{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.9380215, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T18:21:24Z" }, "path": "aa1d89d765677c3e77dd3f770e4764ab7df654f453e661562fcf379d715d5c52.vbe", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 35, "ff": { "m": { "file": { "size": 504863.0, "entropy": 4.48, "size_bytes": 504863.0 }, "text": { "tab_count": 79.0, "digit_ratio": 0.21, "space_count": 8433.0, "total_lines": 1.0, "char_entropy": 4.48, "unique_chars": 100.0, "escape_density": 0.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 504863.0, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 504863.0, "non_ascii_ratio": 0.0, "null_byte_count": 1.0, "last_line_length": 504863.0, "long_token_count": 1267.0, "whitespace_ratio": 0.02, "most_common_ratio": 0.14, "octal_escape_count": 14.0, "non_printable_ratio": 0.02, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 38.0 } }, "s": [ [ 50, "u8", "O~qopnj~'~/M+CY" ], [ 729, "u8", "/v8GOc3vq" ], [ 942, "u8", "\u0026O\u0026+cf\u0026{fZ\u0026X\u00262f W*f{2 \u0026+fW\u0026+\u0026Rfy\u002602vWc\u0026+\u0026lfv2%f\u0026WFffWF\u0026l*c2vcWf" ], [ 1146, "u8", "clfvWvf" ], [ 1226, "u8", "c+f+cq2 Wc\u0026y\u0026Zf*Wcfv2%f{2c\u0026+fG2vclf" ], [ 1850, "u8", "clfv2,fX2G\u0026+*W\u0026+\u0026Zf+cf2vW\u0026\u0026+\u0026lfv2%fG2\u0026f{2 \u0026+f*2G\u0026Ff" ], [ 2661, "u8", "2\u0026fv2*2*f2\u0026y\u0026\u00262!2f\u0026W\u0026f\u0026l\u0026ffF\u0026\u002620\u00262\u0026G2ff!2\u00262vfcff2\u0026fv2f\u0026O\u0026ff+\u0026\u0026ff2\u0026fv2f2,f2\u0026F\u0026\u00262c2f\u0026Z\u0026*\u00268\u0026ffW\u0026\u00262*\u00262\u0026v2ff,2\u00262vfcf*2\u0026f 2f\u0026Z\u0026ffF\u0026\u0026ff" ], [ 4197, "u8", "2\u0026f 2f2!f2\u0026l\u0026\u00262G2f\u0026+\u0026f\u0026R\u0026ff+\u0026\u002621\u00262\u0026v2*f\u00262\u00262vf\u0026fX2\u0026f 2f\u0026Z\u0026ff+\u0026cf*2\u0026f 2f2!f2\u00262\u0026c2\u00262f\u0026y\u0026f\u0026Z\u0026ff2\u0026\u00262q\u00262\u0026\u00262ff!2\u00262\u0026f\u0026fT2\u0026f\u00262f\u0026Z\u0026ff2\u0026\u0026fT" ], [ 5653, "u8", "2\u0026fG2f\u0026W\u0026ffF\u0026\u0026f{2\u0026fv2f2Ff2\u0026F\u0026\u00262 2f\u0026+\u0026f\u0026l\u0026ffl\u0026c2f\u00262\u0026G2*f\u00262\u00262Gf\u0026fT2\u0026fv2f\u00268\u0026ffF\u0026\u0026f*2\u0026fv2f2%f2\u0026F\u0026c2\u00262f\u0026l\u0026*\u00262\u0026ffy\u0026\u00262+\u00262\u0026 