{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "skip": [
      {
        "m": "az/docx",
        "why": "uncalibrated"
      }
    ],
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.6687533,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-13T03:24:30Z"
  },
  "path": "03e56b984215231e6ab3196e5cccd41f88d4d0c9f21aa8c9c3fa5a5c526de8c1.doc",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Md",
        "k": {
          "core.created": "2021-08-30T16:15:00Z",
          "core.creator": "Dell",
          "core.modified": "2021-09-10T08:23:00Z",
          "core.application": "Microsoft Office Word",
          "embedded[0].filename": "word/embeddings/oleObject1.bin",
          "core.last_modified_by": "Dell"
        },
        "x": 42,
        "id": 0,
        "ms": {
          "file": {
            "size": 56967.0
          },
          "office": {
            "ooxml": {
              "entry_count": 15.0,
              "image_part_count": 1.0,
              "embedded_part_count": 1.0
            },
            "doc_type": "doc",
            "embedded_executable_count": 1.0
          }
        },
        "sz": 56967,
        "ts": [
          {
            "a": "T1027.006",
            "c": 0.949999988079071,
            "d": "Embedded executable in OOXML entry: word/embeddings/oleObject1.bin",
            "i": "objectives/command-and-control/dropper/payload::embedded-executable",
            "l": 3
          },
          {
            "c": 0.9700000286102295,
            "d": "Embedded OLE object part",
            "e": [
              "word/embeddings/oleObject1.bin"
            ],
            "i": "metadata/document/office/markup::ooxml-embedded-ole-part",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 1.0,
            "d": "File extension claims OleDoc but content is Ooxml",
            "e": [
              "expected=OleDoc, actual=Ooxml"
            ],
            "i": "metadata/file-extension-mismatch",
            "l": 4
          }
        ],
        "sha": "03e56b984215231e6ab3196e5cccd41f88d4d0c9f21aa8c9c3fa5a5c526de8c1",
        "path": "03e56b984215231e6ab3196e5cccd41f88d4d0c9f21aa8c9c3fa5a5c526de8c1.doc",
        "type": "docx"
      }
    ],
    "tv": "92e78"
  }
}