u0026" ], [ 60777, "xor", "DVHD\\EH9H(\\6" ], [ 60815, "u8", "2GfG2f2\u0026fW\u00268\u0026cWc2*cW\u0026*\u00268\u0026**8\u0026*2+\u0026+\u0026G2Xfv2c2FfGff2cf%2*\u00268\u0026*fW\u0026*f+2GfG2X2%fW\u00268\u0026cWc2*\u0026R\u0026*\u00268\u0026*fW\u0026*2+\u0026W\u0026F2Xf\u00262c2Ffc**2c*F2*\u00268\u0026*f8\u0026c*X" ], [ 60906, "xor", "9HD\\EH9H(\\6" ], [ 61615, "u8", "\u0026l\u0026F2Xfv2c2 f*f12c* 2*\u00268\u0026**8\u0026cf02vfG2f2%fWc2\u0026G2G2*\u0026F\u0026*\u00268\u0026**8\u0026c2*\u0026+\u0026G2*f 2c2cfc**2v*F2*\u00268\u0026X*8\u0026c*q2*fF2*2%fW\u0026F\u0026vWv2*\u0026W\u0026*\u00268\u0026{fZ\u0026cWf" ], [ 62689, "u8", "\u0026l\u0026*\u00268\u0026{fR\u0026c2*\u0026l\u0026F2*fv2cWcf\u0026f*2**F2*\u00268\u0026**8\u0026cf*2cfF2*2*fWcW\u0026G2\u00262*cy\u0026*\u00268\u0026{fR\u0026c2*\u0026W\u0026F2*f*2c2\u0026fvff2*fG2*\u00268\u0026**8\u0026cf02*fF2*2%fW\u0026F\u0026vW 2*" ], [ 62945, "u8", "\u0026y\u0026*\u00268\u0026Xfy\u0026c2*\u0026+\u0026G2*f 2cWcfcfq2**F2*\u00268\u0026**8\u0026cf*2*fF2*2vfW\u0026W\u0026cWc2*\u0026W\u0026*\u00268\u0026{fR\u0026c2*\u0026+\u0026G2*f 2c2cfc**2*fc2*\u00268\u0026*fy\u0026cf*2cfF2+WvfW\u0026y\u0026cWc2*" ], [ 63881, "u8", "f2\u0026cfq2vfG2*2 fWc8\u0026*2,2*c2\u0026*\u00268\u0026Xfl\u0026c2q\u0026+\u0026G2*f 2cWFf*f12c*\u00262*\u00268\u0026**W\u0026cfq2vfG2*2 fWc8\u0026*2,2*c2\u0026*\u00268\u0026{fR\u0026c2f\u0026F\u0026G2Xf\u00262c2%f*f12cf*2*\u00268\u0026X" ], [ 64221, "xor", "\\B\\6HEHDHVH" ], [ 65269, "u8", "fF2c2FfcfX2cfF2*\u00268\u0026*f8\u0026cfX2*fF2" ], [ 65333, "u8", "*\u00262c2FfcfX2cfF2*\u00268\u0026*f8\u0026cf12vfG2{2FfW\u00268\u0026c2*2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2{fv2c2FfcfX2cfF2*\u00268\u0026*f8\u0026v*+2GfG2{2,fW\u00268\u0026c2,2*\u00268\u0026*\u00268\u0026*f8\u0026c2X\u0026l\u0026F2+" ], [ 65514, "xor", "VHD\\_HEH)\\6" ], [ 65578, "xor", "VHD\\_HEH)\\6" ], [ 65929, "u8", "fO\u0026cfq2GfG2*2*fW\u00268\u0026vW 2X\u0026R\u0026*\u00268\u0026ffO\u0026v20\u0026F\u0026G2*fF2c2Ffcfq2cfF2*\u00268\u0026*f8\u0026vff2cf\u00262f2%fW\u00268\u0026cWc2*\u0026y\u0026*\u00268\u0026*fF\u0026vW+\u0026+\u0026G2{fc2*2,f*f12cfF2*\u00268\u0026*" ], [ 