{
  "llm": {
    "conf": 0.8,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "suspicious",
    "interpretation": "Obfuscated .NET binary with reflection"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 3000,
    "conf": 54,
    "mods": [
      {
        "cls": 0,
        "raw": 0.8058366,
        "rte": "az",
        "prob": 0.8058366
      }
    ],
    "prob": 0.8,
    "files": [
      {
        "id": 0,
        "lvl": 3000,
        "conf": 54,
        "prob": 0.800000011920929,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T01:25:00Z"
  },
  "path": "042a7c109c5b7465acba0dda0ef8b3bb8b5737085b7e1581ef164bca7f4426d7.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.m%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!9nj=SOnLR=.qBJ@wnL\u0026w[arR^HarR^HarR^HarR^b000000002P0SSi200p%R00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "A+P09By+CJD2[7sz7Xj\u003cvp%E@B98baA@XQtvS=r@x(mMTz!9B206$WEwO\u003e))C#OH1y?k[OBAh88B-.f{q*ACawO\u003c4$wOb:\u0026v@#B6zu9QSA+PA706$WEwO\u003e))C%(j+v@=p5BzkVhl3di?x\u003c#jbwDk2qB7Gh$y\u003cwx^zF0P}B-H]jx(v(PBAzLqvS=^706$WEwO\u003e))C%=H!Aa9Tfl3di?x\u003c#jbwDk2qB7Gh$y\u003cw\u0026$z!a02Bu$1\u003cA+P09By+CrB8$]fvR*rSzV",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 663163,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 663099
          },
          {
            "b": "rbUYSA+PA70b2\u003e+uR\u003e=Ywozy70b2\u003e+uQF:GAa9Tf07pKxAbP/e03znkl${ZYz/Yt@y?iPlz/6DizE)ZcqE%]/B-H#6o\u003c}{FxjV8-B7GD2lVl^-zeIZVB-8p3B7GD2l${7Cz!z%VB9hqv07pKfy\u0026r@:wPJ0gBo2lNDsW7PD2[7sz7Xj%vrVB6x8)0:Byd:JCXI2qzbUd{wDl^.Byd^KzdJYDwQ5q-z*jPSB7Ct)wPRoNB.(ely?W=#0cqZ[uSgV+wLE7",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 664787,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 664723
          },
          {
            "b": "vrDyd07y^lvR/QRx(!A9y/tC3y?mU/qGV\u003cSm)*8Mr6$\u003cfBAokrpJG$Bp\u0026**Xx(^[!BWGdesAu$jrc9i.l1t1JC42GhASx0GAbn@)wDkkiBx0K8wPE\u0026qAbXi-zddc@0b2\u003e+uQF%RA+fcgl#M{Jx(i]Az^^eRq/DL!Bo2u.zVA:Plv0V:0bL2C07]Q(0awlu0a!Jo07YF10bU8j07GsV0cHUN08V9:09hDX08k*}08[2HB98CpzF5@^B5-iRA@",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 671526,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 671462
          },
          {
            "b": "07O.=07!\u003eY0aNY-09g^g08Cp{0cicT09Bqz0d5YN090#EzGxAdA=1cVz!0L.rDy4#olh=!m00zHnon\u003eMm}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2!J@Ck$iQrrcMJB]V=dxAhdQC(QASzVANOBPuo1vGpj-l1BIDwPI[)woQ%^DsW7*y^z(Nz!0i$x(v(*D2Nr{w]7p:z//M2Bo29Ts].JyCMpS.k(+Otz2^QTx-IZly5*RwwNPW(mq=QQD2N\u003ezASyc3l\u0026.mGwb]OEli",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 675812,
                "z": 25,
                "cf": 0.949999988079071
              }
            ],
            "ln": 675748
          },
          {
            "b": "f-S{deDvKag5%6fg5%6feDvH9fAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvH9fAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvNbfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvNbfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003clE001F{\u003cu$8PzCdsimO{ku5{:JT000000000000000000080rrx",
            "n": [
              {
                "c": 4,
                "d": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.",
                "i": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor",
                "o": 919994,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 919898
          },
          {
            "b": "0020I4GDFe00000002==4GDFK0000000000000000000000000002oQ4GDFe00000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 3,
                "d": "Embedded .NET runtime string marker",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-string",
                "o": 1493070,
                "z": 11,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 1493006
          }
        ],
        "mol": "MdTh",
        "sha": "042a7c109c5b7465acba0dda0ef8b3bb8b5737085b7e1581ef164bca7f4426d7",
        "path": "042a7c109c5b7465acba0dda0ef8b3bb8b5737085b7e1581ef164bca7f4426d7.iso",
        "risk": 37,
        "size": 1507328,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 1507328.0,
              "entropy": 5.08,
              "size_bytes": 1507328.0
            },
            "binary": {
              "overall_entropy": 5.08,
              "peak_region_bytes": 559104.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                664787,
                15
              ],
              [
                675812,
                25
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-runtime-string",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "Embedded .NET runtime string marker",
            "spans": [
              [
                1493070,
                11
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                663163,
                17
              ],
              [
                671526,
                9
              ]
            ]
          },
          {
            "id": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.",
            "spans": [
              [
                919994,
                3
              ],
              [
                920046,
                3
              ],
              [
                920202,
                3
              ],
              [
                920254,
                3
              ]
            ]
          }
        ]
      }
    ]
  }
}