2ff!2\u00262 f\u0026f" ], [ 6869, "u8", "2\u0026fG2f\u0026W\u0026ffy\u0026\u0026fT2\u0026fG2f2!f2\u0026y\u0026\u00262!2f\u0026W\u0026f\u0026O\u0026ffF\u0026\u00262f\u00262\u0026 2ff!2\u00262cfcfX2\u0026fv2*\u0026+\u0026ffF\u0026\u0026f*2\u0026fv2f2%f2\u0026+\u0026\u00262,2f\u0026+\u0026*\u0026l\u0026ff+\u0026\u00262{\u00262\u0026 2ff!2\u00262*f\u0026f*" ], [ 7381, "url", "2\u0026fv2f\u00262\u0026ff+\u0026\u0026fX2\u0026fG2f2\u0026f2\u0026F\u0026\u00262\u00262f\u0026W\u0026f\u0026O\u0026ff+\u0026\u00262*\u00262\u0026 2ff!2\u00262\u0026fcfq2\u0026f 2f\u0026Z\u0026ffy\u0026cfX2\u0026f*2f2\u0026f2\u0026+\u0026\u00262*2f\u0026+\u0026*\u0026l\u0026ff+\u0026\u00262*\u00262\u0026c2*f 2\u00262vf\u0026fX" ], [ 11669, "u8", "2\u0026fv2f\u0026+\u0026ffy\u0026\u0026f02\u0026f 2f2 f2\u0026l\u0026\u00262G2f\u0026+\u0026f\u0026O\u0026ff+\u0026c2X\u00262\u0026\u00262ff\u00262\u00262\u0026f\u0026f+2\u0026f*2*\u0026+\u0026ffl\u0026\u0026fT2\u0026fG2f2 f2\u0026+\u0026c2v2f\u0026+\u0026f\u00262\u0026ff+\u0026\u00262X\u00262\u0026G2ff\u00262\u00262Gf\u0026ff" ], [ 14099, "u8", "\u0026W\u0026Xf2\u0026vff2%f\u00262" ], [ 14516, "u8", "#pvr*@#@\u0026,P,PP,P,rP{PrP3Pq@#@\u0026PP,~SKWw@#@\u0026~P,P@#@\u0026~P~~tr$Kxc#@#@\u00263U9P?;8@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026nMk\\mY" ], [ 14749, "u8", "cZ# hlDtP{PVK1\\Zc#@#@\u00263U9P?!8@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026@#@\u0026K.b\\CY" ], [ 15214, "u8", "`F*@#@\u0026,PP,~~P,RUYCDO$KEUNm.X,'~ihf" ], [ 22451, "u8", "Av1WcF\u0026GlGy{cFs+Z2!+Tyb!GT22,GW{1vyGlGfvX" ], [ 22749, "u8", "yGfvO" ], [ 23027, "u8", "ZGTFFW,GGcy+f2*" ], [ 23328, "u8", "cWX*l +92Gv3" ], [ 23443, "u8", "T!OvZ!fGTTyGT!l" ], [ 23815, "u8", "TZfvZTF+!!A" ], [ 23847, "u8", "TZFvTTAvT!O" ], [ 23911, "u8", "TZ GTT8vT!G" ], [ 24019, "u8", "T!FvZ!1vTTyGT!O{!Z!{TZsvTT2cT!ZTZ!*F!Z%vZ!F" ], [ 24083, "u8", "T!2cZ!