{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 0.9988067746162415 } ], "prob": 1.0, "skip": [ { "m": "az/docx", "why": "uncalibrated" } ], "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.9380215, "class": 0 }, { "m": "az/documents", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 0.9988068, "analyzed_at": "2026-05-31T10:25:21Z" }, "path": "05b56c3455a5616745dfb45a396e8202fdb6f078afda4b72c3a157837c25b481.doc", "raw": { "v": "5", "fs": [ { "f": "O(C)Md", "x": 42, "ff": { "m": { "file": { "size": 564233.0, "entropy": 7.99, "size_bytes": 564233.0 }, "office": { "embedded_count": 1.0, "ooxml.entry_count": 14.0, "ooxml.max_entry_size": 518144.0, "ooxml.image_part_count": 2.0, "embedded_executable_count": 1.0, "ooxml.embedded_part_count": 1.0, "is_macro_enabled_extension": 0.0 }, "archive": { "file_count": 14.0, "member_count": 14.0, "script_count": 0.0, "zip_bomb_ratio": 7.92, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 560773.0, "compression.ratio": 0.91, "hidden_file_count": 1.0, "total_uncompressed": 614206.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 30.0, "rtlo_filename_count": 0.0, "format.regular_count": 14.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.07, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 14.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 13.0 } }, "v": { "file.stem": "05b56c3455a5616745dfb45a396e8202fdb6f078afda4b72c3a157837c25b481", "office.kind": "docx", "file.basename": "05b56c3455a5616745dfb45a396e8202fdb6f078afda4b72c3a157837c25b481.doc", "office.created": "2020-04-27T07:10:00Z", "office.creator": "hp", "office.modified": "2020-04-27T07:13:00Z", "office.revision": "2", "office.application": "Microsoft Office Word", "office.features[0]": "ole_objects", "archive.format.kind": "zip", "archive.members[0].path": "[Content_Types].xml", "archive.members[1].path": "_rels/.rels", "archive.members[2].path": "word/_rels/document.xml.rels", "archive.members[3].path": "word/document.xml", "archive.members[4].path": "word/media/image1.png", "archive.members[5].path": "word/embeddings/oleObject1.bin", "archive.members[6].path": "word/theme/theme1.xml", "archive.members[7].path": "word/media/image2.emf", "archive.members[8].path": "word/settings.xml", "archive.members[9].path": "word/fontTable.xml", "office.embedded[0].kind": "ole2", "office.last_modified_by": "hp", "archive.members[0].crc32": 439669760, "archive.members[10].path": "word/webSettings.xml", "archive.members[11].path": "docProps/app.xml", "archive.members[12].path": "word/styles.xml", "archive.members[13].path": "docProps/core.xml", "archive.members[1].crc32": 3071971614, "archive.members[2].crc32": 3786106977, "archive.members[3].crc32": 2531182092, "archive.members[4].crc32": 2286958260, "archive.members[5].crc32": 513123071, "archive.members[6].crc32": 3803035030, "archive.members[7].crc32": 2874622395, "archive.members[8].crc32": 4064858464, "archive.members[9].crc32": 2672462878, "archive.timing.mtime_max": 315532800, "archive.timing.mtime_min": 315532800, "archive.members[10].crc32": 2458572874, "archive.members[11].crc32": 1501618630, "archive.members[12].crc32": 3894599584, "archive.members[13].crc32": 572348907, "office.embedded[0].source": "word/document.xml", "office.embedded[0].filename": "word/embeddings/oleObject1.bin", "archive.format.entry_types[0]": "regular", "archive.members[0].entry_type": "regular", "archive.members[0].mtime_unix": 315532800, "archive.members[0].size_bytes": 1510, "archive.members[1].entry_type": "regular", "archive.members[1].mtime_unix": 315532800, "archive.members[1].size_bytes": 590, "archive.members[2].entry_type": "regular", "archive.members[2].mtime_unix": 315532800, "archive.members[2].size_bytes": 1226, "archive.members[3].entry_type": "regular", "archive.members[3].mtime_unix": 315532800, "archive.members[3].size_bytes": 3213, "archive.members[4].entry_type": "regular", "archive.members[4].mtime_unix": 315532800, "archive.members[4].size_bytes": 56818, "archive.members[5].entry_type": "regular", "archive.members[5].mtime_unix": 315532800, "archive.members[5].size_bytes": 518144, "archive.members[6].entry_type": "regular", "archive.members[6].mtime_unix": 315532800, "archive.members[6].size_bytes": 6992, "archive.members[7].entry_type": "regular", "archive.members[7].mtime_unix": 315532800, "archive.members[7].size_bytes": 5480, "archive.members[8].entry_type": "regular", "archive.members[8].mtime_unix": 315532800, "archive.members[8].size_bytes": 1650, "archive.members[9].entry_type": "regular", "archive.members[9].mtime_unix": 315532800, "archive.members[9].size_bytes": 1296, "office.embedded[0].size_bytes": 