{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/vbs",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T08:27:45Z"
  },
  "path": "c5d70f28b64780ffb165b136e3fbd86681fe2ae65c3e2feaddca35fe3426d67d.vbs",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(AsC)",
        "x": 71,
        "ff": {
          "m": {
            "file": {
              "size": 256782.0,
              "entropy": 4.43,
              "size_bytes": 256782.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 37247.0,
              "total_lines": 52.0,
              "char_entropy": 4.43,
              "unique_chars": 81.0,
              "lines_over_200": 2.0,
              "lines_over_500": 1.0,
              "avg_line_length": 4936.15,
              "high_byte_ratio": 0.05,
              "lines_over_1000": 1.0,
              "max_line_length": 255575.0,
              "non_ascii_ratio": 0.05,
              "empty_line_ratio": 0.1,
              "last_line_length": 15.0,
              "whitespace_ratio": 0.15,
              "most_common_ratio": 0.13,
              "line_length_stddev": 35096.47,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "Dim Script"
            ],
            [
              12,
              "u8",
              "Script = \"La politique de Google semble"
            ],
            [
              54,
              "u8",
              "tre grandement responsable du succ"
            ],
            [
              90,
              "u8",
              "s de Chrome. En effet, face"
            ],
            [
              127,
              "u8",
              "volution rapide d'internet et de son contenu, ainsi qu'au mat"
            ],
            [
              190,
              "u8",
              "riel informatiqueILa politique de Google semble"
            ],
            [
              376,
              "u8",
              "riel informatiqueELa politique de Google semble"
            ],
            [
              562,
              "u8",
              "riel informatiqueXLa politique de Google semble"
            ],
            [
              748,
              "u8",
              "riel informatique La politique de Google semble"
            ],
            [
              934,
              "u8",
              "riel informatique(La politique de Google semble"
            ],
            [
              1120,
              "u8",
              "riel informatique[La politique de Google semble"
            ],
            [
              1306,
              "u8",
              "riel informatiqueSLa politique de Google semble"
            ],
            [
              1492,
              "u8",
              "riel informatiqueyLa politique de Google semble"
            ],
            [
              1678,
              "u8",
              "riel informatiquesLa politique de Google semble"
            ],
            [
              1864,
              "u8",
              "riel informatiquetLa politique de Google semble"
            ],
            [
              2050,
              "u8",
              "riel informatiqueeLa politique de Google semble"
            ],
            [
              2236,
              "u8",
              "riel informatiquemLa politique de Google semble"
            ],
            [
              2422,
              "u8",
              "riel informatique.La politique de Google semble"
            ],
            [
              2608,
              "u8",
              "riel informatiqueTLa politique de Google semble"
            ],
            [
              2980,
              "u8",
              "riel informatiquexLa politique de Google semble"
            ],
            [
              3538,
              "u8",
              "riel informatiqueULa politique de Google semble"
            ],
            [
              3910,
              "u8",
              "riel informatiqueFLa politique de Google semble"
            ],
            [
              4096,
              "u8",
              "riel informatique8La politique de Google semble"
            ],
            [
              4468,
              "u8",
              "riel informatiquenLa politique de Google semble"
            ],
            [
              4654,
              "u8",
              "riel informatiquecLa politique de Google semble"
            ],
            [
              4840,
              "u8",
              "riel informatiqueoLa politique de Google semble"
            ],
            [
              5026,
              "u8",
              "riel informatiquedLa politique de Google semble"
            ],
            [
              5212,
              "u8",
              "riel informatiqueiLa politique de Google semble"
            ],
            [
              5584,
              "u8",
              "riel informatiquegLa politique de Google semble"
            ],
            [
              5770,
              "u8",
              "riel informatique]La politique de Google semble"
            ],
            [
              5956,
              "u8",
              "riel informatique:La politique de Google semble"
            ],
            [
              7258,
              "u8",
              "riel informatiqueGLa politique de Google semble"
            ],
            [
              8188,