66666, "xor", "VHD\\_H9HH\\ED" ], [ 67273, "u8", "*+\u0026cff2vfG2*2\u0026fW\u0026W\u0026\u00262%2{\u0026F\u0026*\u00268\u0026*fF\u0026c2+\u0026l\u0026F2*f*2c2Ffcfq2cfF2*\u00268\u0026*f8\u0026*fq2cf\u00262X2GfW\u00268\u0026v2G2{\u0026F\u0026*\u00268\u0026**8\u0026c21\u0026l\u0026F2{f*2c2FfcfX2cf 2*\u00268\u0026*" ], [ 67714, "xor", ")\\DH!HEDEH" ], [ 67864, "xor", "EH!H)\\)\\DHEHDHVHD" ], [ 68265, "u8", "fR\u0026vWq\u0026+\u0026G2+*v2c2,fc**2cf 2*\u00268\u0026*f8\u0026cfq2cfF2*2Ff+\u0026R\u0026v2G2*c8\u0026*\u00268\u0026*f2\u0026c21\u0026W\u0026F2ff\u00262cW f*f12cfF2*\u00262\u0026XfW\u0026cfq2cfF2*2FfW\u00268\u0026c2F2X\u00268\u0026*\u0026O\u0026f" ], [ 68418, "xor", "B\\DH\\HDDEH" ], [ 68713, "u8", "f+\u0026vWX\u0026W\u0026F2{fv2*2,fcfX2cf 2*\u00268\u0026*f8\u0026cfq2cfF2*2Ff+\u0026F\u0026*2*2*cl\u0026*\u00268\u0026*f2\u0026c2q\u0026+\u0026G2*f 2cWFf*f12c*\u00262*\u0026F\u0026*fF\u0026cfq2cfF2*2FfW\u00268\u0026c2F2*\u00268\u0026*\u0026O\u0026*" ], [ 69365, "u8", "**2c2%f*fq2cfG2*\u00268\u0026Xfy\u0026cf12vfG2" ], [ 69461, "u8", "2%fW\u0026O\u0026cWc2*c8\u0026*\u00268\u0026{fR\u0026c21\u0026+\u0026G2" ], [ 69801, "u8", "*2\u0026c2+\u0026W\u0026F2*fF2cW\u0026fvf{2c*F2*\u00268\u0026*f8\u0026cfX2*fF2*2 fW\u00268\u0026v2\u00262*\u0026y\u0026*\u00268\u0026**W\u0026c2q\u0026l\u0026F2X*F2c2%fGff2G*F2*\u0026y\u0026ffF\u0026cfq2cfF2*2FfW\u0026y\u0026c2*2*\u00268\u0026*\u00268\u0026X" ], [ 70186, "xor", "EH)\\EH9H(\\" ], [ 70338, "xor", "N\\DH\\HEDEH" ], [ 70421, "u8", "WvfW\u00268\u0026c2F2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026l\u0026F2*fF2c2FfcfX2cfF2*\u00268\u0026*f8\u0026cfq2cfF2*2FfW\u00268\u0026v2G2*\u0026R\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026F2*fF2c2%f\u0026f02cfc2*\u0026W\u0026*fO\u0026cff2vfG2*" ], [ 70817, "u8", "c8\u0026*\u00268\u0026**l\u0026c2+\u0026+\u0026G2*f 2c2%f\u0026f02cfc2*\u00268\u0026{fR\u0026cf+2vfG2*2 fW\u00268\u0026c2F2*cl\u0026*\u00268\u0026" ], [ 71201, "u8", "c8\u0026*\u00268\u0026XfW\u0026c2q\u0026+\u0026G2*f 2c2%f\u0026f02*fc2*\u00262\u0026" ], [ 71401, "u8", "*W\u0026c2q\u0026+\u0026G2*f\u00262c2%f\u0026f02v*F2*\u00268\u0026{fZ\u0026cfq2vfG2*2 