{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Known AgentTesla trojan detected"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.9979939,
        "rte": "az",
        "prob": 0.9979939
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T11:10:25Z"
  },
  "path": "06375f73417c1c3178952d4ceb43fcfab3d6ba37d27ba1957a5798299019f730.iso",
  "raw": {
    "v": "8",
    "rev": "935ec",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^#zGf2Hzddr\u003cB98trwGS\u0026*h-I{5arR^HarR^HarR^b000000002x0rr9100gmy00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "A=2lb0bVfBz2!\u003eZxAikRyYFx\u003c0b)e-z*8h1CMqU%0b(oCq*ACawO\u003c4/A::fazF5@vzdd6*lVuHMvrb)Hz/oy\u003es7#+\u0026mrSlWBApF\u003ey\u0026%p?xjVf(yHP?Mz!/t]wPRo{vN$AQyE@z.B-Zh)w]vV(B7GwFga)9NyYE]AxjVf(lU{EQvSbW}wjQSSyxeA!BydyKx)Ky(z*Dg0z*Dp3z*Dy6z*D0}z*Dv5z*DB7z*Dc#z*DH9z*DKaz2^7qBwca:ByGv)z^)hRz^)\u003e\u0026z^)$(z^)nTz^)kSz^)bPz*D6%z*DQcz*DTdz*Dj1z*DE8z^)}\u003ez^)I.z^)+/z^)tVz^)FZz^)O:z^)X^z^)qUz^)U=z^).!z^)CYz^)!*z^MESA+eV\u0026q/(C\u0026x\u003e7gLy\u0026%p?xjVf(m}D^lzGx]dzEWkTm}D^lzGx]dzEWkTz:XqXAbP/euTDxxB97\u0026dv}x1O090SLwNPaFvp\u003c7DvRPE:BwN0@C4\u003eF#A:QQ4zs4u70001rwD",
            "n": [
              {
                "c": 5,
                "i": "third_party/elastic/Windows_Trojan_AgentTesla/windows/trojan/agenttesla",
                "o": 820382,
                "z": 17,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 820254
          },
          {
            "b": "Aai-]A+4KJvqfPVzE[6m08)DDxAgzox(EK1vrb(UpgnlUC4B-?zE^Wf07gBdzF9J\u003emrSlWBo1)208)DJlU{EQB8#LzA+2eJvqH6$07y^nA^qRC08m3CB75Y)07pydA^qRC08N9BB9zLywjQcI)eWg!0047:z/Pv*xjVf(p*[A^Cw?IjnmuNM0b2\u003e+uR\u003efLB9zLywb{WZByd\u003cM3QsW)00030%nS91000000000c0SSi2qb.:YBy/qwl#(ZWx(mMmaxA5]B7]MgjV1=Be?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-zARC.gIeHRh!B^0whM5HgHQB/0000lq*ACawO\u003c4/A::fazF7N*x([i2z#/}s00CX#BytyQ0SSi22)gec01Pei001[V0006!o/r7N0000005:/S04m*E01Ybg01Ybg0096p00000000000k]uE0k]uE0000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 5,
                "i": "third_party/elastic/Windows_Trojan_AgentTesla/windows/trojan/agenttesla",
                "o": 823614,
                "z": 16,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 823486
          },
          {
            "b": "C42ifwDlvOByf09A=+(e0afhHzE^E0xg3PPw[+[2A::67z/eMDl\u0026Y-1x\u003ediJC42ifwNw^AuQngiz/]G8x)Kh%y?iPNxM4%l0afX-A=.p*B5L:juQngiz/]@tlVM:GwO#Q7vqH0Vz!9Y@08drtwjyPTzb1OUz/Qa6q/cR}l1szyB-8p*z/ff3xlwl6BzkVh07*a2A+Punpgn0J0cAH9wLMVJwDkqtx*#/MwDkbjv@#B6zEENhu[}ZQz^^eRw[=6)zEEL=q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVh077yqwk)FDD2Nr{vrlH3zdmZbC(S5awDkbfB7GxavqGU7vruj4zBe5PwmY=Yq!o#-vqGU7vruj4zBe5PwmYB%wb{p=ve%$^wDlyPve$H@wDl{\u003cwDl{\u003cwb{*{zua([ASyr0Bo3J5BPuS6v/Q7TBu%}WA@Y(=C(RI\u0026wDly.Bo2#[v/QgYB]Vh@Bo2#@v/Qg:B]Vh$C(RJ2wDq8#00000z#:M-B]T*HB7Gh$y\u003cu1VD2[7sz7XZ$w]83*BzkVh08^xHz!%PdmrP57009610rr90@@A910000001n]e002\u003e{D2[7sz7Xj%vrVB6xdLfawPz\u003caz/dY{e?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH}xDvLxPIhd!^Vf!)h@fKV+C1PXP602nBTB97#g",
            "n": [
              {
                "c": 5,
                "i": "third_party/elastic/Windows_Trojan_AgentTesla/windows/trojan/agenttesla",
                "o": 827272,
                "z": 24,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 827563,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 827144
          },
