{ "llm": { "conf": 0.85, "grade": "hostile", "model": "Qwen/Qwen3.6-27B", "outcome": "hostile", "interpretation": "Bumblebee malware packer detected" }, "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 1, "raw": 0.9989225, "rte": "az", "prob": 0.9989225 } ], "prob": 0.85, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.8500000238418579, "type": "iso" } ], "version": "v18.18", "analyzed_at": "2026-08-01T15:42:48Z" }, "path": "0e063c8d1f54b6002d4483ac2e7a254e26f62bedcf43784cd183bf0c209b55f8.iso", "raw": { "v": "8", "rev": "9cc7c", "files": [ { "id": 0, "ctx": [ { "b": "ndR]KnR@Ni0rr9\u003cI\u0026li*004}tc\u0026%wGnq\u003eMu(CCKX0o\u003caP@@kJEI.Cei07+eCXC=EcngROG0F86?002MFGe-(i07.V\u003e7Y\u003cWq1\u003c3-znq\u003eIVI^dIYnq?pfi7O%HbTs[M-2@B8+/[p4IcIqirArf!r6:IIrZx!TJCG([np*ci00030748+o0j%uT001?6nq\u003eLSI]kMf^?z=Zm2O@s^NYqqnqNIK!cMcsxA4]goP86b!cMb^XI\u003cG*gR=XvEhtFiM=Gdb0f6QInR@Hw0@@r?Jy1QVIhde]002ADqL)fBZEOCb07\u003ej^c\u0026%wG.-4L}nYMP61onD2hVJ?H:a\u003e=s000-[002-IZC2V*08nr+?#-@VnYKsz^(dmbo]lTy0rr9]InelP002-IZT@L!08nr+\u003eMg.:o]lRA0rr9=:a{(5000310075dz#zP{0eTZ1m2s}j:3{1yh#\u0026%0msUa(002Azrs:{P}?Xto:3*yihVJ\u0026mmfyO0{z2T/0eQ", "n": [ { "c": 5, "d": "Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic.", "i": "third_party/CHECK/POINT/Malware/Bumblebee/Packed", "o": 804645, "z": 10, "cf": 0.8999999761581421 } ], "ln": 804517 }, { "b": "Mx42\u003eMZ\u003cekQ)WsiK^Ik(Y{CKUJ*2V^NvoIcKDtG-KDtQrM+w(TKDD63Y]!tsM86+aOr5$#Kb/-(J*t^5KD\u003e@}MyKkbKEIM4J/Yo!Kc2([L:mS7K=tP^N3\u003cwcN3\u0026$@MzysvKD\u003e({KDt^7Nui(5Kc=l1M%#eqNVsh9M64e{M6WM0J*(D4M6)Y2Or/I5JHD2)L8UM+Oq\u0026R(JH2P(MxvoxN46qfKEhz@KDb:0J*=2%Kc#euKD#w@vWio?O0fqfM7ab4J*#P6KE88[J*D94NvxIfMYNq\u0026N#\u0026\u003e]O1b$pOskP", "n": [ { "c": 3, "d": "Encoded payload detected: xor", "i": "metadata/encoded-payload/xor", "o": 962150, "z": 43, "cf": 0.8999999761581421 } ], "ln": 962086 }, { "b": "K?EcCNu%thMZi\u003eBJ*kV\u003cO0oq6M.ZdnY{k82Nv652J*bS=N3KhgJG)$mKcWFDKE88)Mx^JbN2)P2N3Ro}Or/h4Nt)-0Myje4Lz$#(KDtD-LA8b#JHb/[N2^w%N#\u0026.]N2!}CL:)(8JGo6VOrYRhKcck#K^h5%KDt\u003c0KDkV!L9Rx0NWxOaMZ:7CM5?D8Y{$jJMyA]8Kc=k[M6N@bQ)vKpvVW7HNuS![NW5#8Q)NvkKdqL#KD2-%KcL@%MZA@aKDbD!Mx^=5NvGLgO0YUcLARn)LBN+%LAy(*MYNU$JHDh$", "n": [ { "c": 3, "d": "Encoded payload detected: xor", "i": "metadata/encoded-payload/xor", "o": 980229, "z": 44, "cf": 0.8999999761581421 } ], "ln": 980165 }, { "b": "J/YM!My0!%KDk]%Kc+(*O0]w7Q(H$9NuK51Kg*QoKDkG\u003cLA8f6Y{UyLQ(ZX4LAp(\u0026MZ+WTM.Y+jJG]^xOroh9Kd8C@K^RJ7KDt@[L-Q#*KD#l2NW/\u003ecM5?2/Q(R4oMx#6DMxw\u003eFY{B}LM6NI%N3KniOrf24O1bO4O0PkbN2WV6J*ue@KERDeKDt#(MZr-4N7XGuO0xa%MZ0/8J/PSrMxde\u0026Kb]V\u0026N2O!BN3A.