{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.9380215, "class": 0 }, { "m": "az/vbs", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T11:59:34Z" }, "path": "e2adfd891d4312f7cdb0cbc2178f79438ad2900680a2fe139a3531fbae2bdee4.vbe", "raw": { "v": "5", "fs": [ { "f": "O(As₂)Md", "x": 37, "ff": { "m": { "file": { "size": 1249462.0, "entropy": 4.97, "size_bytes": 1249462.0 }, "text": { "tab_count": 43.0, "digit_ratio": 0.18, "space_count": 18024.0, "total_lines": 1.0, "char_entropy": 4.97, "unique_chars": 101.0, "escape_density": 0.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 1249462.0, "high_byte_ratio": 0.0, "lines_over_1000": 1.0, "max_line_length": 1249462.0, "non_ascii_ratio": 0.0, "null_byte_count": 1.0, "last_line_length": 1249462.0, "long_token_count": 3245.0, "whitespace_ratio": 0.01, "most_common_ratio": 0.09, "octal_escape_count": 9.0, "unusual_whitespace": 1.0, "non_printable_ratio": 0.01, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 33.0 } }, "s": [ [ 194, "xor", "gl)ufu\"#s!7-8yr" ], [ 289, "u8", "J@#@\u0026~,P~@#@\u0026~,P~\u00260,9r`}I sbVn2XkdOk`(;e(:#P:4nx@#@\u0026,P~P~~,PJZt\t(,'~E2fcq*8cqc8*8cqWFWFc8c8*FWF*FWF*qWFc8*FWFc8*qc8c8cqcq*8cqc8*" ], [ 2218, "u8", "XRvfv;*z\u0026fWZ2%c8c2*,+G*FW\u0026*1+GvwXFWc ~f0vOcOv/c3*Rv+vRXb+f*12,c9f2vfv;*A\u0026+l,W v;*F" ], [ 2235, "xor", "\\DBE)D(9HD_E)" ], [ 2427, "xor", "\\DBE)D(9HD_9/H4" ], [ 2443, "u8", "Gl!vO*9vzvWGX\u0026TfyvfvR{!lc" ], [ 2469, "u8", "+Fvc3XFc/\u0026ZXz\u0026++ Fb\u0026OvG" ], [ 2527, "xor", ",j\",e?jklf" ], [ 2667, "u8", "OcfcAfWv)W,F,*OvA*ZFc*2l%X12v\u0026Zf + vzfqc2vWv9\u00261fyvfG+*b2\u0026X1F!\u0026qXFc/Gz*+*{+ +ZvR\u0026yX,Fb{!+b" ], [ 3028, "xor", "6r6ojijk6j" ], [ 3044, "xor", "6G(OH66(D_)9D" ], [ 3173, "u8", "++,\u0026qXF*)Gz*A*0l,2%vw*8*cWAf!+GXTyscO{,+\u0026v;" ], [ 3186, "xor", "jp,lre67jxj#" ], [ 3235, "xor", ")6_E/H66(D_H4D/" ], [ 3295, "xor", "UDNEBD_()HD6\\" ], [ 3333, "xor", "DE))(6)ENH9" ], [ 3435, "u8", "Fc/c8*lc*WFWFc8vF" ], [ 3563, "u8", "Fc/c8*8c*WFF*c8c8*fWFfcW\u0026*qF%c8*FWFc8f*cFc8G" ], [ 3681, "u8", "GWF*q2!cq*8cqc8*8cqWFF!cyGF" ], [ 3713, "u8", "AWG*qFbcy*FWFc8*qc8c8v/c+X8v+c8**WG*qWsc+*8v*c8*Gc{WF2Fcyc8XbWFf%WG*qF,cy*Fl*c8*Xc8c8c" ], [ 3825, "u8", "Fc0WF+ZcyvF*ZWF*fWv*q+Acy{G+ c8fTcFc8cqcqX8*)c8f!WG*q+%c+" ], [ 3937, "u8", "AWG*qF,c+{F**c8*lcqWFWbc8vF*sWF*FWF*qWFc8*FWFc8*qc8c8G)c+{Fvqc8*,W%*q+%c+X8v+c8Xlc{WF+Acy*8X,WF*,W%*ql*cy*F+ c8*XcFc8v3c+X8*)c8{" ], [ 4081, "u8", "wcfWFWFc8*8*2WF*,Wc*qFGc8" ], [ 4193, "u8", "GWG*q+2c+X8vqc8*Oc0WF2*cyc8" ], [ 4427, "u8", "GWZc8*qcWc8GXcq*8c9c8fcW\u0026*qF%cq*8cqc8*8cqWFF*cyGF" ], [ 4587, "u8", "Fv+c8fRc{WFF!cyc8" ], [ 5083, "u8", "Fvfc8XFWv*qWFcq*8c+c8X8cfWFWFc8c8*FWFf%WG*q+fcy" ], [ 5163, "u8", "Fvfc8*lc{WFlGcy*8*FWF*FWF*qW*cy*FWFc8*qc8c8cqcq*8cqc8*FWF*qWFcq*8cqc8*lcqWFWFc8c8* WF*FWF*qWFc8*FWFc8f0cWc8cqcq*8cqc8**WF*qWFcq*" ], [ 5422, "u8", "c8*8cqWF2!cOc8+sWF*FWF*qWFc8*FWFc8*qc8c8cqc1*8 oc8*FWFX1lFcf*8cqcW{Fc1WFWFc8c8*FWF**WF*qWFc8*FWFc8*qc8c8cqcq*8cqc8*FWF*qWFcq*Ocq" ], [ 5553, "u8", "Fc{WFWFc8*8*FWF**WF*qWFc8*FWFc8*qc8c8cqcq*8cqc8*FWF*qWFcq*8cqc8*8c1WFWFc8c8*FWF**WF*qWFc8*FWFc8*qc8c8cqcq*8cqc8*FWF*qWFcq*Ocqc8" ], [ 5681, "u8", "Fc*WFWFc8*8*FWF**WF*qWFc8*FWFc8*qc8c8cqcq*8cqc8*FWF*qWFcq*Ocqc8*8c" ], [ 5748, "u8", "WFWFc8c8*GWF*\u0026WF*q+Gc8*FWFc8*qcyc8cfcq*8cqc8*FWF*qWFcq*8cqc8*8cqWFWFc8c8*FWF*FWF*qWFc8*FWFc8*qc8c8cqcq*8cqc8*FWF*qWFcq*8cqc8*8cq" ], [ 7077, "u8", "q+%\u0026qXl*)\u0026WX+v$+\u0026FvcA\u0026ZX%WF*FWF*qWFc8*FWFc8*qc8c8cqcq*8cqcGf*W *qWFcq*8cqc8*8cqWFWFc8c8*FWF*FWF*qWFc8*FWFc8*qc8c8cqcq*8cqvF*FWF*" ], [ 7357, "u8", "FFcX lGX1+\u0026cA" ], [ 8123, "xor", "ED(9(D(9(D" ], [ 8203, "u8", "ZWZGzX" ], [ 8324, "xor", "?kkljkje,j6" ], [ 8336, "xor", ";;#r696p#ij" ], [ 8363, "u8", "Gvf\u00268Xyc0+ 2FcAcl*,F\u0026*F+b*/FG\u0026W*\u0026WfGlXq*W*ZGX\u00261XFvqGz*bl%X)lGc+*2c/vO" ], [ 8509, "u8", "cFv*2l%X)l\u0026\u0026lX\u0026+ v;X+\u00262v2\u0026Xc3*+v+c8*FWF*ql cf*8cqc8*lv{FvFvGyG2{bWF*FWF*q2!c2*FWFc8*9\u00262*zGXv/*Fv*\u0026ZXv2 XXF*v$XR**c;*8*qWFlFc8c8*" ], [ 8709, "u8", "XW2vR*FWFcyfTc8c8cqc1XR*)GzXv+Z*/2*\u0026qfZc+c8*lcqWcWFc8vF" ], [ 8773, "u8", "*+%cAXG+FG2*+cRv2c+\u0026XX2vXcAf*WF*qW c9*ycqc8*O*0lb2!*+cR" ], [ 8901, "u8", "fFvcyf\u0026+\u0026GZX+\u0026Zclv" ], [ 8984, "u8", "c)*R*X\u0026Zf*lGX)F!G0fy*qGFXyc0+cW,cy*RX,Fv*2+Z*/FbGRf + vzf1cFvWG" ], [ 9067, "u8", "Gv*GOX+\u0026+l*F*cO*FXbl%f*l\u0026" ], [ 9163, "u8", "AWZ\u0026lfqv~clv" ], [ 9221, "u8", "qW*cA{%l%v+X" ], [ 9256, "xor", "H_6EDGH4DED" ], [ 9345, "u8", "ZW *qW vF*vWFc8*qvzc;G{\u0026*{Oc9GRfcF,*3F%v$" ], [ 9419, "u8", "fl v;{0\u0026y*zGXv/fy*XGz" ], [ 9573, "u8", "fFvc)f2*1GZf8\u0026Tl\u0026WFclvFXGWF*FWF*9F*c8" ], [ 9611, "u8", "bWZGFf*GOcAG0v{" ], [ 9627, "u8", "Fvfv;X WG" ], [ 