{ "ml": { "l": 0, "v": "6", "fs": [ { "l": 0, "id": 0, "prob": 1.0 } ], "prob": 1.0, "models": [ { "m": "az", "prob": 0.9434439, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "analyzed_at": "2026-06-02T12:00:22Z" }, "path": "a4c420a51a30d6c67e55bc6d3d6692caf2ec6bb289d32fee0dd9287a38022994.vbe", "raw": { "v": "6", "fs": [ { "f": "O(As)Md", "x": 36, "ff": { "m": { "file": { "size": 1440183.0, "entropy": 5.15, "size_bytes": 1440183.0 }, "text": { "tab_count": 57.0, "digit_ratio": 0.21, "space_count": 32460.0, "total_lines": 1.0, "char_entropy": 5.15, "unique_chars": 100.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 1440183.0, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 1440183.0, "non_ascii_ratio": 0.0, "null_byte_count": 1.0, "last_line_length": 1440183.0, "long_token_count": 2959.0, "whitespace_ratio": 0.02, "most_common_ratio": 0.07, "non_printable_ratio": 0.02, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 102.0 }, "binary": { "overall_entropy": 5.15 } }, "s": [ [ 90, "xor", "%\u0026*0;b'XcpEcn497-E" ], [ 102, "u8", "r(%+1YcJUm4n9EV" ], [ 471, "u8", "V^J#@#@\u0026,~P,@#@\u0026P,P~@#@\u0026PP,~.g.pj~xPzDMlz`EKmY4JB~JbxES,JmUEBPEY" ], [ 995, "u8", "tKvEWfX2cyG*+,+/vW 3vlG0" ], [ 1195, "u8", "6Y@#@\u0026@#@\u0026~P,~In9z|v#@#@\u0026d@#@\u0026d@#@\u00267@#@\u0026d@#@\u0026i@#@\u0026i@#@\u0026i@#@\u0026i@#@\u0026d@#@\u0026i@#@\u00262U[,?;4@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026wEUmDrKx~Ij:2Kv#@#@\u0026P," ], [ 1363, "u8", "*l\u0026 fT2cf*2{2%fF\u0026Z\u0026vW\u00262" ], [ 1508, "xor", "\\HN9H\\EH4H" ], [ 1520, "xor", "9HED\\HN\\:H(HO\\E" ], [ 1567, "u8", "2%fy\u0026Z\u0026\u0026Wc2+\u0026Z\u0026*\u00262\u0026{fy\u0026v2X\u0026+\u0026F2{fc2v2*fc*" ], [ 1609, "u8", "2vf 2" ], [ 1619, "u8", "fl\u0026vff2Gfc2+2%fy\u0026y\u0026*2G2X\u00262\u0026" ], [ 1825, "xor", "zZ:e:j.0.c" ], [ 2303, "u8", "fG2*2 fvfX2vfF2" ], [ 2467, "xor", "H4HN\\O\\EH4HEH4HE" ], [ 2612, "xor", "VH)\\DHEHK\\" ], [ 2687, "u8", "f%2v2*fv*X2!*F2+\u0026Z\u0026+fZ\u0026 fT2 f!2+2!fy\u0026Z\u0026 2!2+\u0026Z\u0026+\u0026Z\u0026+fZ\u0026 2T\u0026y\u0026!2{f\u00262v2%f *X2*f 2{\u0026l\u0026" ], [ 2695, "xor", "D6\\OD(\\EH4HE" ], [ 2723, "xor", "H4HN\\O\\EH4HEH4HE" ], [ 2783, "u8", "2%fycl\u0026*2 2" ], [ 2815, "u8", "fc2 2%f f+2cf%2*cy\u0026*f2\u0026*fX2**\u00262X2\u0026f+c+\u0026v2v2{\u0026W\u0026{\u0026F\u0026" ], [ 