{
  "llm": {
    "conf": 0.99999785,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "review": false,
    "outcome": "hostile",
    "interpretation": "Obfuscated VBS runner with hidden execution"
  },
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": 0,
    "conf": 100,
    "mods": [
      {
        "cls": 2,
        "raw": 0.9999969,
        "rte": "az",
        "prob": 0.9999969
      }
    ],
    "prob": 0.9999969,
    "files": [
      {
        "id": 0,
        "lvl": 0,
        "conf": 100,
        "prob": 0.9999969005584717,
        "type": "rar"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.9999969005584717,
        "type": "vbs"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-04T06:56:18Z"
  },
  "path": "b76d5451dd01a49fcbfb64219dfe592d392783ddb4efeb1b2a5f5dcc36ef5d30.rar",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O₂(AsC₂)Md",
        "sha": "b76d5451dd01a49fcbfb64219dfe592d392783ddb4efeb1b2a5f5dcc36ef5d30",
        "path": "b76d5451dd01a49fcbfb64219dfe592d392783ddb4efeb1b2a5f5dcc36ef5d30.rar",
        "risk": 73,
        "size": 181504,
        "type": "rar",
        "facts": {
          "metrics": {
            "file": {
              "size": 181504.0,
              "entropy": 8.0,
              "size_bytes": 181504.0
            },
            "binary": {
              "overall_entropy": 8.0,
              "peak_region_bytes": 181248.0,
              "peak_region_entropy": 7.83
            }
          }
        },
        "traits": [
          {
            "id": "objectives/command-and-control/dropper/execution/wsh::wsh-obfuscated-runner-bloat",
            "atk": "T1027",
            "conf": 0.8799999952316284,
            "crit": 4,
            "desc": "WSH obfuscated runner bloat",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/execution/interpreter/script/wsh::wscript-scriptfullname",
            "crit": 3,
            "desc": "WScript.ScriptFullName",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "atk": "T1105",
            "conf": 0.9200000166893005,
            "crit": 4,
            "desc": "WSH runs hidden window",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/profile/language::lang-hindi-marathi",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Devanagari script detection (Hindi/Marathi)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/reverse-shell/dup::vbs-wscript-shell-run",
            "atk": "T1059.001",
            "mbc": "B0030.002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "VBScript WScript.Shell.Run launch",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/profile/language::lang-japanese",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Japanese script detection (Hiragana/Katakana)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/profile/language::lang-arabic-urdu",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Arabic script detection (Arabic/Urdu)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/profile/language::script-han",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "CJK Han ideograph sequence",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "conf": 0.8500000238418579,
            "crit": 4,
            "desc": "PowerShell or VBScript line bloat",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "cN{O}dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dG",
            "n": [
              {
                "c": 4,
                "d": "WSH obfuscated runner bloat",
                "i": "objectives/command-and-control/dropper/execution/wsh::wsh-obfuscated-runner-bloat",
                "o": 0,
                "z": 28,
                "cf": 0.8799999952316284
              }
            ],
            "ln": 0
          },
          {
            "b": "dK([$dK\u003e(m4gjE9\u0026^^^D/[Fan/R^xb/SMBIR}D:QSm^0VR}v%2Sux\u0026\u003e/[w1*/S\u003c8c/]1BYaBB",
            "n": [
              {
                "c": 3,
                "d": "Arabic script detection (Arabic/Urdu)",
                "i": "metadata/file/profile/language::lang-arabic-urdu",
                "o": 332,
                "z": 10,
                "cf": 0.800000011920929
              }
            ],
            "ln": 316
          },
          {
            "b": "zEEBdviwxPBy/nh\u0026^^mo\u003cask\u0026Gq))-YYjTr\u003caA0AG1H5}YYjQN\u003caA9DGr%P\u003cM/A.1\u003cav",
            "n": [
              {
                "c": 3,
                "d": "Japanese script detection (Hiragana/Katakana)",
                "i": "metadata/file/profile/language::lang-japanese",
                "o": 491,
                "z": 6,
                "cf": 0.800000011920929
              }
            ],
            "ln": 475
          },
          {
            "b": "zEW^5z/c0\u003e4gjE9\u0026/]3q\u0026h0)vQ]@TLFz^k*\u0026h8B\u003eQ{]oTZ98vfS]f.9\u0026h0QnRh:AeQAB}b\u003c/UuuH{#SnSoe]B\u003eDou@Y{4J!T(+}8\u003e^u9aX@WvdcM(5\u003czF77^x(kIqx=#z=LPX[WH2w=7\u0026h8B\u003eQ]%",
            "n": [
              {
                "c": 3,
                "d": "Devanagari script detection (Hindi/Marathi)",
                "i": "metadata/file/profile/language::lang-hindi-marathi",
                "o": 922,
                "z": 21,
                "cf": 0.800000011920929
              },
              {
                "c": 3,
                "d": "CJK Han ideograph sequence",
                "i": "metadata/file/profile/language::script-han",
                "o": 962,
                "z": 30,
                "cf": 0.800000011920929
              }
            ],
            "ln": 906
          },
          {
            "b": "g=c%BdgDRbarR!Ih.V%ye(D?faA/N#gbQQ9fF1tovqH0@4gkKwwfs/[vHSUN3mu$kYcb+j/[w1Q/T6m:aLzO6",
            "n": [
              {
                "c": 4,
                "d": "WSH runs hidden window",
                "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
