{
  "llm": {
    "conf": 0.9998243,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "RAR contains HTA lure document"
  },
  "ml": {
    "v": "7",
    "eng": "2.3.0-beta.1",
    "lvl": 0,
    "conf": 100,
    "mods": [
      {
        "cls": 2,
        "raw": 0.999749,
        "rte": "az",
        "prob": 0.999749
      }
    ],
    "prob": 0.999749,
    "files": [
      {
        "id": 0,
        "lvl": 0,
        "conf": 100,
        "prob": 0.9997490048408508,
        "type": "rar"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-25T13:00:17Z"
  },
  "path": "0eaf5839296cac7542202494914072b08123ffffe145f3522ca607712e90e42f.rar",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "qEKO?8v3oy:{OSq3\u0026{Iq00-J9FpJf209kEzY*-593.A=pFb/.EHL{Y-arW$Xm$r8\u0026bUR][ByuqhA=kGhyJNF2CpT\u003eLz!abonk*TBavPpdf!NcYvg08r}7LPgk[\u00265P=h%ByfLiZeg^*?grQUDRGp}i8WIcVA\u00267[$DjPNE\u0026x/syl",
            "n": [
              {
                "c": 5,
                "d": "Tiny high-entropy RAR carries an HTA",
                "i": "objectives/anti-static/pack/archive::rar-tiny-compressed-hta",
                "o": 85,
                "z": 11,
                "cf": 0.9700000286102295
              },
              {
                "c": 5,
                "d": "RAR ships customs-document HTA lure",
                "i": "objectives/command-and-control/dropper/delivery/document::rar-customs-hta-document-lure",
                "o": 0,
                "z": 23,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)H(Db)",
        "sha": "0eaf5839296cac7542202494914072b08123ffffe145f3522ca607712e90e42f",
        "path": "/tmp/cyclotron-4d01bfa8/samples/0eaf5839296c/0eaf5839296cac7542202494914072b08123ffffe145f3522ca607712e90e42f.rar",
        "risk": 273,
        "size": 3338,
        "type": "rar",
        "facts": {
          "metrics": {
            "file": {
              "size": 3338.0,
              "entropy": 7.82,
              "size_bytes": 3338.0
            },
            "binary": {
              "overall_entropy": 7.82,
              "peak_region_bytes": 3072.0,
              "peak_region_entropy": 7.75
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/data/archive/rar::customs-eur1-hta-member",
            "conf": 0.949999988079071,
            "crit": 4,
            "desc": "RAR HTA member references EUR1 customs form",
            "spans": [
              [
                81,
                23
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/archive/rar::hta-member-extension",
            "conf": 0.9200000166893005,
            "crit": 3,
            "desc": "RAR member contains HTA extension",
            "spans": [
              [
                85,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/archive/rar::customs-hs-hta-member",
            "conf": 0.9300000071525574,
            "crit": 4,
            "desc": "RAR HTA member references HS customs codes",
            "spans": [
              [
                76,
                20
              ]
            ]
          },
          {
            "id": "metadata/file/magic/identity::rar-v5",
            "conf": 1.0,
            "crit": 2,
            "desc": "RAR v5 archive magic",
            "spans": [
              [
                0,
                23
              ]
            ]
          },
          {
            "id": "objectives/anti-static/pack/archive::tiny-high-entropy-rar",
            "atk": "T1027.002",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Tiny high-entropy RAR container",
            "spans": [
              [
                0,
                23
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/document::rar-customs-hta-document-lure",
            "atk": "T1204.002,T1027.002",
            "conf": 0.9800000190734863,
            "crit": 5,
            "desc": "RAR ships customs-document HTA lure",
            "spans": [
              [
                0,
                23
              ],
              [
                76,
                20
              ],
              [
                81,
                23
              ],
              [
                85,
                11
              ]
            ]
          },
          {
            "id": "objectives/anti-static/pack/archive::rar-tiny-compressed-hta",
            "atk": "T1027.002",
            "conf": 0.9700000286102295,
            "crit": 5,
            "desc": "Tiny high-entropy RAR carries an HTA",
            "spans": [
              [
                0,
                23
              ],
              [
                85,
                11
              ]
            ]
          }
        ]
      }
    ]
  }
}