2868, "xor", "VH)\\EHEHD\\6DH\\)9H" ], [ 3199, "u8", "f*2G2 f*ff2vf%2" ], [ 3263, "u8", "f*2G2 fGff2vf%2" ], [ 3363, "xor", "H4HN\\O\\EH4H6H\\H" ], [ 3555, "xor", "H4HN\\O\\EH4HEH4HE" ], [ 3747, "xor", "H4HH9(\\EH4HE" ], [ 4003, "xor", "H4HN\\O\\EH4HE" ], [ 4255, "u8", "2%fFc2\u0026*W\u00262+\u0026y\u0026+\u0026Z\u0026+f+\u0026 2T\u0026+c\u00262+f,2 2!f\u0026*q2 f!2+cl\u0026Xf2\u0026vfX2v**2" ], [ 4399, "u8", "\u0026W\u0026+fZ\u0026*2{\u0026+\u0026,2{fc2v2%f!*q2 f!2+\u0026Z\u0026+fZ\u0026 fT2 f!2+2!fy\u0026Z\u0026 2!2+\u0026Z\u0026+\u0026Z\u0026+fZ\u0026 2T\u0026y\u0026!2+f!2 2!f fT2*fG2X\u00262\u0026" ], [ 4451, "xor", "H4HN\\O\\EH4HEH4HE" ], [ 4579, "xor", "H4HN\\O\\EH4HEH4HE" ], [ 4643, "xor", "H4HN\\O\\EH4HEH4HE" ], [ 4707, "xor", "H4HN\\O\\EH4HDH" ], [ 4872, "xor", ":\\NDN\\EH4H" ], [ 4927, "u8", "f\u00262G2cfvf12v*v2" ], [ 5000, "xor", ":\\HD(\\EH4HD" ], [ 5043, "u8", "fF\u0026 2T\u00262cc2+f!2 2%fcf{2vf*2{\u0026W\u0026**+\u0026vf+2v*F2" ], [ 5193, "u8", "2\u0026f 2+\u0026y\u0026+fO\u0026 *X2cf*2{2%f+\u0026l\u0026v2\u00262X\u00268\u0026{\u0026l\u0026" ], [ 5237, "xor", "H)\\EH(HB\\E" ], [ 5284, "xor", "VHN\\O\\DHEH6H" ], [ 5411, "xor", "H(HN\\N\\EH4HEHEHE" ], [ 5667, "xor", "H4HH9(\\EH4HDHEH" ], [ 5723, "xor", "z0.cK6ze:F:" ], [ 5971, "u8", "f8\u0026Gff2vf*2+2%fF\u0026Z\u0026 W*2*cl\u0026" ], [ 6067, "xor", "D\\HN96HEHD\\" ], [ 6824, "u8", "6D@#@\u0026P~~,@#@\u0026P,~P\\.pjjP'~thA)A@#@\u0026Ax[,s!xmDkKU@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026w;UmDkKx~|B\\tfc5;ep\\#@#@\u0026,PP~9b:~(V6`|@#@\u0026P,P" ], [ 8158, "xor", "1wQKdorIEIEQwIsx" ], [ 8213, "u8", "vFc+3W2clXclZc+{+v8vGvXG{" ], [ 12405, "xor", "EHEHEDH\\DD" ], [ 12485, "xor", "EHDHEDVH6\\" ], [ 13637, "xor", "EHEHED\\H6\\N\\DH(H" ], [ 15115, "xor", "VHD\\(\\DHVHE" ], [ 15372, "xor", "HD\\(\\DHVHE" ], [ 15718, "xor", ".Z:76z:K:e:6:mzp" ], [ 16072, "xor", "HEDEHD\\N\\)H(H" ], [ 16139, "xor", "EHD\\N\\)H(H" ], [ 17291, "xor", "9HD\\N\\)H(HE" ], [ 18242, "xor", ":mzK:m:Kze:6.Z." ], [ 20875, "xor", "EHD9D\\HH4H" ], [ 22725, "xor", "EHEH(DVH6\\" ], [ 24075, "xor", "9HD9(\\HH\\HE" ], [ 24965, "xor", "EHDHEDVH6\\" ], [ 25547, "xor", "4HD9D\\HHVHE" ], [ 25989, "xor", "EHEH(DVH6\\" ], [ 26309, "xor", "EHEHED\\H6\\N\\DHEHE" ], [ 26827, "xor", "(H6\\N\\DHEH" ], [ 27759, "xor", "e:6:7zK:m:Kz0.6zD." ], [ 28122, "xor", "zj.:zH.6:ez" ], [ 30063, "xor", "e:D:7zZ:7:KzZ." ], [ 