                "o": 2975,
                "z": 13,
                "cf": 0.9200000166893005
              }
            ],
            "ln": 2959
          },
          {
            "b": "gbg:qdiG@Wa%n6Na%niPs5SQHx(FeDq!6\u0026ZAcaM(y?#\u003cPzdK?par\u00260Na}j(4arR!Ii59fxaA/R1fFLa3B#.ArhW]",
            "n": [
              {
                "c": 3,
                "d": "WScript.ScriptFullName",
                "i": "objectives/execution/interpreter/script/wsh::wscript-scriptfullname",
                "o": 5257,
                "z": 22,
                "cf": 0.5
              }
            ],
            "ln": 5241
          },
          {
            "b": "f(GQcvNz\u003eHgbIJ(mn(G+p\u003c3\u003e]B.T/OAz6.Xst\u0026#Bpfgv(fg[fnwLWnDzz=lhs8/}",
            "n": [
              {
                "c": 2,
                "d": "VB6 binary file put",
                "i": "micro-behaviors/fs/file/write/direct::vb6-put-binary-source",
                "o": 25020,
                "z": 3,
                "cf": 0.8799999952316284
              }
            ],
            "ln": 25004
          },
          {
            "b": "zGmEer8Eybs-#GvoLdyfm}D=@v\u003eRNOo?XhGnnH%[x*%^}t3bxQml0^$n?\u0026$HA8pD",
            "n": [
              {
                "c": 2,
                "d": "VB6 binary file get",
                "i": "micro-behaviors/fs/file/read::vb6-get-binary-source",
                "o": 146815,
                "z": 3,
                "cf": 0.8799999952316284
              }
            ],
            "ln": 146799
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 230630.0,
              "entropy": 6.1,
              "size_bytes": 230630.0
            },
            "text": {
              "digit_ratio": 0.26,
              "space_count": 5425.0,
              "total_lines": 807.0,
              "char_entropy": 6.1,
              "unique_chars": 173.0,
              "lines_over_200": 289.0,
              "lines_over_500": 184.0,
              "ascii_art_lines": 4.0,
              "avg_line_length": 283.79,
              "high_byte_ratio": 0.01,
              "lines_over_1000": 104.0,
              "max_line_length": 1235.0,
              "non_ascii_ratio": 0.01,
              "empty_line_ratio": 0.02,
              "last_line_length": 4.0,
              "long_token_count": 290.0,
              "whitespace_ratio": 0.03,
              "most_common_ratio": 0.04,
              "line_length_stddev": 414.46,
              "repeated_char_sequences": 4.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 3.0,
              "most_common_char_codepoint": 55.0
            },
            "binary": {
              "overall_entropy": 6.1,
              "peak_region_bytes": 197632.0,
              "peak_region_entropy": 6.12
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC₂)Md",
        "path": "b76d5451dd01a49fcbfb64219dfe592d392783ddb4efeb1b2a5f5dcc36ef5d30.rar!!Requirement document 2026010711864779153.vbs",
        "risk": 73,
        "sha": "a182f5d6317bf28aefa3169bf0cb356124ebf65721874f5e0ca61e6c1e52546a",
        "size": 230630,
        "traits": [
          {
            "id": "metadata/file/profile/language::lang-japanese",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Japanese script detection (Hiragana/Katakana)",
            "spans": [
              [
                491,
                6
              ]
            ]
          },
          {
            "id": "objectives/execution/interpreter/script/wsh::wscript-scriptfullname",
            "crit": 3,
            "desc": "WScript.ScriptFullName",
            "spans": [
              [
                5257,
                22
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/wsh::wsh-obfuscated-runner-bloat",
            "atk": "T1027",
            "conf": 0.8799999952316284,
            "crit": 4,
            "desc": "WSH obfuscated runner bloat",
            "spans": [
              [
                0,
                28
              ]
            ]
          },
          {
            "id": "metadata/file/profile/language::lang-hindi-marathi",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Devanagari script detection (Hindi/Marathi)",
            "spans": [
              [
                922,
                21
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/reverse-shell/dup::vbs-wscript-shell-run",
            "atk": "T1059.001",
            "mbc": "B0030.002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "VBScript WScript.Shell.Run launch",
            "spans": [
              [
                2975,
                20
              ]
            ]
          },
          {
            "id": "metadata/file/profile/language::lang-arabic-urdu",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Arabic script detection (Arabic/Urdu)",
            "spans": [
              [
                332,
                10
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "atk": "T1105",
            "conf": 0.9200000166893005,
            "crit": 4,
            "desc": "WSH runs hidden window",
            "spans": [
              [
                2975,
                13
              ]
            ]
          },
          {
            "id": "metadata/file/profile/language::script-han",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "CJK Han ideograph sequence",
            "spans": [
              [
                962,
                30
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "conf": 0.8500000238418579,
            "crit": 4,
            "desc": "PowerShell or VBScript line bloat",
            "spans": [
              [
                0,
                29
              ]
            ]
          }
        ],
        "type": "vbs"
      }
    ],
    "rev": "299a3",
    "v": "8"
  }
}