9681, "u8", "/cRvyv3\u0026Xfyv+GOX 2\u0026XXF*c9*Rv+G+fOc{lvF*cG*RXb+b*bl%" ], [ 9693, "xor", "E)!6N\\H66(D" ], [ 9733, "u8", "*FvcAX%lb*2fX*2vyv/*+f2vf\u0026l*22F*9WFcXX8*qc8*8cqWfF*c8vz*ZFGfcl\u0026*9F%vFXFlb\u0026Z*" ], [ 9825, "u8", "Zl%X*WAcqX8cq*O*8cqWFWFc8c8*FW *FlF*qW,c8*FWFc8*qc8c8cfcqX8cqcO*FWF*qWFcX*8c+\u0026WfWcfW2+GG2vG" ], [ 10177, "u8", "AFb*32c\u0026ZX\u0026lbGFXqcFcAG**X*W*)GzX*lc*/2!vf" ], [ 10209, "xor", "j,#jora6\u0026?:ji6" ], [ 10310, "u8", "WFc8*FWFc8*X*8cycqcqX8vqGz" ], [ 10423, "xor", "6f,#,?fkej\"rf" ], [ 10491, "xor", "VD/9DD(EBD69(" ], [ 10577, "u8", "{c8cyG*c)*ycqcOXFWF*fl\u0026cq*8cfcl{Fv{W*WFvFc8* +G*,l *qW c8X\u0026W vF*1cyc8v{*qX8v0c8*AW *q+G*X*8cqvl*8*+WFW clc8*fW%*F+G*0WF\u0026WX WFcy*" ], [ 11297, "u8", "GlF*qW%c9*8c0cy*lcqW,W*v~c;" ], [ 11387, "xor", "VDKEHDDE)D" ], [ 11403, "u8", "GWcvWf*vFcWcfcq" ], [ 11516, "xor", "DK9HD(EBDE9" ], [ 12027, "xor", "VD(9DDBE)D" ], [ 12171, "u8", "sW*cy*qc8c2vfG{" ], [ 12187, "u8", "Rcqc2*FlF*+lvcf" ], [ 12253, "xor", "ED\\DD()DE9D" ], [ 12267, "u8", "FcXcy" ], [ 12284, "xor", "D(E)6(9(DD" ], [ 12363, "u8", "GW*cy*qvzcl*" ], [ 12476, "xor", "D(9ND(EBDE9" ], [ 12545, "u8", "\u0026lFXql clXFWFvFXXvFcWcocX" ], [ 12640, "xor", "D(9HDE9(D_" ], [ 12939, "u8", "G+\u0026c8XXcFc8GXc+" ], [ 13025, "u8", "\u0026lv*3WFcqX8*)c8X8c0WF+%cy*8XbWF*,W%*qWccyXF+ c8*1cRc8G" ], [ 13163, "u8", "F*+c8fWc{WFF!cyGFXv2**FWF*q+scy*F+cc8*XcFc8G{v/*8cqc8*,W%*qF*cq" ], [ 13207, "xor", ";6ojx#1#xjl" ], [ 13227, "u8", "FvfcR*8cqWFF,cAc8*FWFfcW\u0026*qF*c8" ], [ 13259, "u8", "GWZc8XqcRc8GXc+X8*1c8XFW%*qFbc+X8vqc8X8c{WF+Gc8GF" ], [ 13437, "u8", "FWFfcWG*qWb\u00268X*WFc8f*c2c8v/c+*8v+c8*,WG*q+%c+" ], [ 13483, "u8", "Fv*c8Xlc0WFFvcyvF" ], [ 13723, "u8", "Fvfc8f%WG*qWGG**8cqc8*Gc0WF+ZcyGFX,WF*,W%*q2Fcy{G+ c8*9cRc8v/c+" ], [ 14213, "u8", "*+%*zXGlbcl" ], [ 14277, "u8", "fFc\u0026Of lF\u0026ZX" ], [ 14378, "u8", "fy*Xv+Xy*0lbFbcyc8" ], [ 14653, "u8", "Wc* FG" ], [ 14662, "xor", "(BDED)EH)\\6" ], [ 14674, "u8", "cF*2v/\u0026qXFvq\u0026Zf*lG" ], [ 14781, "xor", "NEKD\\\\N66(" ], [ 15037, "u8", "Fv*2WG*qFbvW" ], [ 15051, "u8", "f+ GZX+cRvWv/c3X+vXcA* FG" ], [ 15165, "u8", "FF,X 2\u0026XXWFcGX%lbG2" ], [ 15196, "xor", "jqfxjr,e?1," ], [ 15452, "xor", "jijr\u0026j,f?kk" ], [ 15781, "u8", "*+%c3XFvqG2*yc0+\u0026W \u0026lGOX,F!