/vTT8vT!F" ], [ 24391, "u8", "TZ*GZTs+!!;" ], [ 24455, "u8", "TZccZT*+!!;" ], [ 26077, "u8", "2vfGG" ], [ 27143, "u8", "qR FG" ], [ 31213, "u8", "lvf*Z{Ov/+\u0026Wf!Z!8T 8!T!Z XolGvw" ], [ 31277, "u8", "AvXvl" ], [ 31443, "u8", "/vFvAv1vfX2G{vA" ], [ 31527, "u8", "XFcGfX;vqvl{2G1+vl2 WG+" ], [ 31623, "u8", "XF cl" ], [ 31943, "u8", "o+ GZX,FfcA+1GGcyFo*oXlvfvA" ], [ 32397, "u8", "FvcZ+**lcAc3 +qlv9v8" ], [ 32563, "u8", "lvq2F+c\u0026R\u0026yfc2f+ 2Ff" ], [ 32787, "u8", "ovOvWGTGX" ], [ 34652, "u8", "T2!1 yqvZ\u0026T02 F" ], [ 35495, "u8", "TZvcTTZ T!8" ], [ 35559, "u8", "TZ GTTlvT!W" ], [ 35683, "u8", "!ZG{TZsvTTWvT!W{Z!XF!Z%vZ!2X!ZsX!Z\u0026XTZ\u0026*ZT2W,FZTT!Z Z!)!TTG!T!Gf!ZffTZf\u0026TTG\u0026T!GfZ!92!Zf\u0026Z!Gf!Zff!ZffTZf\u0026ZTf2!!GfT!G\u0026Z!9\u0026TTG\u0026T!Gf" ], [ 35911, "u8", "TZcGZTF+!!2" ], [ 36007, "u8", "TZ GTTWcT!l" ], [ 36359, "u8", "TZZvZTZ+!!O" ], [ 36519, "u8", "TZ vTTyGT!l" ], [ 36563, "u8", "T!wvZ!1vTTWGT!8" ], [ 37075, "u8", "T!8vZ!*G$TZ!T!l*!Z*XTZF*TTOcT!A*Z!XlfZ!!Z!R+\u0026ZFT!ZffTZA ZTs2!!w+T!A\u0026Z!/\u0026TT; T!zf!ZAfTZG TT;GT!;XZ!9F!Zf*Z!~{!ZAX!Z,+TZ% ZTby!!++" ], [ 39341, "u8", "Z!/vZTZGTZ!F!!8cZTbZ!TfZG" ], [ 41427, "u8", "T!Z!Z T!)TZ!9!ZTf2!T92!!9fZ!9\u0026ZTG\u0026TZf2!!G\u0026ZTf2!Tf2!T92!!Gf!Zf\u0026ZT9\u0026Z!G\u0026T!9fZ!9\u0026ZTf2!T92!!9fZ!9\u0026ZTG\u0026TZf2!!G\u0026ZTf2!Tf2!T)Z!!GT!Z%vZT" ], [ 43373, "u8", "Z!TGZTZGTZFW!!z!ZTfZf" ], [ 48365, "u8", "Z!3vZT8vTZ\u0026W!!Z ZT*+!Tf+!To+!!y{!Z%vZTfcZ!Z T!)fZ!3vZTs+!T1+!!*{Z!qvZT2vTZ,+!!;vZT!F!T!F!TqW!!zT!Zf!l{T!Z!8vT!*{Z!qvZTcW!TTy!!3" ], [ 49261, "u8", "Z!/vZTZGTZ!F!!8cZTbZ!TfZA" ], [ 49373, "u8", "Z!{GZT*+!T1+!!" ], [ 50131, "u8", "T!8vZ!/vTTycT!Z+!ZbfTZ2vTTwvT!O" ], [ 51091, "u8", "T!GvZ!ovTTyGT!R" ], [ 52039, "u8", "TZ*GZTZ+!!8" ], [ 52163, "u8", "fZ!TTZFvZTcF!!8" ], [ 52179, "u8", "T!WcZ!T TTAvT!O" ], [ 52627, "u8", "T!8vZ!9vTTRGT!w" ], [ 53139, "u8", "T!lGZ!ovTT2vT!2" ], [ 53267, "u8", "T!A Z!/vTTOvT!8" ], [ 53363, "u8", "Z!X+!Z%vZ!2X!ZZX!Zs" ], [ 53383, "u8", "TZcGZTZ+!!O" ], [ 53607, "u8", "TZ%vTTWGT!w" ], [ 54887, "u8", "TZ GTT2vT!O" ], [ 54919, "u8", "TZGGZTcF!!+" ], [ 55315, "u8", "T!FGZ!fGTT2GT!8" ], [ 56788, "u8", "vZ!Z T!1+Z!9cZT\u0026W!T{W!!oXZ!XcZTWcTZsW!!GcZTsl!T2W!T1W!!8*!Z%cZTfcZ!w*T!*XZ!T*ZT,l!T+l!!f*Z!+cZTA TZcF!!ZGZT,F!T F!TfW!!y*!Z! ZT/" ], [ 58413, "u8", "Z!3vZTOvTZ2+!!OvZTF+!T%+!TfWsFZT!Z%vZT*GZ!FvT!3" ], [ 60013, "u8", "Z!+GZTw TZsy!!z\u0026ZT\u0026F!T!F!T*F!!W{!Z%v8*T!Z!Z T!)fZ!fGZT\u0026F!TX+!!+{Z!*vZTWvTZFW!!Z ZT!l!T,W!TTy!!W{!Z2vZTXvZ!yGT!+{Z!XGZT\u0026W,+TZ!!3f" ], [ 60237, "u8", "!Z%vZTo Z!;\u0026T!3fZ!XvZTZ+!T*F!!1" ], [ 60493, "u8", "!Z%vZTfvZ!w T!o+Z!)