fWcy\u0026*2F2X\u00262\u0026*\u00268\u0026XfR\u0026c2*\u0026+\u0026G2*fc2cW f*fq2*f\u00262*\u00268\u0026*fl\u0026cf*2vfG2*2cfWc2\u0026vW 2f\u00262\u0026*\u0026y\u0026" ], [ 71529, "u8", "*y\u0026c2f\u0026+\u0026G2*f*2c2%f\u0026f02cfc2*\u00262\u0026ffF\u0026cfq2vfG2*2 fW\u0026R\u0026vWv2*cl\u0026*\u00262\u0026XfF\u0026c2+\u0026+\u0026G2*f 2c2%fv*" ], [ 71657, "u8", "f8\u0026c2*\u0026+\u0026G2*f 2c2%fcf12*fF2*\u00262\u0026**W\u0026cf+2vfG2*2\u0026fWcy\u0026\u00262!2f\u0026y\u0026*\u00268\u0026ffl\u0026c2f\u0026+\u0026G2*fc2c2%f\u0026f02G*F2*\u00262\u0026X*8\u0026cf+2vfG2*2 fW\u0026R\u0026c2F2f\u0026F\u0026*\u00268\u0026" ], [ 71785, "u8", "fy\u0026c2q\u0026+\u0026G2*f\u00262c2%f*fX2c*c2*\u00262\u0026" ], [ 71969, "u8", "c8\u0026*\u00268\u0026X*8\u0026c2f\u0026+\u0026G2*f 2c2%fv*" ], [ 72169, "u8", "*l\u0026c2+\u0026+\u0026G2*fc2c2%f\u0026f02G*F2*\u00262\u0026ffR\u0026cf*2vfG2*2 fW\u00268\u0026G2\u00262*c+\u0026*\u0026y\u0026" ], [ 72353, "u8", "\u0026W\u0026*\u0026y\u0026*fl\u0026c2q\u0026+\u0026G2*f 2c2%f\u0026f02G*F2*\u00268\u0026**2\u0026cff2vfG2*2 fWcy\u0026*2F2" ], [ 72417, "xor", "H!HDHVHEDEH" ], [ 72489, "u8", "fF\u0026c2+\u0026+\u0026G2*f\u00262cWFf*fq2G*F2*\u00268\u0026ff2\u0026cf*2vfG2*2\u0026fW\u0026F\u0026vW 2*\u0026F\u0026*\u0026y\u0026{fy\u0026c2*\u0026+\u0026G2*f 2c2%fv*" ], [ 72585, "u8", "f2\u0026cfq2vfG2*2 fWcy\u0026\u00262c2f\u0026Z\u0026*\u00268\u0026Xfl\u0026c2*\u0026+\u0026G2*f 2cW f\u0026f*2cf*2*\u0026y\u0026XfO\u0026cf+2vfG2*2 fW\u0026R\u0026vWv2*cl\u0026*\u0026y\u0026Xf8\u0026c2*\u0026+\u0026G2*f 2c2%fv*" ], [ 72737, "u8", "\u0026W\u0026*\u0026y\u0026Xfy\u0026c2f\u0026+\u0026G2*f 2c2%fv*" ], [ 72801, "u8", "\u0026W\u0026*\u0026y\u0026Xfl\u0026c2+\u0026+\u0026G2*f 2c2%fv*" ], [ 73432, "xor", "9HVHH\\O\\DH" ], [ 74666, "xor", "EHH\\6H9HK\\D" ], [ 74985, "u8", "fy\u0026c2q\u0026W\u0026F2*fF2c2%fGf{2v*v2*\u00268\u0026*f8\u0026cfX2cf 2*2FfW\u00268\u0026c2,2*\u0026y\u0026*\u00268\u0026*f8\u0026c2q\u0026l\u0026F2*f%2c2Ffcf12cfF2*cW\u0026XfW\u0026v*" ], [ 77503, "u8", "2cfF2*\u00268\u0026*f8\u0026\u0026f*2cfv2*W f+c2\u0026vW 2{\u0026R\u0026*cy\u0026XfF\u0026*21\u0026W\u0026\u00262*f 