*2l%X1W\u0026GRXGl,\u00268*3*Rv8*{\u0026X*2v*vGf,2" ], [ 16005, "u8", "fFvczf\u0026l,GZfqclc8G)c3XFvq\u0026Z*22\u0026" ], [ 16139, "xor", ")EH)E6EH\\D!)6" ], [ 16155, "u8", "FvfG+X l%X12 v/*Fv*vz*+cXWFF,\u0026OvG" ], [ 16371, "xor", "WEH(BDEH\\6(9(DB" ], [ 16417, "u8", "ZlGX12!\u0026Xfyv+cW" ], [ 16459, "u8", "AWZGWf1cF*yv/*+fyv+cWf*l\u0026" ], [ 16468, "xor", "j96ojk\u002696k#" ], [ 16895, "xor", "(6N\\H6_E4)4" ], [ 16965, "xor", "q,a#9jekf#9\u0026qjk69#1#1" ], [ 17035, "u8", "flbGl" ], [ 17091, "xor", ")6_9(H96)E" ], [ 17112, "u8", "v/*Fv*GFXv2 X12c*" ], [ 17243, "u8", "Gvfv;* 2\u0026X*+Av/*Fv+vRXzv3+ WbcyvF" ], [ 17413, "u8", "++%czf + G2" ], [ 17483, "u8", "AWZGWX" ], [ 17490, "u8", "cFvWG)v/f2*Xc8fc2" ], [ 17542, "xor", "(DH!6)E(H4D" ], [ 17573, "xor", "praj?\u00269ji#x\u0026" ], [ 17636, "xor", "?1kef1\u002696k#,j9#pkf" ], [ 17765, "u8", "f2F\u00261fyvfv;*zc0WFFccz\u00262" ], [ 18021, "u8", "*Fbv/f2*Xc8{F*{lb+A\u0026O*FXc2!*2lGX)FFczf lcGl*9vAvyG" ], [ 18072, "u8", "v/*Fv*vzXvWG" ], [ 18149, "u8", "qWFvf" ], [ 18193, "u8", "fvGvyGTc3f2v+GF*2l%" ], [ 18512, "xor", "jkjxj:f?6oj" ], [ 18621, "u8", "FcXv+fXXWF*l" ], [ 18640, "xor", "js#k#x6oj?j" ], [ 18877, "u8", "\u00262!X l%Xq2*\u0026lXGl,GFfq\u0026yvyc*v/*Rv+vOfFlGX)Fbc3XR*qc8Xlc{+c2Fcz*F" ], [ 18896, "xor", "\u00261f969#j6oj" ], [ 18961, "u8", "/vGv2\u0026Xc+f2v+cW" ], [ 19141, "u8", "fFc\u0026Of lFc8XXcFvW\u0026qc)XFvqGOX W%" ], [ 19333, "u8", "qFbczX%lb*FX" ], [ 19346, "u8", "cFvyGT*)XlvXG2*blG" ], [ 19368, "xor", "#s\u0026r6\u0026#9j9j1,\"rajk6" ], [ 19436, "xor", "ji#,j9j1,\"rajk6" ], [ 19459, "xor", "e?jra#k\u0026ak" ], [ 19499, "u8", "GvfvRXyc" ], [ 19563, "xor", ")D_)96EHEEH(" ], [ 19717, "u8", "qW,cyXFlb\u0026ZX" ], [ 19781, "u8", "*lccyXFlb\u0026ZX" ], [ 19876, "xor", "?kkl6o\u002696\u0026" ], [ 20306, "u8", "vGvyv3v/fyvfv;X W**q+Z*+XRv*vO" ], [ 20357, "u8", "*+%czX%lbGlX" ], [ 20619, "xor", "e,l#rjsfrj:" ], [ 20754, "xor", "f96r6p#ij,ji" ], [ 20861, "u8", "\u00262FX W%" ], [ 20896, "xor", "jr,e?1krj??" ], [ 20933, "u8", "qWfcyXFlbGOX+\u00262v2GTv*XF*)*2XvWG" ], [ 21061, "u8", "qWccyXFlbGl" ], [ 21350, "xor", "\\DDE6EDG)9" ], [ 21501, "u8", "cFvX WG" ], [ 21541, "u8", "*+%c3XFvq\u0026Zfl*{lb+s*y*R" ], [ 21655, "xor", "GH66(D_H4D\\E\\" ], [ 21693, "u8", "WbX W%" ], [ 21707, "u8", "flbv;X+cFc8v/c3" ], [ 21850, "u8", "fyvfc8XF2" ], [ 21861, "u8", "++s*+XR*)cAXy*0lbW%cyc8Xb+Z{!l%" ], [ 21931, "u8", "GvfcW" ], [ 