\u0026ZT!F!T*F!!*{Z!0vlfZ!TZ,y!!~\u0026ZT*2!T!2!T{2!!2f!Z2 ZTT\u0026Z!A T!qfZ!+*ZTZW!TfW!!T+Z!**ZTlcTZ2W!!A ZT!y!TA2!T+2!!A+" ], [ 61127, "u8", "TZ*GZT\u0026+!!w" ], [ 61210, "u8", "vTTZ T!zf!Z2" ], [ 66023, "u8", "qWcGX" ], [ 66259, "u8", "qG2GZ!1G+{WG3vl" ], [ 66381, "u8", "cF!Gw*TGZ!OGTGo" ], [ 66525, "u8", "WG3vl" ], [ 66663, "u8", "1W%vTTOGXv~*WG+F,+v*FGZT,F*" ], [ 66701, "u8", "s+ GZXT!OGlv$cf{Av1v8" ], [ 66791, "u8", "$W%v*{Ov{*W{ZG1F F\u0026vlvW*!Z,{*+A*0+!GZT,F*v~*+vlG2*3vX" ], [ 67149, "u8", "%WcGR{XvAc;v/vq" ], [ 67283, "u8", "+GyGlGfcoXWGXvF" ], [ 67315, "u8", "AvXFs+ GFvl" ], [ 67331, "u8", "vWc{X+GcZTGFsvA*o*WGlv{vTTFGXvO" ], [ 67469, "u8", "cl Gl" ], [ 67533, "u8", "!ZcGR{XvW*;v/vq*Wvqvl" ], [ 67725, "u8", "ZWcvy{qvwvyv1GX" ], [ 67789, "u8", "cW!!W{fGwvRc1G+*2G/v8" ], [ 68301, "u8", "FW2vw" ], [ 68307, "u8", "1vWG8vfv1" ], [ 68365, "u8", "GW!!W{3vlGwvfcoXWGXvF" ], [ 68396, "u8", "{lcTGlXOGX+AW!!WGA" ], [ 68487, "u8", "TlcGl" ], [ 68691, "u8", "/v2cZG*G9" ], [ 68941, "u8", "vlcvy{qvwvyvTG1" ], [ 69479, "u8", "XF\u0026*TTWGqvG" ], [ 69597, "u8", "2GT!2{cF\u0026{o+%c*" ], [ 69661, "u8", "lGfvw" ], [ 69741, "u8", "Rv**ZT2GfF\u0026F%vWG8" ], [ 69907, "u8", "TGwcZ!fGf{8v/v2*2+s" ], [ 69971, "u8", "+GlvZGocTT2G+Gw" ], [ 70087, "u8", "TlccO*vlsc2*T!2GyGXv*" ], [ 70131, "u8", "RvfWslcGlvF" ], [ 70637, "u8", "WvXvy{2colcF*v2GZT\u0026FZ" ], [ 70707, "u8", "W*olcF*vFvZT\u0026FG" ], [ 71069, "u8", "yGXG2" ], [ 71389, "u8", "FvXGy" ], [ 71437, "u8", "l2 2{Xv2vOv" ], [ 71463, "u8", "/+\u0026cTT2GXv2" ], [ 71527, "u8", "f+ GX{wvfGl" ], [ 71565, "u8", "vF Gl" ], [ 71581, "u8", "OvfG8" ], [ 71645, "u8", "OvTGG" ], [ 71859, "u8", "ZGTFFW2 2vO" ], [ 72029, "u8", "lGfGO" ], [ 72067, "u8", "GF\u0026{fFFvZXA+svw" ], [ 72115, "u8", "8v1+cW2 Gvl" ], [ 72141, "u8", "cFFvW*T!yGWGf*3" ], [ 72285, "u8", "yGXvG" ], [ 72295, "u8", "XWcGX" ], [ 72477, "u8", "Avov2" ], [ 72499, "u8", "yGX+\u0026lcGZGO" ], [ 72579, "u8", "*+ XolcG2{s+%cZT+GlvWGXGT{Gvov2*,Ff*TZ GX" ], [ 72711, "u8", "Tl2vw" ], [ 72755, "u8", "FcTZ F*v2GlXcF2" ], [ 72915, "u8", "0cWGAvXv" ], [ 73043, "u8", "qv2GOv*coXyG{vG" ], [ 73236, "u8", "GyGlvf*TTyGXvF" ], [ 73309, "u8", "AvXcZT F*" ], [ 73581, "u8", "yvoc2{Gv+Fs+vcOGG*slf" ], [ 