{
  "llm": {
    "conf": 0.8,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "suspicious",
    "interpretation": "Obfuscated .NET assembly in ISO"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 3000,
    "conf": 54,
    "mods": [
      {
        "cls": 0,
        "raw": 0.8403428,
        "rte": "az",
        "prob": 0.8403428
      }
    ],
    "prob": 0.8,
    "files": [
      {
        "id": 0,
        "lvl": 3000,
        "conf": 54,
        "prob": 0.800000011920929,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T12:31:00Z"
  },
  "path": "022ab6d6d30d4e85aa232a5724ff43f39aa1a1819e42569ef0d2be3fe9732c0d.iso",
  "raw": {
    "v": "8",
    "rev": "6052a",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!swN]v%aAIjgAbYJexcp-6v\u0026#)parR^HarR^HarR^b000000002V0rr9100h9W00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "l3di?x\u003c#jbwDkbfvS=r@vpB4:l3di?x\u003c#jbwDkUOB97#ge\u003c%zZxkRTeBzkla07pycB.tu3zF8WZwmY/Zl349Uzdmsbrb3C\u003cwKgAWA+P09By+CJD2[7sz7XZ$w]83*BzkVh08)#Wx(mL-l349Uzdmsbl$HBHA+PGmx(v(PBAzLqvS=^706$WEwO\u003e))C%=H/w[+[2A::67z/d\u003c.BAh88B-.f{l349UzdmsblVl*XvqZuRBAzLqvS=^706$WEwO\u003e))C#eK1wozy7l3di?x\u003c#jbwDk2qB7Gh$y\u003cwx^AcVFrxj#xMBAzLqvS=^706$WEwO\u003e))C#O/)wmYQ^A+^%.BAh88B-.f{lVl*xx(^#$y?k[OBAh88B-.f{q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#eb",
            "n": [
              {
                "c": 3,
                "d": ".NET AssemblyCompanyAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-attr",
                "o": 116268,
                "z": 24,
                "cf": 0.9599999785423279
              },
              {
                "c": 3,
                "d": ".NET AssemblyTitleAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
                "o": 116160,
                "z": 22,
                "cf": 0.9599999785423279
              },
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 116183,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 116096
          },
          {
            "b": "B7Gh$y\u003cu1UwPhD]v}tTcz/f-fA=.pJA=k!Yvrl0rg/FHpx(mL-oMauI07y:zBA)\u003cRwPQ)%AaG2GD2Nr{nP5Y\u0026yH{jKzdm6%077yqwnb{]mR(HCA@XKvzE^s00oH\u003eU\u003c+/+]InehfR%f[?\u003c*.CSP$QIEwPI^jA:@VPvqV6ywPI^jA:@VPvqYH^wPv=HD2[7sz7XZ$B8Mhwv}xYYA+frgB-H#6lV)i!B-I3[lV)i!B-I4+zF0!!q*ACawO\u003c4\u0026y\u0026r=\u003e",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 117473,
                "z": 12,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 117409
          },
          {
            "b": "08drtwk3YDA::0l0bDd^zE)Sug5$iFxHUQcf\u0026ysrm}D^sA=kCNwmPZ(B8}sXh+VLEn\u0026gS#09shPBy!o?z!0v1B4{j.z/Qa6w\u003e=/jBVj1\u0026h2{J=vpShPz!0v1B4{j.z/Qa6C$?Z)l%f",
            "n": [
              {
                "c": 1,
                "d": "GetProcAddress API-resolution reference",
                "i": "metadata/file/format/iso::iso-native-api-get-proc",
                "o": 119638,
                "z": 14,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 119606
          },
          {
            "b": "yYF2Dv/QPJx-J5Kzu8o?qug?tzua+Ux-I#IwDkB8zVBqFBPujTwDhYvz2^]yz#-oave$xHve{otw=MJByYF2DiSH/kf90T901?)8zVBnEve$xHx-J5Kzu6U)DJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003clE3uh*bzMBvrS?9\u003e.euBic0000000000000000000000\u0026P92MK\u0026",
            "n": [
              {
                "c": 4,
                "d": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.",
                "i": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor",
                "o": 124370,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 124274
          }
        ],
        "mol": "MdTh",
        "sha": "022ab6d6d30d4e85aa232a5724ff43f39aa1a1819e42569ef0d2be3fe9732c0d",
        "path": "022ab6d6d30d4e85aa232a5724ff43f39aa1a1819e42569ef0d2be3fe9732c0d.iso",
        "risk": 37,
        "size": 989184,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 989184.0,
              "entropy": 7.71,
              "size_bytes": 989184.0
            },
            "binary": {
              "overall_entropy": 7.71,
              "peak_region_bytes": 844800.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                116183,
                17
              ],
              [
                117473,
                12
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyCompanyAttribute marker",
            "spans": [
              [
                116268,
                24
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyTitleAttribute marker",
            "spans": [
              [
                116160,
                22
              ]
            ]
          },
          {
            "id": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.",
            "spans": [
              [
                124370,
                3
              ],
              [
                124422,
                3
              ],
              [
                124474,
                3
              ],
              [
                124526,
                3
              ]
            ]
          }
        ]
      }
    ]
  }
}