22014, "xor", "9NDN9(6GEKH!D)" ], [ 22036, "xor", "j:6p#kjxji6" ], [ 22069, "xor", "N9(DVD(6BE4D" ], [ 22108, "xor", "jqfxjr,e?1," ], [ 22286, "xor", "6k\u0026qjkj:6if" ], [ 22295, "xor", "GH66(D_H4D\\E\\" ], [ 22333, "u8", "FW** WFX" ], [ 22427, "u8", "Gvfvz" ], [ 22433, "u8", "ZlGX*WFcXXWv+GOfOv9l +v*y*RXbFb* lF*9Fcczf\u0026+ cFf1c+vWv/v**FcqGRf!+f" ], [ 22616, "u8", "c3XlvXG2f*2 X*+Ac" ], [ 22667, "u8", "GWFc2Xqc2c8*Tc/X8c+c8" ], [ 22699, "u8", "Fc3cyfRc3WFl!cW*8" ], [ 22717, "u8", "\u0026WF*fWv*qWFc8*FWFc8*XcRc8*+c+*8cXc8*FWF*qF%c+X8coc8*8cqWFWFc8*8" ], [ 22849, "u8", "sWF*qWFvw*FFcc8*qc8c8c+cq*8cqc8" ], [ 22881, "u8", "GWZ*qWFvoX8voc8*8cqWFW c8c8*FWF*FWF*qWFc8*FWFcFX1vwc8G1cq*8cqc8*FWF*qWFcq*8cqc8*8cqWFW*c8c8*FWF*FFG*fl\u0026czXFWAc8*qc8c8cqcq*8cqc8*" ], [ 23073, "u8", "sWF*qWFcq*8cqcF{2G" ], [ 23092, "u8", "WFF!c8c8*FWF*FWF*qWFc8*FWFc8*qc8c8cXcq*8cqc8*FWF*qF%c$X8c$c8*8cqWFWFc8c8*FWF*FWF*qWFc8*FW c8*qc8c8Gfc+*8cqc8*FWF*qWFcq*8cqc8*8cq" ], [ 23284, "u8", "WFl%c8GF*AWF*,WF*qlvc8{GW,c8*Xc8c8*" ], [ 23435, "u8", "GW\u0026c8*1c8c8c0cqX8cfc8*,WF*qWvcq*8cfc8*OcqWFWcc8GF* WF*,FG*q+2cl*Fl*c8*qGFc8v1cq{F*+c8*FFG*q+cGfX8c{c8*8G{WF+cGF*8XvWF*FFG*ql%cO{" ], [ 23681, "u8", "sWF*qWAc8XFW\u0026c8" ], [ 23771, "xor", "xjj#9\u0026a,fj1" ], [ 23787, "u8", "F\u0026fc8XOc9WF+vc2vF" ], [ 24097, "xor", "H9BDE9(DEDV" ], [ 24129, "xor", "H9KDE9(DVD(9" ], [ 24203, "u8", "GW c8{f\u0026Wc8cq*f" ], [ 24348, "xor", "ji#xj\u0026,6j1" ], [ 24398, "xor", "#x;\u00266x#x6ijkjx#?#x;f,ej1k\"jk?" ], [ 24779, "u8", "GW c8{fcGc8v)*f" ], [ 24907, "u8", "GW c8{fczc8c**f" ], [ 24923, "u8", "Fc+c8*fWb*qWF*{{FGfc8*Gc9WFF!*yc8*vWF{\u0026W%*q+b*yXFW%c8*9cRc8v)*+" ], [ 25002, "u8", "{Fv3c8*Gc9WFWb*yc8*vWF{\u0026W%*qWc*yXFW%c8*9cRc8c**+" ], [ 25070, "u8", "c8{2c{WFF*cGGF{ WF*fWG*qF*cGXF+%c8{fc+c8GXc9{F*)c8*fWv*qF*c9{F*)c8{2cXWFF*cG*8" ], [ 25149, "u8", "WF*fW**qF*cGXFl%c8{fcWc8GXc9{F*)c8*fWc*qF*c9{F*)c8{2cfWFF*cG*8X%WF*fW\u0026*qF*cG*Flvc8{fcyc8GXc9X8c3c8*fW *qF*c9*8c/c8{2cqWFF**lvF" ], [ 25323, "u8", "Fc+c8*Gc1WF+GcO*8*%Wv*FWZ*q2%c8*FW*cz*1vwc8GTc" ], [ 25419, "u8", "G2%c+*Xcwc8G0c0" ], [ 25450, "u8", "*8v{cy*Gv+WFF%c+c8f*W%" ], [ 25473, "u8", "G+v*qF%c+XF2 cyfTvzc8*)c" ], [ 25498, "u8", "{F\u0026Tc8{\u0026Ws*qF%c*" ], [ 25515, "u8", "Fc+cz*Oc1WFF%cWc8**Wb*,+s*ql c+*FFbcF" ], [ 25562, "u8", "{FG0cGfcWA*qF%c*" ], [ 25626, "u8", "X8GTcyf%F *q2*cX" ], [ 25643, "u8", "Fv3cyfW*+WFWbclGF" ], [ 25661, "u8", "ZW\u0026{GlG*q+%c+{G+bc8X1Glc8G0cXX8v1cR" ], [ 25697, "u8", "G+Z*qF%cX*8v0cW*Ov{WFF!clc8" ], [ 25729, "u8", "AWG*ql cR{G+*cOXXv~c8v0cX" ], [ 25787, "xor", "(6)9)DBE\\D" ], [ 25803, "u8", "GlvcF" ], [ 25809, "u8", "{GZc8c+cX*8*fc+*f+c*qlbc+*8cXcz*O*1WFF%c+c8XFWf*f+F*qlbc+" ], [ 25947, "u8", "Fc)c+**l!*q2*c0*8c1cz*O*1WFF%cR*8*GW **l,*q+%cR" ], [ 26047, "xor", "f?3,aj1rj#" ], [ 26177, "u8", "Glc*qF%c2{G2*c2*q*+c8GTcf" ], [ 26379, "u8", "G+%cy{{clc8v$cq" ], [ 26411, "u8", "Fv0cy{FcXWFl*c8vF" ], [ 26443, "u8", "GW cz*1cOc8Gfcq" ], [ 26507, "u8", "GW cz*1cOc8c9cq" ], [ 26593, "u8", "GWF*ql cfX8c" ], [ 26606, "u8", "cGXOc+WFl c2*8*vWA" ], [ 26625, "u8", "sW2*ql c2XFWvcy" ], [ 26699, "u8", "GWZcF" ], [ 26731, "u8", "Fc+cz*O*1WF+%c8c8**Wb*,l,*qlbc8" ], [ 26795, "u8", "Fc)cz*Oc1WF+%cWvF* Wb*,W,*qWbcW" ], [ 26827, "u8", "GW cz*1cOc8c+c*" ], [ 26859, "u8", "Fc+cz*Oc1WF+%c2vF* Wb*,W,*qlbc2*FW,cz*1cOc8c)cf" ], [ 26907, "u8", "Fc{cz*,W,*q2*c+*8cXcz*Oc1WFF%cyc8**Wb*,W,*qF!cy*FW*cz*1cOc8v0c+X8c" ], [ 26974, "u8", "cz*,W,*qlbc+*8cXcz*Oc1WFl cyc8**Wb*,W,*qWbcy*FW*cz*1cOc8c+c+*8cXcz*,W,*q2*cq*8cXcz*Oc1WFF%c8c8**Wb*,W,*qF!c8" ], [ 27099, "u8", "Fc+cz*,W,*ql cqX8cqcz*Oc1WFWbclc8" ], [ 27467, "u8", ",l!c8Xqcyc8c{c{*8**cO*fWF*qWFcq*8cqvw{FcqWFl*c8vF* Wb*,W,*{WGc8*FWFc8*qGFcz oc*{FcXc2f%W2*qFbc+X8cqc8*8cqWFWFv2*2f,WF*,+%*ql%cW{" ], [ 27787, "u8", "GW c8*qc8c8cqvf{Oc9c8*F+%*qFcc*X8cocOXOcqWFWFc8c8*F+2" ], [ 27841, "u8", "GW *qlFcl*F+GcF" ], [ 27889, "u8", "2GXWFF\u0026cyGF" ], [ 28011, "u8", "Rc+c8*8cqWFWF*OGO" ], [ 28177, "u8", "{cFc8c)c1{FG1c2*FW,*qlGcq*8cqc8*8cqWbWFc8*8*\u0026WFX,WF**+ccyXFWFc8*qc8c8cqc9*2v/c8" ], [ 28267, "u8", "F $c2X8c9WFWFc8c8*F+bXFW**qWGcO{GFGc8" ], [ 28305, "u8", "fcAc8c+cq*8cqc8*FFG*1yscq" ], [ 28331, "u8", "Fc+c8XO*qW\u0026W\u0026vOvR* WF*FWF*qWFcG{,W%c8X1vFc8 $GqX8 $cO*fW *qWFcq*8cqvz" ], [ 28401, "u8", "FcqWFWGcOvF{vWff%W\u0026*flGc8*FWFc8*qvFcO\u00260c+*8c+c2X,2G*fWGcqX8cXc8*8cqWFWFcOc2X*WFXFWF*qWGv~" ], [ 28475, "xor", "\\6D9(6(9(D" ], [ 28529, "u8", "Fc1WGl c8c8*FWF*F+G*1+Gc8{GWFc2f0G8c8v" ], [ 28568, "u8", "v1{FcXc8*FWF*qWFc1{Oc" ], [ 28605, "u8", "AW,*fW *qWFc8*FWFvO*qc8c8c*c1{FvocO" ], [ 28731, "xor", "VD(EKD(9BD" ], [ 28827, "u8", "F*TcO*fW *qWFcq*8cqvR{FcfWFWcclGF{\u0026Wb" ], [ 28907, "u8", "Rc+c8*8cqWFWFc8*2fGWF*,WF*qlv*z*FWFc2XqcGc8cqcq*8cqvF{GWf*qW\u0026cq" ], [ 