{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.995317816734314,
        "class": 1
      }
    ],
    "prob": 0.9953178,
    "skip": [
      {
        "m": "az/documents",
        "why": "uncalibrated"
      }
    ],
    "class": 1,
    "oprob": 0.9491693,
    "models": [
      {
        "m": "az",
        "prob": 0.9491693,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9953178,
      0.9991311
    ],
    "analyzed_at": "2026-05-02T15:47:56Z"
  },
  "path": "0ab17374c6c9b15bb191fff8168fdb1f14624b6fbd5836b9e1393fcf415e073b.xls",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md(Ag₂)",
        "x": 80,
        "id": 0,
        "sz": 784384,
        "ts": [
          {
            "a": "T1059.005",
            "c": 1.0,
            "d": "OLE2 document contains VBA macros (0 modules: )",
            "i": "metadata/format/macro::ole2-has-vba",
            "l": 4
          },
          {
            "c": 1.0,
            "d": "StdOleLink (external link) (CLSID: 00000300-0000-0000-c000-000000000046) on /MBD0015E784",
            "i": "metadata/format/clsid::dangerous-clsid",
            "l": 4
          }
        ],
        "sha": "0ab17374c6c9b15bb191fff8168fdb1f14624b6fbd5836b9e1393fcf415e073b",
        "path": "/data/samples/bad/datasets/MalwareBazaar/Bazaar.2026.03/HEUR-Trojan.OLE2.UrcBadur.genw-0ab17374c6c9b15bb191fff8168fdb1f14624b6fbd5836b9e1393fcf415e073b",
        "type": "xls"
      }
    ],
    "tv": "96b0e"
  }
}