30914, "xor", ":mzK:6:Kze:6.0." ], [ 31883, "xor", "EH6\\B\\DHVHE" ], [ 32652, "xor", "HD\\N\\)H(HE" ], [ 32715, "xor", "(HD\\(\\DHVHE" ], [ 33163, "xor", "9HD\\N\\DHVHE" ], [ 33228, "xor", "HD\\N\\DHVHE" ], [ 33803, "xor", "EHD\\N\\DHVHE" ], [ 34059, "xor", "4HD\\N\\)H(HE" ], [ 34952, "xor", "H9D\\HD9(\\DH(HE" ], [ 35781, "xor", "EHDHED\\HD9D\\" ], [ 35891, "xor", "6z7:6:7z9." ], [ 35973, "xor", "EHDHEDVH6\\" ], [ 36229, "xor", "EHEHEDVHD\\N\\)H(HE" ], [ 37388, "xor", "HD\\N\\)H(HE" ], [ 37512, "xor", "HEDEHD\\N\\)H(HE" ], [ 37900, "xor", "H6\\D\\DH(HE" ], [ 38243, "xor", "Kzj.::76z:p:e:c" ], [ 38347, "xor", "9HD\\N\\)H(HE" ], [ 38539, "xor", "EHD9D\\HH\\HE" ], [ 38732, "xor", "HD\\N\\)H(HE" ], [ 38859, "xor", "EHD9D\\HH\\HE" ], [ 39109, "xor", "EHDHEDVHD9D\\" ], [ 40002, "xor", ":gzp:z:76e:D.j." ], [ 40203, "xor", "4H69(\\HH\\HE" ], [ 40267, "xor", "9HD9(\\HH\\HE" ], [ 40331, "xor", "4H69(\\HH\\HE" ], [ 40392, "xor", "HED\\HD9D\\DH(HE" ], [ 40517, "xor", "EHDHEDVH6\\" ], [ 41095, "xor", "m:76e:6.j." ], [ 41317, "xor", "D9(HED6H9H" ], [ 41376, "u8", "2vcyfv2 \u0026Ff" ], [ 42309, "xor", "EHEH(DVH6\\" ], [ 43686, "xor", "\\(HEDEH9HEH6H" ], [ 43979, "xor", "VH6\\D\\DH(HE" ], [ 44107, "xor", "VH6\\D\\DH(HE" ], [ 44427, "xor", "VHD9(\\DH(HE" ], [ 44741, "xor", "EHDHEDVH6\\" ], [ 45511, "xor", "m:76e:cK:." ], [ 46347, "xor", "\\HD9(\\DH(HE" ], [ 46693, "xor", "D\\BHED6HEH9H6H" ], [ 47499, "xor", "VHD9(\\DH(HE" ], [ 48453, "xor", "EHEH(DVH6\\" ], [ 48965, "xor", "EHEH9D9HD9D\\" ], [ 49221, "xor", "EHDHED\\HD9D\\" ], [ 49632, "u8", "2vclfv2 \u0026Wf" ], [ 49733, "xor", "EHEH9DVHD\\N\\DHVH" ], [ 49829, "xor", "D9(HED6H9H" ], [ 50565, "xor", "EHDHED\\HD9D\\" ], [ 50760, "xor", "HED\\HD9(\\DH" ], [ 51147, "xor", "!HD9D\\DH(HE" ], [ 51915, "xor", "9HD9(\\HH\\HE" ], [ 51979, "xor", "EH69(\\HH4H" ], [ 52292, "u8", "fWcq\u0026+fR\u0026X2 2vcW\u0026lf,2Gfc2cf" ], [ 52328, "xor", ":7zc:K:e:6:mzK" ], [ 52427, "xor", "VHD\\(\\DHVHE" ], [ 52930, "xor", ":mzK:m:Kze:6.Z." ], [ 52994, "xor", ":mzK:m:Kze:6.Z." ], [ 53442, "xor", ":mzK:m:K6e:6.Z." ], [ 54822, "xor", "\\(HEDDH9H!H" ], [ 55934, "xor", "66.j:7zK:m:Kze:D." ], [ 58371, "xor", "6zK:m:pze:6.j.j:Z:e6j." ], [ 59098, "xor", "6Z.6z-.j:ez" ], [ 59354, "xor", "6Z.6z-.j:ez" ], [ 59558, "xor", ".Z:Kz7:K:K:6:mze" ], [ 59610, "xor", "6Z.6z-.j:ez" ], [ 59738, "xor", "6Z.6z-.j:ez" ], [ 