73613, "u8", "vFsvy{T*WG2vXv)" ], [ 73741, "u8", "sW Gl" ], [ 73747, "u8", "fGl*w*9vTTyGXvW" ], [ 74157, "u8", "WGqvW*zGfF!Z G8vR" ], [ 74394, "u8", "cTTwv" ], [ 74477, "u8", "wvfcZTwv*lslcGlvF" ], [ 74675, "u8", "RGXW F*vAvA" ], [ 74701, "u8", "s+,vW{TGlv2v0GX*AvovO" ], [ 74771, "u8", "ovOvWGqvf" ], [ 74823, "u8", "1+%vZ{F+ GF" ], [ 74835, "u8", "ovWGZG1G+{2cT!A" ], [ 75123, "u8", "wvfW F*vWv8" ], [ 75341, "u8", "cFFvz{1v;v8v+vo" ], [ 75549, "u8", "Ov/vZ{!FF*1FfcTTAvovO" ], [ 75603, "u8", "fGyGlv" ], [ 75610, "u8", "GoXWGXv2{!Z2" ], [ 76179, "u8", "qc2vOv+G*{lv9vG" ], [ 76269, "u8", "lv9cR" ], [ 76295, "u8", "X+ GW{\u0026l,Gy{ovGvlv9cTTGvqvl" ], [ 76323, "u8", "Fc{flcGf{lvXG8{lv+lcF*vFcZTf+F" ], [ 76403, "u8", "yGXFslcGlv2{!ZZ" ], [ 76467, "u8", "wv+FcF2vwv2*!ZZ" ], [ 76819, "u8", "fcA GvXv*{2G1G2X!ZZ" ], [ 76957, "u8", "RvfGy{F+f*TZZvq" ], [ 77021, "u8", "wvovR" ], [ 77043, "u8", "Ac/+Z+Fv2cZTA+s" ], [ 77075, "u8", "ovRcAvX*TT~vfvw" ], [ 77095, "u8", "XlZvq" ], [ 77351, "u8", "/+Fvf*AvovO" ], [ 77459, "u8", "/v8v2cXv*{8v{vl" ], [ 77555, "u8", "AvX+ZW%G8vG*GFc" ], [ 77597, "u8", "2co*W{*+\u0026{TZ%v*{Fv3vl" ], [ 77703, "u8", "TZ%vW{F+!*y{XvWv;vov" ], [ 77735, "u8", "*FFvTXlv/vO" ], [ 77843, "u8", "/cZ!Fv3v1" ], [ 77869, "u8", "Av1vy{WGflcF*vFcZTG+2" ], [ 78253, "u8", "WGfGO{2*TZG+Zv8vZTG+Z" ], [ 78279, "u8", "TZGv8" ], [ 78365, "u8", "wc0Gl" ], [ 78375, "u8", "1WcGf{8v/cZT+voW*+bGOv2X!Z*" ], [ 78407, "u8", "fFs*O{*+AvZTXvzGOvfGoXlv{v8" ], [ 78515, "u8", "WcTZ*+bGOv2XG+F" ], [ 78746, "u8", "**{lv{cZT*+*{/+Fv" ], [ 78764, "u8", "XWGfvl" ], [ 78899, "u8", "8vX+ F%vW*wXf+!T*+*{/+Fv+XslcGl" ], [ 78995, "u8", "Xv2G2GXvf" ], [ 79047, "u8", "TFfvw" ], [ 79187, "u8", "+GOGZGovf*OG/vy" ], [ 79315, "u8", "/vOvZG9vo" ], [ 79367, "u8", "1+ GW{cFFcy{XvWGAv1vo" ], [ 79623, "u8", "1+%cy{*+GvF" ], [ 79955, "u8", "qv2GFGov+{yc+Gw" ], [ 80007, "u8", "fFGGw" ], [ 80013, "u8", "F cy{XvFvFvXG+" ], [ 80173, "u8", "lv{cZTlv*F*F vOvy{cFc{FWc" ], [ 80327, "u8", "+F%vWXFWc*2XT!lvWGXG+" ], [ 80531, "u8", "XGyvlv*cTTlv*G8" ], [ 80685, "u8", "lG9cZTlv*FF+Gvlv;" ], [ 80733, "u8", "WGqv2" ], [ 80947, "u8", "ZGTFFW*v;vw" ], [ 81043, "u8", "fvyGlGovf{lv+GZT*+ {XFcG/" ], [ 81427, "u8", "T!lvZG1G*Xyvov;" ], [ 81443, "u8", "Wb{fF!GTTlvTGw" ], [ 81485, "u8", "cFFvW*T!lvAv1v0" ], [ 