2G2cf*fX2*f\u00262*\u00268\u0026*f8\u0026cfq2GfG2*2%f2\u00268\u0026*2 2" ], [ 77674, "xor", "EHD\\EHEHK\\D" ], [ 78338, "xor", "(\\DHVHDDEH" ], [ 80037, "u8", "\u00262\u0026Xfy\u0026G2{\u0026l\u0026\u00262*f\u00262cW*fcfX2vfG2+c+\u0026Xfl\u0026vf{2cfF2*2cfWcy\u0026c2F2*\u00268\u0026*\u00268\u0026**+\u0026\u002621\u0026+cc2*fv2c2%fv*" ], [ 80389, "u8", "\u00262\u0026*f8\u0026cfq2*fF2*2%fF\u0026O\u0026cWF2*\u00268\u0026*\u00268\u0026**y\u0026c2q\u0026W\u0026F2*fF2cWFfvf02cf\u00262" ], [ 80453, "u8", "\u00262\u0026*f8\u0026cfq2*fF2*2%fF\u0026O\u0026cWF2*\u00268\u0026*\u00268\u0026**y\u0026c2q\u0026W\u0026F2*fF2c2,fvf02vf,2*\u00262\u0026*f8\u0026cfq2GfG2X2 fFc8\u0026c2 2*\u00268\u0026*\u00268\u0026*fy\u0026c21\u0026Wcc2*f,2c2Ffcfq2GfG2*" ], [ 80585, "u8", "fF\u0026cfq2vf,2*2FfW\u00268\u0026vWv2*\u00268\u0026*\u00268\u0026*f8\u0026*21\u0026W\u0026*2** 2*2%fcf12cfF2*\u00268\u0026**y\u0026cfq2cfF2*2FfW\u0026+\u0026v2%2" ], [ 81289, "u8", "fy\u0026cfq2cfF2*2FfF\u00268\u0026c2F2" ], [ 82789, "u8", "\u0026W\u0026**y\u0026c2q\u0026W\u0026F2*fF2GWFfvf{2vf,2*\u0026y\u0026*f8\u0026cfq2GfG2*2cfFc8\u0026cWF2{\u0026Z\u0026*cy\u0026*fl\u0026c2q\u0026W\u0026F2*fF2c2%fcfq2v*v2*\u00268\u0026*f8\u0026cf12vf,2*W fW\u0026F\u0026c2F2{\u0026F\u0026*" ], [ 83253, "u8", "f\u00262v2%fGf{2Gf,2*\u0026y\u0026**2\u0026v*" ], [ 83754, "xor", "EHD\\EH9H(\\D" ], [ 84329, "xor", "DVHD\\EH9H(\\D" ], [ 84681, "u8", "*+\u0026vff2vf%2*2FfW\u00268\u0026vWv2*\u00268\u0026*\u00268\u0026*f8\u0026c2q\u0026W\u0026\u00262** 2*2%fcf12cfF2*\u00268\u0026**y\u0026cfq2cfF2*2Ff+\u0026+\u0026v2G2" ], [ 84866, "xor", ")\\DH9HDDEH" ], [ 84961, "u8", "cW\u0026*\u00268\u0026*fF\u0026c2q\u0026W\u0026F2*fF2c2%fvf{2cf\u00262*\u00268\u0026" ], [ 87797, "u8", "fc2G2vf\u0026fX2v*c2" ], [ 87861, "u8", "f\u00262G2Gfcf+2Gf,2" ], [ 88364, "xor", "4HO\\:H4HO\\:" ], [ 88428, "xor", "4HO\\:H4HO\\:" ], [ 88492, "xor", "4HO\\:H4HO\\:" ], [ 88556, "xor", "4HO\\:H4HO\\:" ], [ 88620, "xor", "4HO\\:H4HO\\:" ], [ 88684, "xor", "4HO\\:H4HO\\:" ], [ 88748, "xor", "4HO\\:H4HO\\:" ], [ 88812, "xor", "4HO\\:H4HO\\:" ], [ 88876, "xor", "4HO\\:H4HO\\:" ], [ 