Normal
No, it is not because the ratios are also skewed if you equate attacks with samples. Many attacks reuse samples. And many samples are never used to attack. The ratios if checking the samples only will be in high favor of self-replicating malware, especially old self-replicating malware that has almost no attack surface in the real world anymore.