{
  "llm": {
    "conf": 0.99300003,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "ISO dropper with .NET reflection loader"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.96912676,
        "rte": "az",
        "prob": 0.96912676
      }
    ],
    "prob": 0.99,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9900000095367432,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T13:27:17Z"
  },
  "path": "00c683daa732a0f64c8601e5c6ba8e006f84f9ed24180dea224f05c72d27baed.iso",
  "raw": {
    "v": "8",
    "rev": "3fe0e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^{nk7Y\u003ef!\u003eQyh8vfKgb7Esp^^+}arR^HarR^HarR^b000000000a0rr91009Ab000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c!UR2rAh20SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao",
            "n": [
              {
                "c": 5,
                "d": "ISO .NET reflection resource loader",
                "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader",
                "o": 32769,
                "z": 5,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 32641
          },
          {
            "b": "1q+f*f-RgR0^=T400A(pf:mXcve{oidK\u003eSsspblrgl-KYe06-h\u0026]HvA=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lga\u003emkfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00961009610bbqR",
            "n": [
              {
                "c": 3,
                "d": ".NET ResourceReader reference in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-reader",
                "o": 72356,
                "z": 24,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 72292
          },
          {
            "b": "XXoG19O(wr:ECwN/yrVA]:yfv}Aco)ExQmm7P/AO@t#\u0026WIP7-Bp#hAQrlPIt]%jrcD-}R6WGWtG\u0026Gyqn8cnduLN1FLK%fOL5aNVO\u0026^TthQb/{PP\u003c\u003e/0VeH(nscoYyDE[RY!au\u0026\u003eVeH(6hw9{zz4Q6U\u0026GsBWrGWsZlq{Gy0rrc2000003\u0026*ncB$$W7e\u0026tswgb/gk000c4u\u0026Qfbjp}L[byPQ)OdL-3A18^Ebu5Y8x(mN8000003)bDH5c8Xgbs+:9l\u0026Wh!93kdXoA+y@bsli+vGlxd000000SSi3r#g]B2)QCg0qVZL02tLm0rr91t(T\u003c89SMfugxmyPv/MGeirf3V2MK\u00268KPkvY5c8Xg9rl6t2lj-70@@r30rr911onA40SSi24fcwd0SSi2000Ph0rr91000i6HYx^x1]%!^lJvq\u003cT]H/?1]#1glJvq\u003cYz$q01]#KvlJvq\u003c:n!Nc1]#)F*w?AT{5J?E4GMCc2ltqm",
            "n": [
              {
                "c": 5,
                "d": "ISO stages a .NET resource payload",
                "i": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager",
                "o": 533580,
                "z": 4,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 533452
          },
          {
            "b": "A@XTLwO#PXvqYQ(wPv=xl${ZYz/Yt@y?iPnzE=KPq/)4\u003evqOCTv}xR3x(v\u003e?q*ACawO\u003c4\u003epxjsnA+eV@07?6If/x26zGEV\u002607?6Ihz+z9zGFY%ASw\u003cMBw)s3AbP=swN[kOv}xR3x(v\u003e?pHX6Iv@}YpB8$]fvR*q\u0026q*ACawO\u003c4$wOb:\u0026v@#B6zu8$zB7Gh$y\u003cwx^ze-{3C%MK]A+P09By+CrB8$]fvR*rTwPIv4x(Ffdz/d\u003c.BAh88B-.f{l349UzdmsbmRMWIr+lq)x(v(PBAzLqvS=^706$WEwO\u003e))C$}^+wDk2qB7Gh$y\u003cw\u0026$z!a02Bu$1\u003cA+P09By+Csx(mD)ASwBuzE^E0xguYCxla5EwO\u003e)/A.gdXzVAHyBzbP6lsB}D07gWwAa%b%BzkVhqE%VMCWUYdz/fRZBAzLqvS=^708[e:By/qwqGV(0x(dAllVl*Xx(4v3q!o#)x\u003e7Z}08^@SBzkP6lVl*Xvrui)x(4H9C%MK]A+P09By+CJB-qquwPI]:y?c%}z9-n=A+P09By+",
            "n": [
              {
                "c": 3,
                "d": ".NET AssemblyCompanyAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-attr",
                "o": 538841,
                "z": 24,
                "cf": 0.9599999785423279
              },
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 538823,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 538695
          },
          {
            "b": "BydyKx\u003eqg7q!ZL?0axzGuRCxDwb]5ovpB4:r+VR$vqF\u003e:D2d5k08)DJlVl*Xvrui)y?lNSCYV?{zE^s0x(mMKwObv[y\u0026/UPB-4gGA=k!Yvrl0rg/FHpx(mL-xjVf(lV)A\u0026wO#PTz/5]%zu9vGvpPvdwPQ)%AaK7\u003cnP5Y\u0026yH{jKzdm6%090(7xKL{EA=LPl08[2HB98CpzF5@Gz+j?*gCO}@AbYxawb]OEq/)4]zF5@twPQTPzFrY]B97q\u003eB8Mhwv}wOXA+eV@0cqZ[uR\u003eVZx([6czu9grBw)p4x(mL-nP5SYA=7\u003ePwNPaoD30P$qE%oE07gNvB7Ctry\u0026r*0lVl{?0n1t{8hQ@:lgW$pxA@H{yxaTHDr:F*g#Kh@US(GA5.djH0Tn]kaoqGG10vNA10vNB10vNH10vN-2oT0Y5)LCy1rWWSr0iyrFOth\u003c5]vZP5?9[!5Fb0F4GV?o0%Pud0%Pxr0%P+Q1rWWR5cTfS0tb\u003eBaoh(OaoqGM1rWZC0T6RC5L96F0rA^61rWWSrrTGC0tnxqaozM-5}KD}aozM-5]!d00S:nNFro{r5?0?Z009f4015/d00iu8",