29003, "u8", "GWFc8X1*8c2cfv1" ], [ 29019, "u8", "Rc+c8*FWF*qWFcq*2v)c8*lv{WFW*vl*8X\u0026WF*fW *qW,cy*FWFvF*qv;c8v**X*8Gfc8**+%*qWFcfX8c9c8XOv{WF2%cyvF+sWF**+%*q2\u0026GW" ], [ 29032, "xor", "#1jr6i#xj,6;" ], [ 29131, "u8", "GF,c8*XvFc8\u0026TG**8\u0026fc8**+%*qF%v0" ], [ 29163, "u8", "F\u0026fc8*lv0WFFcc+c8X%WF**+%*q+scz{GFFc8*XvRc8v)v**8c1c8**+%*q+ v0X8v)c8*lv)WFlcvRGF{FWF**+%*qWZvR{Gl%c8*Xvzc8c*v0{F*fc8**+b*q2Gv{*" ], [ 29179, "xor", "V6K9(DDEKD" ], [ 29184, "xor", "jjkej1k3#:;" ], [ 29323, "u8", "GWvc8*q*8c8c" ], [ 29437, "u8", "ZWF*FlF*qW c8*FWvc8{fc8c8\u00261*)X8v/c8" ], [ 29585, "u8", "fczc8cqcX*8cqc8X,WF*qW cqX8vqcGfZ\u0026XW\u0026FbcWc8**W *FWF*qWvc8XFWFc8fTc+cWv*v9{F*fc8*FWF*qWFcqX8cqc8*lcqWFWbGR*8" ], [ 29754, "xor", ")(DH9(6BE)DE9H)" ], [ 29803, "base64", "\u001bg\u003c]Ņ}φ" ], [ 29919, "xor", "V6BE)DE\\))G6V" ], [ 29983, "xor", "V6BE)DE9)D" ], [ 30043, "u8", "F*)c8X,F%*fl\u0026*){F\u00260c8*Ov0W 2GcRvF{%WFX,+G*+2Gvz{G2%c8X1*8c2G{v){F\u0026" ], [ 30077, "xor", "K9(6BE)DE\\)" ] ], "v": { "file.stem": "e2adfd891d4312f7cdb0cbc2178f79438ad2900680a2fe139a3531fbae2bdee4", "file.basename": "e2adfd891d4312f7cdb0cbc2178f79438ad2900680a2fe139a3531fbae2bdee4.vbe" }, "id": "vbs" }, "id": 0, "sz": 1249462, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1249462.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1249462.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1562.001", "c": 0.8199999928474426, "d": "PowerShell char arithmetic", "e": [ "aorp\u002693i37/3", "a7s\u002673/3,l", "se:6/673//", "4:(U4/4JJO4", "e\"d/,3/37pr6", "39/373eroj", "\u0026\"73/373pd", "D_D!6/4_UN4", "rpkk3i37/7ey", "3/3j/73/ero#", "O4:4K:4O4OO4/4:OVO:H\\(GEEOO4JN", "gl)ufu\"#s!7-8yr", "9/k3/73,ar", "eaisr3/37pr", "jkrp6i/x3/37p", "rpikr?37/76p" ], "i": "objectives/evasion/anti-av/amsi::powershell-char-arithmetic", "l": 1, "m": "E1562", "el": [ "0x432f7", "0x42a5b", "0x42d5d", "0x10acb", "0x43c08", "0x41fa9", "0x41a5d", "0x41d8d", "0x44609", "0x44637", "0x25ef6", "0xc2", "0x42890", "0x43e08", "0x44435", "0x44b09" ] }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "PowerShell or VBScript line bloat", "e": [ "text.avg_line_length = 1249462.