81549, "u8", "FG*ZTXvAvwcT!X" ], [ 81565, "u8", "Gv1vWX*+c{q+ccTTlv9vO" ], [ 81677, "u8", "slcGl" ], [ 81709, "u8", "GvqvA" ], [ 81895, "u8", "q+2voXGvXvW{OvTZ*+fv8vA" ], [ 82029, "u8", "GvqvA*ZGTFF+s*WGl" ], [ 82087, "u8", "XFvcoXWGXvF" ], [ 82131, "u8", "/vlcWGXv{*Z!XvG" ], [ 82269, "u8", "wvfGA" ], [ 82311, "u8", "0Wfvw" ], [ 82317, "u8", "Fvcl" ], [ 82387, "u8", "/vlvOv" ], [ 82451, "u8", "/vyv8vfGo" ], [ 82461, "u8", "ZGfGO" ], [ 82599, "u8", "X+ *TTlv/vy" ], [ 82707, "u8", "qvRv2v0GX*lv+G8" ], [ 82893, "u8", "s+fcy{XvRvZG1vf*Z!XvW" ], [ 83091, "u8", "ovAcyvTGTTlvfvA" ], [ 83245, "u8", "8v/vZ{lv+l!ZcvyGw" ], [ 83469, "u8", "FsvF{fG2G8vT*oXWGXv2{!Zc" ], [ 83603, "u8", "+vZGOv/vf*WGXvF*!Zc" ], [ 83629, "u8", "yvTGO" ], [ 83751, "u8", "9WcGX" ], [ 83827, "u8", "ZGTFFW!!WvA" ], [ 83891, "u8", "Wvq+*+%vw*W" ], [ 83924, "u8", "clvGvqv3" ], [ 84237, "u8", "cFFvl" ], [ 84487, "u8", "TZcvl" ], [ 84493, "u8", "F,vZ{0GlcyGXvf{l*fGO" ], [ 84557, "u8", "FsvF{fG2G8vT*X" ], [ 84573, "u8", "Gv1vW{slc{X+\u0026GTTWvXvF" ], [ 84947, "u8", "XvlvZGf*oXwv" ], [ 85075, "u8", "XvlvZGf*oXAvov~" ], [ 85101, "u8", "lvXvZ{2*ol2+FvyGlX!Zc" ], [ 85127, "u8", "TF\u0026*wXf+*GW{1vyvyGovTTWvXvl" ], [ 85183, "u8", "*+!{\u0026lsX9+*GO" ], [ 85235, "u8", "ZGflslZvOv8" ], [ 85331, "u8", "/vWGlGocTTWvXvl" ], [ 85357, "u8", "Av*Gl{ZGfl!Zcvlvl" ], [ 85555, "u8", "Gvo+ F%v2cZTc+*" ], [ 85619, "u8", "wvfW!Zcvlvl" ], [ 85661, "u8", "WGXvG" ], [ 85811, "u8", "lvTF\u0026ls*2clX!Zc" ], [ 86119, "u8", "{W2 f{AvovO" ], [ 86343, "u8", "*W%vW{*FFcy" ], [ 86477, "u8", "cWcv8" ], [ 86483, "u8", "ov;vZGX*TT8v*G8" ], [ 86547, "u8", "qvWG2G3v1*w*o*l" ], [ 87235, "u8", "GF\u0026{fFFvZXslcGl" ], [ 88259, "u8", "\u0026+!TfW,cF*FWfcwX+cwc;c+coX8c**8*cWsX1l*c$*w***ZXO*+l\u0026W cZ!2*GW!T Ws*/W cwXFWc*8**cw*O*Xc$*w***ZX,l XfW cTT8c0Gl*~vo+s+%c2GF{s+c" ], [ 88666, "u8", "cf*lc*cFfG2v*X2G\u00260f8c" ], [ 89267, "u8", "wvfFs+ G2vO" ], [ 89437, "u8", "WGfvl" ], [ 90972, "u8", "TOGT!FXFZ!TT8cZTqAATFATw!0AsZffw!W1ZZf" ], [ 93075, "u8", "T!2s8!3vTTF2q!A" ], [ 93107, "u8", "Z!0zFZ2vZ!W0FZ2" ], [ 93127, "u8", "fZv\u0026ZTA~c Z0f!+\u0026Z!$A*+Zvf!+f!ZA$*y!cfT+\u0026T!~$W Ty\u0026Zv\u0026Z!~$cy!T\u0026ZvfTZAA2+!A\u0026!+fT!~AZ T%fT+\u0026T!~$!y!" ], [ 93319, "u8", "fZv\u0026ZTA~sFZ*f!