            "n": [
              {
                "c": 3,
                "d": ".NET Base64 decoder reference in ISO",
                "i": "metadata/file/format/iso::iso-dotnet-base64-decoder",
                "o": 541334,
                "z": 16,
                "cf": 0.9399999976158142
              },
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 541383,
                "z": 12,
                "cf": 0.9399999976158142
              },
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 541442,
                "z": 25,
                "cf": 0.949999988079071
              }
            ],
            "ln": 541255
          }
        ],
        "mol": "O₂(AsC)Md",
        "sha": "00c683daa732a0f64c8601e5c6ba8e006f84f9ed24180dea224f05c72d27baed",
        "path": "00c683daa732a0f64c8601e5c6ba8e006f84f9ed24180dea224f05c72d27baed.iso",
        "risk": 239,
        "size": 544768,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 544768.0,
              "entropy": 7.54,
              "size_bytes": 544768.0
            },
            "binary": {
              "overall_entropy": 7.54,
              "peak_region_bytes": 459776.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                541442,
                25
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-metadata-sig",
            "conf": 0.9700000286102295,
            "crit": 3,
            "desc": ".NET metadata signature string in ISO content",
            "spans": [
              [
                533580,
                4
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                538823,
                17
              ],
              [
                541383,
                12
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::primary-volume-descriptor",
            "conf": 1.0,
            "crit": 2,
            "desc": "ISO-9660 primary volume descriptor marker",
            "spans": [
              [
                32769,
                5
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-base64-decoder",
            "atk": "T1140",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET Base64 decoder reference in ISO",
            "spans": [
              [
                541334,
                16
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-reader",
            "atk": "T1027.009",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET ResourceReader reference in opaque content",
            "spans": [
              [
                72356,
                24
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyCompanyAttribute marker",
            "spans": [
              [
                538841,
                24
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader",
            "atk": "T1027,T1140,T1620",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO .NET reflection resource loader",
            "spans": [
              [
                32769,
                5
              ],
              [
                533580,
                4
              ],
              [
                538823,
                17
              ],
              [
                541383,
                12
              ],
              [
                541442,
                25
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager",
            "atk": "T1027,T1140,T1620",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO stages a .NET resource payload",
            "spans": [
              [
                32769,
                5
              ],
              [
                533580,
                4
              ],
              [
                538823,
                17
              ],
              [
                538841,
                24
              ],
              [
                541383,
                12
              ],
              [
                541442,
                25
              ]
            ]
          }
        ]
      }
    ]
  }
}