60198, "xor", "\\(HEDEH9HVH6H" ], [ 60826, "xor", "6Z.6z-.j:ez" ], [ 60890, "xor", "6Z.6z-.j:ez" ], [ 60995, "xor", "zzK:m:Kze:6." ], [ 62319, "xor", "e:c:gzZ:6:pz0.6z-." ], [ 65455, "xor", "e:c:gzZ:6:pz0.6z-." ], [ 65794, "xor", ":7zK:m:pze:6.0." ], [ 66254, "u8", "Wv2v\u0026F\u0026Wfv2cfF2cfq2*\u00268fc2F\u0026Wf" ], [ 67750, "xor", "\\HHED6H9HVH" ], [ 69058, "xor", ":gzK:7:Zze:6." ], [ 69835, "xor", "VHD\\(\\DHVHE" ], [ 70706, "url", "\u0026{fW\u0026f\u0026WfF2cfq2*\u0026qf+\u0026f\u0026+*+\u0026*2F2G\u0026R\u0026Wf,* 2cfq2c\u00268fc2F\u0026Ff{\u00262\u0026O\u0026*\u0026{fW\u0026{\u0026lf,2v*q2G\u00260fW\u0026q\u0026Wfl\u0026*2F2c\u00268\u0026WfF2*f!2Gff2vclfc2F\u0026Wfq\u0026W\u0026l\u0026*\u0026+" ], [ 70919, "xor", "6HEDEHD\\B\\" ], [ 71303, "xor", "D:767:6.0." ], [ 73154, "xor", ":zzK:m:K6e:6.Z." ], [ 74664, "xor", ":e67:K:e:6:mzK:m:KzZ.jzg.j:6zK" ], [ 74821, "xor", "9HEH9D9HD9N\\" ], [ 74946, "xor", ":gzK:m:Kze:6.Z." ], [ 76299, "xor", "VHD\\D\\HH4HE" ], [ 76866, "xor", ":mzK:m:K6e:6.Z." ], [ 76930, "xor", ":mzK:m:K6e:6.Z." ], [ 76994, "xor", ":mzK:m:K6e:6.Z." ], [ 77058, "xor", ":mzK:m:Kze:6.0." ], [ 77414, "xor", "9(HEDEH9HVH6H" ], [ 77542, "xor", "\\(H9DEH\\H9HD" ], [ 77895, "xor", "7:K6e:6.Z." ], [ 78023, "xor", "7:K6e:D.0." ], [ 78566, "xor", ".Z:e67:7:e:6:7zK:7:KzZ." ], [ 79298, "xor", ":mz7:6:K6e:6.Z." ], [ 79431, "xor", "7:K6e:D.Z." ], [ 79683, "xor", "mz7:7:K6e:6.Z." ], [ 80578, "xor", ":mzK:m:Kze:z." ], [ 80706, "xor", ":mz7:g:K6e:6.Z." ], [ 80962, "xor", ":zzK:m:K6e:6.Z." ], [ 82373, "xor", "EHEHED\\HD9(\\" ], [ 84877, "xor", "4H:\\O\\OH4H4" ], [ 84941, "xor", "4H:\\O\\OH4H4" ], [ 85005, "xor", "4H:\\O\\OH4H4" ], [ 85069, "xor", "4H:\\O\\OH4H4" ], [ 85133, "xor", "4H:\\O\\OH4H4" ], [ 85197, "xor", "4H:\\O\\OH4H4" ], [ 85261, "xor", "4H:\\O\\OH4H4" ], [ 85325, "xor", "4H:\\O\\OH4H4" ], [ 85389, "xor", "4H:\\O\\OH4H4" ], [ 85453, "xor", "4H:\\O\\OH4H4" ], [ 85517, "xor", "4H:\\O\\OH4H4" ], [ 85581, "xor", "4H:\\O\\OH4H4" ], [ 85645, "xor", "4H:\\O\\OH4H4" ], [ 85709, "xor", "4H:\\O\\OH4H4" ], [ 85773, "xor", "4H:\\O\\OH4H4" ], [ 85837, "xor", "4H:\\O\\OH4H4" ], [ 85901, "xor", "4H:\\O\\OH4H4" ], [ 85965, "xor", "4H:\\O\\OH4H4" ], [ 86029, "xor", "4H:\\O\\OH4H4" ], [ 86093, "xor", "4H:\\O\\OH4H4" ], [ 86157, "xor", "4H:\\O\\OH4H4" ], [ 86221, "xor", "4H:\\O\\OH4H4" ], [ 86285, "xor", "4H:\\O\\OH4H4" ], [ 