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000001pv}xgEvrb^[wPRH7A@Y\u0026:BydvGzE^E0xf*3qz/]@tlJv8^00000000000001vuTW$+xLzT7zF8)Tz/xm/xjVf(vpTK\u0026zEWl*p*[xMzdN*2A=Rk4wPRo/woIy8x\u003eg^}pgn0J0cqZ[uVp47C4\u003eF#A.Z4WwDlvOByeD%v}YO1x(mMZv@Dr$0cqYKxjVf(B7F\u003c7A+PSvp\u0026ZF^x(4tXB7GD2B7F\u003c7A+PSvp\u0026ZF^x(4tXxjVf(Ab](7B-Ra)wPh6#vru6Iz!@@}A-v6\u003cwDl^.ByffiwM9eVvrb^#wKZPOwmY^XA+e*6wPR$[xjVf(By/rdy*?A%p\u0026Zb*wPR$[B7GD2By/rdy*?A%p\u0026Zb*wPR$[xjVgbx(v(=A+fr6Bo2@+Byf96xkRd1B-I4\u0026A+fr6BAmC6wPRp2x\u003eIr(BAIRnp\u0026Zb+A@Y\u0026:Byf96xkRB3xglYFA^qRCx(v(=A+fr6Bo3w[Byf96xkRB3xglYFA^qRmwL3=fy\u0026r=\u003ey!]1YA::67z/fQ@B7GD2nP53OB.25PzBXIYvQT7GAaK5#BzkV4A:-/@By/Gl0ae6bzE^E0xf*3qz/]@tlVl\u003cOx\u003eINevruj4zuarXBydQSv@cqP0rr910a=dqAb](ux\u003eg^}pgn0J0afePv}YO1x(mMZv@Dr$0afeBC42n#wN[QBkMy/+00960%nJ9100000000Ae0000@q*ACawO\u003c4/A::fazF7Hyr+lq)x(r",
            "n": [
              {
                "c": 5,
                "i": "third_party/elastic/Windows_Trojan_AgentTesla/windows/trojan/agenttesla",
                "o": 829097,
                "z": 22,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 828969
          },
          {
            "b": "00000000000chTVwnb{]08)YBwPdSGx(dB407zcxwPh:9z/bLMwOkYS00000000000000007ZKownC/Sl1t1JC42GhASwEEwNPW(nP5P\u003evqYN^090SLwNP9Hq*ACawO\u003c50xLzN107QQxpHX6Iv@$:Wy\u0026%p?m}D^wD2Ns:A=k!=vqYQ(wDkRJzGGPfwMi}]wO\u003c[JzEEuFy\u0026r*008^xpwi$M-wDkRtvpPvJwPRoMwO#d5xAg+nBz7UGvr.=NAS",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 854697,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 854633
          },
          {
            "b": "zBF!WwPh:9z/bLHwPRQ7wjZVJzVAdEy\u0026\u003c/uwL3=KzVB.RAr5vtvr8uDBAh8kxf{-Py?d9$077yqwmY=YqE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!nKWJtzdN-@Bz(g1m}D^hzGP/cA::6dASv.4Bz(g1e[nykz/L?RD2[7sz7Xj\u003cvp%E@B98baA@Yc:B97#ge(D?fBzkP6e\u003eG@5wPzZdq!o#)x\u003e7Z}08[e:By/qwqGV(0x(dz",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 932872,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 932808
          }
        ],
        "mol": "MdTh",
        "sha": "06375f73417c1c3178952d4ceb43fcfab3d6ba37d27ba1957a5798299019f730",
        "path": "06375f73417c1c3178952d4ceb43fcfab3d6ba37d27ba1957a5798299019f730.iso",
        "risk": 109,
        "size": 940032,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 940032.0,
              "entropy": 4.91,
              "size_bytes": 940032.0
            },
            "binary": {
              "overall_entropy": 4.91,
              "peak_region_bytes": 3072.0,
              "peak_region_entropy": 7.83
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                827563,
                17
              ],
              [
                854697,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                932872,
                15
              ]
            ]
          },
          {
            "id": "third_party/elastic/Windows_Trojan_AgentTesla/windows/trojan/agenttesla",
            "conf": 0.8999999761581421,
            "crit": 5,
            "spans": [
              [
                820382,
                17
              ],
              [
                823614,
                16
              ],
              [
                823631,
                12
              ],
              [
                827272,
                24
              ],
              [
                829097,
                22
              ],
              [
                829155,
                18
              ],
              [
                829177,
                19
              ],
              [
                829331,
                20
              ]
            ]
          }
        ]
      }
    ]
  }
}