+\u0026Z!$AoqZ f!+f!ZA$o8!!fT+\u0026T!~$AFTA\u0026Zv\u0026Z!~$28!/\u0026ZvfTZAAAq!z\u0026!+fT!~AAFT%fT+\u0026T!~$28!" ], [ 93658, "u8", "\u0026TT22XFW3GZZXTZAZ+q8%f!+fZ!$~ 8F%F!;X!ZA/ 8F" ] ], "v": { "file.stem": "aa1d89d765677c3e77dd3f770e4764ab7df654f453e661562fcf379d715d5c52", "file.basename": "aa1d89d765677c3e77dd3f770e4764ab7df654f453e661562fcf379d715d5c52.vbe" }, "id": "vbs" }, "id": 0, "sz": 504863, "ts": [ { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 504863.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "2\u0026fv2f\u00262\u0026ff+\u0026\u0026fX2\u0026fG2f2\u0026f2\u0026F\u0026\u00262\u00262f\u0026W\u0026f\u0026O\u0026ff+\u0026\u00262*\u00262\u0026 2ff!2\u00262\u0026fcfq2\u0026f 2f\u0026Z\u0026ffy\u0026cfX2\u0026f*2f2\u0026f2\u0026+\u0026\u00262*2f\u0026+...", "2F\u0026yf!2c\u0026lfT\u0026Z\u00268\u0026T\u0026TfZ\u0026q\u0026Z**2FfT2!\u0026TfZ\u0026T\u0026ZfZ\u0026T2!2!\u0026R\u0026Zf!2!fF2!f02!\u0026Zf!2\u0026\u00268fT\u0026Z\u0026R\u0026+\u0026*fZ\u0026*\u0026yf 2FfT2!\u00260..." ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0x1cd5", "0x6cff9" ] }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 504863.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 504863.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "2G2v\u00262\u0026WfF2cf*2cf{2c\u00268f*2G\u0026Wf+\u0026l\u00268\u0026*\u0026qfW \u003curl\u003e", "\u0026ffW\u0026q\u00262f,f{2c\u0026qfF\u0026{\u0026Wfy\u0026X2F2v\u0026y\u0026WfF2\u0026f, \u003curl\u003e", "2F\u0026yf!2c\u0026lfT\u0026Z\u00268\u0026T\u0026TfZ\u0026q\u0026Z**2FfT2!\u0026TfZ\u0026T \u003curl\u003e", "\u0026W\u0026R\u0026*\u00260fW\u0026T\u0026Z**2c*f2ccffW\u0026T\u0026Z*l\u0026*W 2c\u0026R \u003curl\u003e", "2G2c\u00268\u0026WfF2cf*2cf+2c\u00268f*2 \u0026Wfq\u0026+\u0026F\u0026*\u0026qfW \u003curl\u003e", "2\u0026fv2f\u00262\u0026ff+\u0026\u0026fX2\u0026fG2f2\u0026f2\u0026F\u0026\u00262\u00262f\u0026W\u0026f\u0026O \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:217183", "offset:232899", "offset:446457", "offset:468485", "offset:253215", "offset:7381" ] } ], "sha": "aa1d89d765677c3e77dd3f770e4764ab7df654f453e661562fcf379d715d5c52", "path": "aa1d89d765677c3e77dd3f770e4764ab7df654f453e661562fcf379d715d5c52.vbe", "type": "vbs" } ], "tv": "176d6" } }