86349, "xor", "4H:\\O\\OH4H4" ], [ 86413, "xor", "4H:\\O\\OH4H4" ], [ 86477, "xor", "4H:\\O\\OH4H4" ], [ 86541, "xor", "4H:\\O\\OH4H4" ], [ 86605, "xor", "4H:\\O\\OH4H4" ], [ 86669, "xor", "4H:\\O\\OH4H4" ], [ 86733, "xor", "4H:\\O\\OH4H4" ], [ 86797, "xor", "4H:\\O\\OH4H4" ], [ 86925, "xor", "4H:\\O\\OH4H4" ], [ 86989, "xor", "4H:\\O\\OH4H4" ], [ 87053, "xor", "4H:\\O\\OH4H4" ], [ 87117, "xor", "4H:\\O\\OH4H4" ], [ 87181, "xor", "4H:\\O\\OH4H4" ], [ 87245, "xor", "4H:\\O\\OH4H4" ], [ 88058, "u8", "c2fvWcf" ], [ 88205, "xor", "(H6\\)\\HHEH" ], [ 88378, "u8", "\u0026yfG2*f{2 \u0026+*W\u0026f\u00262fFcX2vW\u0026\u0026+cWfv2%fG2!f+Wv\u0026+fv2vclf" ], [ 88751, "xor", "p:e:m:zze:7" ], [ 88781, "xor", "(HE\\)\\DHEHE" ], [ 88954, "u8", "\u0026yfG2*f{2 \u0026+*W\u0026f\u00262fFcX2vW\u0026\u0026+cWfv2%fG2!f+2,\u0026F*\u00262v\u0026yf" ], [ 89082, "u8", "clfvWvf" ], [ 89199, "xor", "p:e:m:zze:7" ], [ 89229, "xor", "(HE\\)\\DHEHE" ], [ 89293, "xor", "4H:\\O\\OH4H4" ], [ 89485, "xor", "(H:\\O9HHEH4" ], [ 89518, "u8", "\u0026Z\u0026Z\u0026f\u0026{fZ\u0026T\u00262fG2!fT2F\u0026*fZ\u0026T\u00268fZ\u0026T2!2%\u0026Z\u0026Zf!2%f\u00262!fT2!\u0026Zf!2!\u0026Zff\u0026Z\u0026ZcX\u0026+fZ\u0026T\u0026Zf\u00262!fTW*\u0026+fZ\u0026T\u0026Zf2\u0026T2!W*\u0026y\u0026Zf!2Ff\u00262!fT2!\u0026Zf!2!clf" ], [ 89549, "xor", "4H:\\O\\KH4H4" ], [ 89677, "xor", "(H:\\O\\DHEH4" ], [ 89805, "xor", "EH:\\O\\KHEH4" ], [ 89869, "xor", "EH:\\O\\(HEH4" ], [ 89997, "xor", "(H:\\O\\DHEH4" ], [ 90061, "xor", "EH:\\O\\OH4H4" ], [ 90253, "xor", "4H:\\O\\HH(H4" ], [ 90317, "xor", "EH:\\O\\NH(H4" ], [ 90381, "xor", "4H:\\O\\(H4H4" ], [ 90573, "xor", "EH:\\O\\BHEH4" ], [ 90630, "u8", "fZ\u0026T\u00268f+\u0026T2!2G\u0026+\u0026Zf!2*fv2!fTW\u0026\u0026Wf!2!\u00268fT\u0026Z\u0026Z\u0026+\u0026qfZ\u0026T\u0026Rfc2!fT2!\u0026TfZ\u0026T\u0026ZfZ\u0026T2!2*\u0026+\u0026Zf!2%fG2!fT2*\u0026+f!2!clf+\u0026Z\u0026Zc*\u0026" ], [ 90637, "xor", "EH:\\O\\)HEH4" ], [ 90701, "xor", "4H:\\O\\DHEH4" ], [ 90758, "u8", "fZ\u0026TcWf+\u0026T2!2*\u0026+\u0026Zf!2%fv2!fT2!\u0026Zf!2!\u0026lf" ], [ 90765, "xor", "EH:\\O\\DHEH4" ], [ 90829, "xor", "EH:\\O\\(HEH4" ], [ 90893, "xor", "4H:\\O9NH4H4" ], [ 91085, "xor", "4H:\\O\\KH4H4" ], [ 91142, "u8", "fZ\u0026TcWf+\u0026T2!2*\u0026+\u0026Zf!2%fv2!fT2!\u0026Zf!2!