88940, "xor", "4HO\\:H4HO\\:" ], [ 89004, "xor", "4HO\\:H4HO\\:" ], [ 89068, "xor", "4HO\\:H4HO\\:" ], [ 89132, "xor", "4HO\\:H4HO\\:" ], [ 89196, "xor", "4HO\\:H4HO\\:" ], [ 89260, "xor", "4HO\\:H4HO\\:" ], [ 89324, "xor", "4HO\\:H4HO\\:" ], [ 89388, "xor", "4HO\\:H4HO\\:" ], [ 89452, "xor", "4HO\\:H4HO\\:" ], [ 89516, "xor", "4HO\\:H4HO\\:" ], [ 89580, "xor", "4HO\\:H4HO\\:" ], [ 89644, "xor", "4HO\\:H4HO\\:" ], [ 89708, "xor", "4HO\\:H4HO\\:" ], [ 89772, "xor", "4HO\\:H4HO\\:" ], [ 89836, "xor", "4HO\\:H4HO\\:" ], [ 89900, "xor", "4HO\\:H4HO\\:" ], [ 89964, "xor", "4HO\\:H4HO\\:" ], [ 90028, "xor", "4HO\\:H4HO\\:" ], [ 90092, "xor", "4HO\\:H4HO\\:" ], [ 90156, "xor", "4HO\\:H4HO\\:" ], [ 90220, "xor", "4HO\\:H4HO\\:" ], [ 90284, "xor", "4HO\\:H4HO\\:" ], [ 90330, "xor", "4H4HO\\O\\:H4" ], [ 90412, "xor", "4HO\\:H4HO\\:" ], [ 90476, "xor", "4HO\\:H4HO\\:" ], [ 90540, "xor", "4HO\\:H4HO\\:" ], [ 90604, "xor", "4HO\\:H4HO\\:" ], [ 90668, "xor", "4HO\\:H4HO\\:" ], [ 90732, "xor", "4HO\\:H4HO\\:" ], [ 90796, "xor", "4HO\\:H4HO96" ], [ 91201, "u8", "Wvfv2" ], [ 91249, "u8", "c2\u0026v2Tf W\u00262vf*f" ], [ 91373, "xor", "HO\\EH4HN\\:" ], [ 91441, "u8", "cW\u0026 2*fG2v2v*vf" ], [ 91610, "xor", "9H(HH\\)\\6HEH6H(H" ], [ 91675, "xor", "H\\HB\\)\\DH(H_HEHE" ], [ 91825, "u8", "cW\u0026 2ffG2F2v*cf" ], [ 92765, "xor", "HO\\O\\:H4H:H4H:" ], [ 92780, "xor", "4HO\\:H4HO\\:" ], [ 92828, "xor", "VHO\\O\\:H4H:H4H:" ], [ 92890, "xor", "VH\\HO\\O\\:H4H:H4" ], [ 93082, "xor", "4H\\HO\\O96H" ], [ 93219, "u8", "\u0026+\u0026T\u0026Z\u0026+fF\u0026!2T\u0026Z\u0026*2Tf!2F2!f!fT2%f!2T\u0026Z\u0026*f2\u0026!fT2!f!2T2!fZ\u0026Z\u0026!2!W*\u0026+\u0026T\u0026Z\u0026Xf+\u0026!2T\u0026R\u0026v2Tf!Wc2vf!fT2*fv2T\u0026Z\u00260f+\u0026!fT2!f!2T2!fZ\u0026Z\u0026!2!2X" ], [ 93274, "xor", "4H4HO\\O9DHEH:H4H6" ], [ 93338, "xor", "4H4HO\\O\\6HEH:H4" ], [ 93411, "u8", "\u0026+\u0026T\u0026Z\u0026+fF\u0026!2T\u0026Z\u0026*2Tf!2F2!f!fT2Gf!2T\u0026ZcXfy\u0026!fT2!f!2T2!fZ\u0026Z\u0026!2!2X\u0026+\u0026T\u0026Z\u00260fF\u0026!2T\u0026l\u0026v2Tf!W*2 f!fTWcfv2T\u0026Z\u0026Xf+\u0026!fT2%fv2T2!