518144, "archive.compression.methods[0]": "deflate", "archive.compression.methods[1]": "stored", "archive.members[0].data_offset": 569, "archive.members[10].entry_type": "regular", "archive.members[10].mtime_unix": 315532800, "archive.members[10].size_bytes": 260, "archive.members[11].entry_type": "regular", "archive.members[11].mtime_unix": 315532800, "archive.members[11].size_bytes": 706, "archive.members[12].entry_type": "regular", "archive.members[12].mtime_unix": 315532800, "archive.members[12].size_bytes": 15590, "archive.members[13].entry_type": "regular", "archive.members[13].mtime_unix": 315532800, "archive.members[13].size_bytes": 731, "archive.members[1].data_offset": 1528, "archive.members[2].data_offset": 2093, "archive.members[3].data_offset": 2447, "archive.members[4].data_offset": 3789, "archive.members[5].data_offset": 60667, "archive.members[6].data_offset": 555537, "archive.members[7].data_offset": 557274, "archive.members[8].data_offset": 558481, "archive.members[9].data_offset": 559265, "archive.members[10].data_offset": 559736, "archive.members[11].data_offset": 560233, "archive.members[12].data_offset": 560647, "archive.members[13].data_offset": 562927, "archive.members[1].header_offset": 967, "archive.members[2].header_offset": 1771, "archive.members[3].header_offset": 2400, "archive.members[4].header_offset": 3738, "archive.members[5].header_offset": 60607, "archive.members[6].header_offset": 555486, "archive.members[7].header_offset": 557223, "archive.members[8].header_offset": 558434, "archive.members[9].header_offset": 559217, "archive.members[10].header_offset": 559686, "archive.members[11].header_offset": 559923, "archive.members[12].header_offset": 560602, "archive.members[13].header_offset": 562616, "archive.members[0].compressed_size": 398, "archive.members[1].compressed_size": 243, "archive.members[2].compressed_size": 307, "archive.members[3].compressed_size": 1291, "archive.members[4].compressed_size": 56818, "archive.members[5].compressed_size": 494819, "archive.members[6].compressed_size": 1686, "archive.members[7].compressed_size": 1160, "archive.members[8].compressed_size": 736, "archive.members[9].compressed_size": 421, "archive.members[10].compressed_size": 187, "archive.members[11].compressed_size": 369, "archive.members[12].compressed_size": 1969, "archive.members[13].compressed_size": 369, "office.embedded[0].relationship_type": "oleObject", "archive.members[0].compression_method": "deflate", "archive.members[1].compression_method": "deflate", "archive.members[2].compression_method": "deflate", "archive.members[3].compression_method": "deflate", "archive.members[4].compression_method": "stored", "archive.members[5].compression_method": "deflate", "archive.members[6].compression_method": "deflate", "archive.members[7].compression_method": "deflate", "archive.members[8].compression_method": "deflate", "archive.members[9].compression_method": "deflate", "archive.members[10].compression_method": "deflate", "archive.members[11].compression_method": "deflate", "archive.members[12].compression_method": "deflate", "archive.members[13].compression_method": "deflate", "archive.members[0].central_header_offset": 563296, "archive.members[1].central_header_offset": 563361, "archive.members[2].central_header_offset": 563418, "archive.members[3].central_header_offset": 563492, "archive.members[4].central_header_offset": 563555, "archive.members[5].central_header_offset": 563622, "archive.members[6].central_header_offset": 563698, "archive.members[7].central_header_offset": 563765, "archive.members[8].central_header_offset": 563832, "archive.members[9].central_header_offset": 563895, "archive.members[10].central_header_offset": 563959, "archive.members[11].central_header_offset": 564025, "archive.members[12].central_header_offset": 564087, "archive.members[13].central_header_offset": 564148 }, "id": "docx" }, "id": 0, "sz": 564233, "ts": [ { "a": "T1027.006", "c": 0.949999988079071, "d": "Embedded executable in OOXML entry: word/embeddings/oleObject1.bin", "i": "objectives/command-and-control/dropper/payload::embedded-executable", "l": 3 }, { "c": 0.9700000286102295, "d": "Embedded OLE object part", "e": [ "word/embeddings/oleObject1.bin" ], "i": "metadata/document/office/markup::ooxml-embedded-ole-part", "l": 2 }, { "a": "T1036.005", "c": 1.0, "d": "File extension claims OleDoc but content is Ooxml", "e": [ "expected=OleDoc, actual=Ooxml" ], "i": "metadata/file-extension-mismatch", "l": 4 } ], "sha": "05b56c3455a5616745dfb45a396e8202fdb6f078afda4b72c3a157837c25b481", "path": "05b56c3455a5616745dfb45a396e8202fdb6f078afda4b72c3a157837c25b481.doc", "type": "docx" } ], "tv": "52045" } }