\u0026ZfT\u0026Z\u0026ZcX\u0026" ], [ 91149, "xor", "EH:\\O\\DHEH4" ], [ 91277, "xor", "EH:\\O9HHEH4" ], [ 91341, "xor", "4H:\\O\\OH4H4" ], [ 91405, "xor", "EH:\\O\\(HEH4" ], [ 91470, "xor", "H:\\O\\OH4H4" ], [ 91526, "u8", "fZ\u0026TcWf+\u0026T2!Wc\u0026+\u0026Zf!Wvfv2!fT2\u0026\u0026Wf!2!\u00268fT\u0026Z\u0026Z\u0026q\u0026TfZ\u0026Tc8fF2!fT2!\u0026TfZ\u0026T\u0026Zf2\u0026T2!2 \u0026+\u0026Zf!2cf\u00262!fT2!\u00262f!2!\u0026Zff\u0026Z\u0026Z\u0026T\u0026ffZ\u0026T\u0026Zf\u00262!fT2!\u0026f" ], [ 91661, "xor", "4H:\\O\\OH4H" ], [ 91725, "xor", "EH:\\O9HHEH4" ], [ 91853, "xor", "4H:\\O9DHEH4" ], [ 91917, "xor", "EH:\\O\\(HEH4" ], [ 92045, "xor", "9H:\\O\\NH(H4" ], [ 92109, "xor", "4H:\\O\\OH4H4" ], [ 92173, "xor", "4H:\\O\\OH4H4" ], [ 92237, "xor", "4H:\\O\\OH4H4" ], [ 92290, "u8", "WvcXfW\u0026TcW*y\u0026T2!2!\u0026Z\u0026Zf!2!f!2!fTWv\u0026Wf!2!\u0026+f*\u0026Z\u0026ZcX\u0026*fZ\u0026T\u0026Ofc2!fTWv\u0026XfZ\u0026TclfW\u0026T2!Wv\u0026W\u0026Zf!2,fc2!fT2\u0026\u0026lf!2!\u0026yfX\u0026Z\u0026Z\u0026X\u0026*fZ\u0026T\u0026+f*2!fT" ], [ 92302, "xor", "H:\\O\\OH4H4" ], [ 92557, "xor", "4H:\\O\\(H4H4" ], [ 92621, "xor", "4H:\\K\\OH4H4" ] ], "v": { "file.stem": "a4c420a51a30d6c67e55bc6d3d6692caf2ec6bb289d32fee0dd9287a38022994", "file.basename": "a4c420a51a30d6c67e55bc6d3d6692caf2ec6bb289d32fee0dd9287a38022994.vbe" }, "id": "vbs" }, "id": 0, "sz": 1440183, "ts": [ { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1440183.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ ":S7HoF=fZ-.56b9-0em=b", "0g,.9-0$37.8f07=o'jSg0'05", "'o,6ko97/6fF", "b6-03,e:sj.z", "D_)9)AD44O!JO4/4V6EK44E", "H=S,obz3-7z058F", "Z/8ZboF9H6-3k=8=S%6.", "D:E)6/4WV(", "%3'Z5=F-.pZ8/7:z55N.z6e,.", "(K/KU_4/4A", "H)(EDGJ4/6B(", ")N(HO!N9D4/4A\\4", "))EB)DG6/4", "eZ-HZ.9.D6.967-5", "V5V0F:Fhpd~:t%gl]h:t]sqdhhb_d7EV5V0V5V0h:FV5V0F:F:k_0UcFmFSBL77LB7L77LBB7L7L7B7BBL7B7LB7L7BBL77BBL7B...", "4/6/VGK9KA:\\" ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "56cb1", "90a0b", "abe65", "b0478", "5ab22", "64980", "a4eb2", "5974c", "76d7c", "ab21a", "95ff7", "542d7", "a2421", "7ae25", "4baad", "9f4fe" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1440183.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "c": 0.9200000166893005, "d": "Security advisory source identifiers", "e": [ "Osv" ], "i": "micro-behaviors/data/text/security/threat-intel::advisory-source-identifiers", "l": 1 }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 1440183.