*W\u0026+\u0026!2!2X" ], [ 93548, "xor", "EHO\\:H4HO\\:" ], [ 93658, "xor", "(HEHO\\O\\_HEH:H4HE" ], [ 93787, "xor", "HEHO\\O\\DHEH:H4H" ], [ 93868, "xor", "4HO\\:HVHO\\:" ], [ 93933, "xor", "HO\\:H4HN\\:" ], [ 93978, "xor", "(HEHO\\O\\_HEH:H4HE" ], [ 94298, "xor", "VHEHO\\O96H9H:H4" ], [ 94363, "xor", "HEHO\\O\\_H9H:H4H" ], [ 94426, "xor", "4H\\HO\\O96H" ] ], "v": { "file.stem": "90eefdabd6f33de39071d4bfd540654bfdc60bff3198d5637f82e10b0cabd01d", "file.basename": "90eefdabd6f33de39071d4bfd540654bfdc60bff3198d5637f82e10b0cabd01d.vbe" }, "id": "vbs" }, "id": 0, "sz": 911377, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 911377.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 911377.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "!ND/_A9/6H", "6_9NEB4J4/6", "f!2!W\u0026fcfT2!f!2qcy\u0026TfR\u0026,f+2!f,Wf2 fZcl\u0026 2\u00262Tc2\u0026T\u0026Z\u0026TfOc\u00262+\u0026Z\u0026,W+*c2!W\u0026fvfT2!f,Wf\u0026Z\u0026Tf+\u0026!f*2!*FWq2 fZ...", "4:UOG)N\\4/94", "J_D9/VN6/6A9", "D(4/9JEDE(!B", "V(4/4/6KEDE", "*v2!2Gfcfq2!fF2{\u00268\u0026Tf2cv*X2!f!2q2FfZ\u00268cc2F2TclcXcy\u0026Tfl\u0026\u00262+\u0026Z\u0026,2*f!2!2vf!*+2!f!\u0026Z\u0026TfW\u0026\u0026fT2!f*2qW*fZ\u0026y..." ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0x95d51", "0x63ba5", "0x441bd", "0x89cab", "0xb7f4c", "0xb7887", "0x6f8b2", "0x445bd" ] }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 911377.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "f!2!W\u0026fcfT2!f!2qcy\u0026TfR\u0026,f+2!f,Wf2 fZcl\u0026 \u003curl\u003e", "*v2!2Gfcfq2!fF2{\u00268\u0026Tf2cv*X2!f!2q2FfZ\u00268cc \u003curl\u003e", "\u0026Z\u0026Tfl\u0026F*+2!f!2!fZ\u0026O\u0026*2!2T\u0026Z\u0026qcy\u0026TfR\u0026,2T \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:278973", "offset:279997", "offset:282125" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "gNuQ0z3\u003cQm?o`N7.'e$Q\u003c2$:WgNoeN`Q'D`=-$z` \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3, "el": [ "offset:618892" ] } ], "sha": "90eefdabd6f33de39071d4bfd540654bfdc60bff3198d5637f82e10b0cabd01d", "path": "90eefdabd6f33de39071d4bfd540654bfdc60bff3198d5637f82e10b0cabd01d.vbe", "type": "vbs" } ], "tv": "52045" } }