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Excessively long lines (\u003e1MB)", "e": [ "Detected line(s) exceeding 1MB (potential anti-analysis technique)" ], "i": "objectives/anti-static/excessive-line-length", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "W\u0026q+/%R\u002680Z2F1!2F1*2F,RfFOZ\u00268)T\u00268bW\u0026qb0f \u003curl\u003e", "FloF\u0026oZ!Z!!Z!Z1v8*oG2sTTZ!!Z*!O*Flo{\u0026w!Z \u003curl\u003e", "!ZfZ!q!TTZ20\u0026Ro!2%o02%!TfO!0\u0026OqZ\u002618%2, Z \u003curl\u003e", "/2,%Rf,z%\u0026O/*\u0026OZR\u0026120fO!0\u0026z++*02bv0fz%0\u0026 \u003curl\u003e", "lG*Z0fl*sR01GlsR20Gq9AsoswX,l,0X;!!o0R,9 \u003curl\u003e", "!RAX$Z%\u0026$XG!0!w1lZTR*;,GWF20flc+cW0y*s8o \u003curl\u003e", "3vwGZGqG+{2G*Gl{vFG{0F,G){~G/GG{AGoR!RF% \u003curl\u003e", "38!T!ZT!RA03G!!TTZ!T ~/RG*Z*A%*~\u0026wTFZ!0f \u003curl\u003e", "wsso02Z*!W0lZTFcZ2%Zs~TFFcT*R!o$Z%Gl9%R* \u003curl\u003e", "#%ZFToR*,$T8!T!Z/FcXA!FZsFclT!RA**Z%0$;s \u003curl\u003e", "*2fv;ffF!\u0026G{*\u0026GGR\u00269G/fG%T\u0026G0/0/2f,TfG,*\u0026 \u003curl\u003e", ")!y2Oc3s$owsosw{*8Zff;!so{lF0\u0026R*l TwsF*F \u003curl\u003e", "+RfG/Tw2Ts2TwGoZGw\u0026!wGw*G8!0AWc+*Zc%~ob; \u003curl\u003e", "2\u0026A;f\u0026;*\u0026299\u002622z\u0026f2of2F1\u0026W+,**2c*$fW,$\u0026W \u003curl\u003e", "!R clTTcR\"0!q{W!1#%ZF{*Zc\u0026+9~2$ l022/8%R \u003curl\u003e", "\u003cbinary data\u003e \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:1244946", "offset:1062799", "offset:1242099", "offset:1244582", "offset:593063", "offset:643458", "offset:1009330", "offset:499067", "offset:542535", "offset:950335", "offset:1240102", "offset:823986", "offset:696198", "offset:1219559", "offset:343468", "offset:498709" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "s;rrak\u00263raf7??f7erf/\"q\u00267r1f7/lr3 \u003cxor\u003e", "76e=6S,zKF\u003cKmH.N6eo%ossk9zFpm=N://FZ[D8F \u003cxor\u003e", "\"\u0026:/373\u0026:yi3737\u0026i\u0026i/73/rrsf73dy:6\"?/7 \u003cxor\u003e", "(4D:KWD9NDN46O/KEA/)O::4KJB9E9BD4O4OO4K) \u003cxor\u003e", "jf:jdf:69fi6;\u0026:eqf:qlr\"ijr\"\u0026p\u0026:r \u003cxor\u003e", "YN:D0y3L6mmL$\u003c=N0W3uz9\u0026eaeap/uNBD\u003c'\u003cY%W= \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3, "el": [ "offset:1231461", "offset:573221", "offset:1184936", "offset:574517", "offset:1220142", "offset:956764" ] } ], "sha": "e2adfd891d4312f7cdb0cbc2178f79438ad2900680a2fe139a3531fbae2bdee4", "path": "e2adfd891d4312f7cdb0cbc2178f79438ad2900680a2fe139a3531fbae2bdee4.vbe", "type": "vbs" } ], "tv": "52045" } }