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "fWs1vy*Zl,9+zc!fX8,0Z~+ZvfW*F\u0026bz*;Xszb*f \u003curl\u003e", "\u0026{fW\u0026f\u0026WfF2cfq2*\u0026qf+\u0026f\u0026+*+\u0026*2F2G\u0026R\u0026Wf,* \u003curl\u003e", "f8\u0026T\u0026Zf!2!fT2!\u0026TfZ\u0026+\u0026y*2\u0026{2!2!\u0026W\u0026Zf\u00262!* \u003curl\u003e", "\u0026yfc2Ff*Wc\u0026*fF\u0026*\u00268fF\u0026*2c2F\u0026F\u0026Ffv2\u0026fc2FfX \u003curl\u003e", "2c2 \u0026l\u00268fv2Ffc2FfX2F\u0026Wf,\u00268f{\u0026F\u0026W\u0026+\u0026Xf8\u0026X \u003curl\u003e", "lv*29AFAZy*qb~\u0026+**G)T+s* AW3FGf/{FG*c89~ \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:1202877", "offset:70706", "offset:282812", "offset:181758", "offset:180436", "offset:461097" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "%Ffs=$0--p\u003c]D6[]5z'D../k=]jj]Zb,F'~/zN:D \u003cxor\u003e", "NF6SFS8FSZ7:k\u003cm,'F]p8j[j\u003c[zm~7..o%66zNFc \u003cxor\u003e", "p[].~FHjk[m~7jzsF]]$%97~~b,-\u003cZ:f]8.gHbZD \u003cxor\u003e", "7.%F88kZ8Z[H\u003cK]m%eF[z/p:c=b5f~g'=b[0'.pD \u003cxor\u003e", "%cb9D.f,]f.3zSjo3%f6/oK/b[Hk[S[0b[pm6e0c \u003cxor\u003e", ".s7ZFz6[%f9-']ZF=F[.%0b\u003c3jZZD67F~7%9b0jF \u003cxor\u003e", "%Dbo\u003cg%f0H9e,7j-S.[9\u003c'jbH['6g.7os3S[oes \u003cxor\u003e", "$o,5N.ZKcZe96b/z=e:$:-F55.oz9Kzje \u003cxor\u003e", "zF86Zf.b9,]5,K\u003cD0.8][],%70j8-k[,zpz$\u003c-$F \u003cxor\u003e", "S[sz$j56e\u003c[]8jFF0b8H=b~K]cj75'z5\u003cp89$ZH8 \u003cxor\u003e", "gZpo,ze0zem:K\u003cF7-cF$oS.D\u003cs5F=s6Fz0e6H-Z[ \u003cxor\u003e", "]\u003c.kg7~.9'[/:g-Zz86Sz~K0cz'\u003c]g%f0s9$3N=g \u003cxor\u003e", "V5V0F:Fhpd~:t%gl]h:t]sqdhhb_d7EV5V0V5V0h \u003cxor\u003e", "6fDs9FZ[Z%6D-ezzj[cjF9z,[[]m,Sj-zp-b[gN0 \u003cxor\u003e", ",fZ'[]7Fp%6F~HF.=,H'09b/~N9=[s%FFjF[5 \u003cxor\u003e", "80.s\u003ck[,/K0F-D[9s.S3KzgboF9~]o$cZkog~NZg \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3, "el": [ "offset:913280", "offset:625561", "offset:347097", "offset:327032", "offset:1174012", "offset:1138699", "offset:722375", "offset:881509", "offset:619761", "offset:1341665", "offset:813667", "offset:1360687", "offset:309933", "offset:370929", "offset:1178966", "offset:475904" ] } ], "sha": "a4c420a51a30d6c67e55bc6d3d6692caf2ec6bb289d32fee0dd9287a38022994", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-07/a4c420a51a30d6c67e55bc6d3d6692caf2ec6bb289d32fee0dd9287a38022994.vbe", "type": "vbs" } ], "tv": "ed903" } }