$Y{LpVOre\u00262vVVXvM6N(8Q)dpiJ*C=}MYWP2Q)NjiNVASBKDDuaOrdiHJ/B", "n": [ { "c": 3, "d": "Encoded payload detected: xor", "i": "metadata/encoded-payload/xor", "o": 986613, "z": 38, "cf": 0.8999999761581421 } ], "ln": 986549 }, { "b": "Nu9O@Kb]QuNVTzoKDt\u0026@KEhe)M+w(JQ(?acJ*WOHQ)4dbLAzq@M5}t]KDtM]KDtV}MystlKEID6Q(ZXKKc2([LB4P9Kc#J0Or]z7MyB1#My129KD(b%N2^t(J/Y=]J*DcDKdqq[KDkG+LBEV2MYN-0J*(k@M7a29Or/IhOskO2K^Rq)J/Po.K=$/)Mx40sMY)A0KDtM(KEhA4L9}PhMZKUqMZjbaL988]KDk\u003c0KD\u003cppKDtM\u003eJ/PV\u003eJ*C-*M79\u003e}J/Yr:LAq2}LAIA9J*=z%M7jtkOsk.bL:XzzM6)-7Ob", "n": [ { "c": 3, "d": "Encoded payload detected: xor", "i": "metadata/encoded-payload/xor", "o": 986934, "z": 45, "cf": 0.8999999761581421 } ], "ln": 986870 }, { "b": "K=+-!J/Y=)KDCP\u0026NWfthKc#8%MZi-5L8#2)L:)=6Mxvn\u003cK=+-!KdhJ3NVAF*K=T4tKDt#@KEh8?MYvIzK=+=/MZ9V2K^}=0L:WR@MZ:q5N4fw8KDtS=Mysk6OstRNL-RnwM7jwiLA7%0Y{+4zMZIrFY]XRKMyahdKD\u003e\u0026]N2)z\u003cK=V5{N3Tb2Y{$gKMx[55Kb]M)N3\u003czkKDC](M64G3N3Kk9Kd8I$Nu-\u003e}K!!82LBdV6Mssr.KFFndJ\u003eH:tKE8G0vW-QUKEqt]J/GJ]NVA/9M70-4vWi1oKDt=#KDveoJ/PD)M79(9NVJ]2M5}/dQ))\u003cxL9q5?M6^=8O0]X8L:X8dM6W\u00263KDbu+J/YJ(L:XbrJ*=5\u003eKEIR$Q)WTpNWYI9KdhLDMYvJ2vVV(", "n": [ { "c": 3, "d": "Encoded payload detected: xor", "i": "metadata/encoded-payload/xor", "o": 991502, "z": 41, "cf": 0.8999999761581421 } ], "ln": 991438 }, { "b": "K=C{ANu9z\u003eN.s/FJ*(D2MYNYavV=$zY]XtoJ??+#Q(Q?gM5.8%N3rR)KDuo1NVr]1MyLTIN2^S7M6EVGMYNJ6MZT24J/Gi.KEhJ0OrP87N3A\u003e@KDtM=N2)z\u003eNu%n5Ore\u0026CMyj2aJH2V[MxNS6L47kLKDu02KEhb$Mx)(8Kg*{GKc2D+LAR8?NWYRkM13eHNVJ/2O0xtcM.Y.7NWGm#L8$#\u003cY}*:KL8+M?M6W]dKEI-3KdhPdL-Ii3O1bO7J/Gx\u0026K^\u0026elJ*(k{NvGLgKb]J!KD#2\u003cJ*C(]Nui\u00264KDtJ)LM", "n": [ { "c": 3, "d": "Encoded payload detected: xor", "i": "metadata/encoded-payload/xor", "o": 995304, "z": 45, "cf": 0.8999999761581421 } ], "ln": 995240 }, { "b": "KcD2(Orw#2Y{s[AJ/PA(M6).]Os2IbMysmKNVSX(MyK4#KD\u003cpvL9IC{Y{$QWJ*%NGKDveKMyJ@FMyjkrJ/GP]Lam(0MYNk$M6WI)KD#e[KDt-(J/GG\u003cM7ab6NVJO}KeeOpY{UvWJHt/*K=%mzQ)NBpvVDXjM6).$Q(H$aN2)V4MTVwJKb/r-KDVG4KDVf1LBw2eKcMf2MZi]IMx4q(MyJ}%J\u003eHK/N3iR[KcVq#M7ahPK^qo1J*t@\u003cKDCP?MYEF#NVS!]KD\u003e]@Lam(2Lad[HMyJ$%Kc(AbKeekiMst%", "n": [ { "c": 3, "d": "Encoded payload detected: xor", "i": "metadata/encoded-payload/xor", "o": 1000290, "z": 43, "cf": 0.8999999761581421 } ], "ln": 1000226 } ], "mol": "MdTh", "sha": "0e063c8d1f54b6002d4483ac2e7a254e26f62bedcf43784cd183bf0c209b55f8", "path": "0e063c8d1f54b6002d4483ac2e7a254e26f62bedcf43784cd183bf0c209b55f8.iso", "risk": 109, "size": 2883584, "type": "iso", "facts": { "metrics": { "file": { "size": 2883584.0, "entropy": 4.17, "size_bytes": 2883584.0 }, "binary": { "overall_entropy": 4.17, "peak_region_bytes": 27648.0, "peak_region_entropy": 7.81 } } }, "traits": [ { "id": "metadata/encoded-payload/xor", "conf": 0.8999999761581421, "crit": 3, "desc": "Encoded payload detected: xor", "spans": [ [ 962150, 43 ], [ 980229, 44 ], [ 986613, 38 ], [ 986934, 45 ], [ 991502, 41 ], [ 991583, 42 ], [ 995304, 45 ], [ 1000290, 43 ] ] }, { "id": "third_party/CHECK/POINT/Malware/Bumblebee/Packed", "conf": 0.8999999761581421, "crit": 5, "desc": "Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic.", "spans": [ [ 804645, 10 ] ] } ] } ] } }