              "u8",
              "riel informatiquerLa politique de Google semble"
            ],
            [
              9118,
              "u8",
              "riel informatique@La politique de Google semble"
            ],
            [
              9490,
              "u8",
              "riel informatique6La politique de Google semble"
            ],
            [
              9676,
              "u8",
              "riel informatique5La politique de Google semble"
            ],
            [
              9862,
              "u8",
              "riel informatique,La politique de Google semble"
            ],
            [
              10048,
              "u8",
              "riel informatique1La politique de Google semble"
            ],
            [
              10234,
              "u8",
              "riel informatique0La politique de Google semble"
            ],
            [
              11536,
              "u8",
              "riel informatique4La politique de Google semble"
            ],
            [
              12838,
              "u8",
              "riel informatique2La politique de Google semble"
            ],
            [
              14884,
              "u8",
              "riel informatique3La politique de Google semble"
            ],
            [
              19162,
              "u8",
              "riel informatique9La politique de Google semble"
            ],
            [
              21580,
              "u8",
              "riel informatique7La politique de Google semble"
            ],
            [
              255196,
              "u8",
              "riel informatique)La politique de Google semble"
            ],
            [
              255568,
              "u8",
              "riel informatique)\""
            ],
            [
              255589,
              "u8",
              "Script = Replace(Script, \"La politique de Google semble"
            ],
            [
              255895,
              "u8",
              "Dim C1, C2, C3, C4"
            ],
            [
              255915,
              "u8",
              "B5 = \"OWE\""
            ],
            [
              255927,
              "u8",
              "B6 = \"XE\""
            ],
            [
              255938,
              "u8",
              "B1 = \"EXE\""
            ],
            [
              255950,
              "u8",
              "B2 = \"RSHE\""
            ],
            [
              255963,
              "u8",
              "B4 = \"RE\""
            ],
            [
              255974,
              "u8",
              "A9 = \"MOT\""
            ],
            [
              255996,
              "u8",
              "B7 = \"MAND\""
            ],
            [
              256009,
              "u8",
              "B9 = \"CU\""
            ],
            [
              256020,
              "u8",
              "C4 = \"TI\""
            ],
            [
              256031,
              "u8",
              "C2 = \"L.E\""
            ],
            [
              256055,
              "u8",
              "A1 = \"ESI\""
            ],
            [
              256077,
              "u8",
              "C1 = \"NED\""
            ],
            [
              256089,
              "u8",
              "A2 = \"COM\""
            ],
            [
              256101,
              "u8",
              "A3 = \"ONPO\""
            ],
            [
              256114,
              "u8",
              "A7 = \"LI\""
            ],
            [
              256125,
              "u8",
              "C3 = \"CY\""
            ],
            [
              256202,
              "u8",
              "Dim F0, F1, F2"
            ],
            [
              256569,
              "u8",
              "Dim Edge"
            ],
            [
              256626,
              "u8",
              "Set Elite = GetObject(Replace(Edge,\""
            ],
            [
              256767,
              "u8",
              "Elite.Run ALL,0"
            ]
          ],
          "v": {
            "file.stem": "c5d70f28b64780ffb165b136e3fbd86681fe2ae65c3e2feaddca35fe3426d67d",
            "file.basename": "c5d70f28b64780ffb165b136e3fbd86681fe2ae65c3e2feaddca35fe3426d67d.vbs"
          },
          "id": "vbs"
        },
        "id": 0,
        "sz": 256782,
        "ts": [
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.9200000166893005,
            "d": "WSH runs hidden window",
            "e": [
              ".Run ALL,0"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 255575.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "VB6 binary file get",
            "e": [
              "Get"
            ],
            "i": "micro-behaviors/fs/file/read::vb6-get-binary-source",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 52.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 4936.15"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          }
        ],
        "sha": "c5d70f28b64780ffb165b136e3fbd86681fe2ae65c3e2feaddca35fe3426d67d",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-10/c5d70f28b64780ffb165b136e3fbd86681fe2ae65c3e2feaddca35fe3426d67d.vbs",
        "type": "vbs"
      }
    ],
    "tv": "52045"
  }
}