{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Reversed base64 encoded executable detected"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.9992392,
        "rte": "az",
        "prob": 0.9992392
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T09:00:08Z"
  },
  "path": "13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de.iso",
  "raw": {
    "v": "8",
    "rev": "696a6",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.m%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^{mn(\u0026UpF-eRarR^HarR^HarR^HarR^HarR^HarR^b00000000120SSi200lj400000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 volume identifier string",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "0003C0fvG!011.!CN1@+9wvP@00031009Eas4L\u003eXe\u003e5(hj23Zn000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 1,
                "d": "Executable filename marker in opaque content",
                "i": "metadata/file/format/structured::embedded-executable-member",
                "o": 587882,
                "z": 6,
                "cf": 0.949999988079071
              }
            ],
            "ln": 587850
          },
          {
            "b": "mGJVu\u003cobC!00066Ej26@1s:xK6efE/9SMfu5Dz!y00mG{0SSu9z}1**1#uL!11rml00T}O778L(1$xPMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn!vCRWbyPQ)k!v0@KyXy(bu5Y8x(mN800000=(-t?CV\u003e7EbumUxnp7vq5c8Xgbs+:9l\u0026Wh!sBg5G:uxO7bsli+vGlxd000000SSi3s0a\u003el2{fcE0qVZL02tLm",
            "n": [
              {
                "c": 3,
                "d": ".NET runtime marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
                "o": 691556,
                "z": 4,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 691492
          },
          {
            "b": "wb[]awb]eezE^M{o\u003ewx!vp%dUoMauIwN\u003e^ivqYQ(wLD-SB75Y)uSy#Wz^^f/wb]L0k@7qQo\u003c}{FxjUPNqFx(-wmo4=o\u003c}{FxjUPNvpS[QlUH4vyH}3zxKL^\u003ewN\u003e^JxKT!Uz/xScvru6/lUH4vyH}3zxKL^\u003ewN\u003e^JxKT\u003eJzdNM[wPzcBxK$W?wN[ewvqYZ?wb{aMvNj*Dz*b=6m}3mCB6?pFwN/H!wj73szF9J\u003e08c*zzEWuHA=k![m[3==",
            "n": [
              {
                "c": 3,
                "d": ".NET crypto marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-crypto-marker",
                "o": 740560,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 740496
          },
          {
            "b": "A=U@rwDk8aB7FoYzGxJlx)a4/qE%Y-C4yU%C6D@ge[Gos0cqZ[uSgV+wDkOIwP.M.x)Ks\u003cB7GD2ltQNIyG1}[wDl^.Byd\u003cMzE)Sso\u003e!Gzx)Ks\u003cB7GD2p*[lMy+!.0",
            "n": [
              {
                "c": 1,
                "d": "Executable filename marker in opaque content",
                "i": "metadata/file/format/structured::embedded-executable-member",
                "o": 749308,
                "z": 4,
                "cf": 0.949999988079071
              }
            ],
            "ln": 749276
          },
          {
            "b": "x(v\u003e?z/x5ZBZ/DkvpKy[z/bLNwN/*@z/bL@wPRoIx\u003eg^NwO+{/BzkVh0cqZ[uR29UwPyZXy?m9#x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9TRwO1RPwmXbDy\u00260V)BzkVh07?3oxjTCGy\u00260V)BzkVh07gglBAIRnlVl^SwN/*@z/bLvBAzLqvS=^7lVl^SwN/*@z/bLQvqH6$lVl^SwN/*@z/bLxz/fVqz!}^Vy\u00260V)BzkVh08d9FBxi9!Ct\u0026S[nPXJXlVl^SwD",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 753929,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 753865
          },
          {
            "b": "wPRoQvrlHlz/PwQxKL]Yl${WMv@#TfC#Fo[vrb^#z/OiUvr8u?wPRoJzE^r@Bvf.IASxDuvrlJTxKL]YnP5Y\u0026yH{jKzdm6%0aeSnzdNM[wPv=XxKT\u003eJzdNM[wPv=rz!%MkzB!tEwmY=Ysz.\u003eLwNPaXASx3WA+eV@qE%oEwPv=Mzerf.CYV?{vpS}\u002607*a2A=#ebwL^z=C4\u003eF#ASw*4ha8zfAcc1%wPz%dv}wFSz*2\u00269wPv=HBAh8kxf{-Py?d9$",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 756087,
                "z": 12,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 756023
          },
          {
            "b": "pJx#SASxDBwO#3BB.kk%ASxDAwN/p=C4B0.w[CQ{07g^rvru6SvpK7:Bu%!PmR)i*xHl\u0026Nw[t#.xjVf(qE%]/B-H#6o\u003c}{FxjV8-xjVf(p\u00267n!x(lTNzEEf?ASx--BydBIB8UMfv}YB]0aeVDz/w9UB8UMfv}YB]08EYIwPv=tvrcf#wPv=qvpK7=A=l8rwliX\u0026yH}I^nLJ=qB75Y)nmuyDy?mR!nL\u0026\u00269yH}PUvqYQ(wPv=DAcb/jzDpgZB.9{NvqYY",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 756383,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 756319
          },
          {
            "b": "D2N\u003etz/eiVC(QiIzGGr3zGwDZC(RF*BydEOv@=\u003clBw3g\u003c0cqZ[uQX\u003cxA^qRCoj-wGqE%GPB98CFoj-wGq*ACawO\u003c4#wN/\u003e6x([RMlVND\u003eBz\u003e/jvq][90b2\u003e+uQn:OwO\u003e))C(QuCBvyB=v%8)czF8mRB7Gh$y\u003cu1JwPQvUBAhT)B8$]fvR*q\u0026l1BIDwPI]ZvqPZ{C(RF*BydHQzGFuRze0*i0b2\u003e+uS7Dzwkv8VC(R[%Byd{SvpSeKy\u003cu1[wPRoJB5DNTwkv8VC(RhCwPI{3",
            "n": [
              {
                "c": 3,
                "d": ".NET crypto marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-crypto-marker",
                "o": 764830,
                "z": 28,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 764766
          },
          {
            "b": "kQ/w}x^=kidjvCDdjvCDdnIuSkQ!9DkQ!9DkQ!9DkQ!9DkQ!9DkQ!9DkQ!9DkQ!9DkQ!9DkQ!VZmTe]vc{Q3Dl}5H?kQ/UXkTl+DkTl+}qC/+ekTl+DkTl+DkTl+DkTl+DkTl+DkTl+DkTl+DkTl+DkTl+\u003coe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phREBkQ*!6kTl+Pxlv/yc{Q3Dc{Q3Dc{Q3Dc{Q3Dc{Q3Dxdc2gdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdjvCDdn.GUkQ!9DkQ!9DkQ!9DkQ!9DkQ!9D",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 854202,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 854074
          },
          {
            "b": "2MK\u0026800000006ew2MK\u0026E0000000000000000000000000005Vi2MK\u002680000000000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMBvQzua?WzVx+q00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 3,
                "d": ".NET runtime marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
                "o": 1124014,
                "z": 11,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 1123950
          }
        ],
        "mol": "MdTh",
        "sha": "13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de",
        "path": "13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de.iso",
        "risk": 109,
        "size": 1245184,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 1245184.0,
              "entropy": 4.15,
              "size_bytes": 1245184.0
            },
            "binary": {
              "overall_entropy": 4.15,
              "peak_region_bytes": 268288.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-crypto-marker",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET crypto marker in opaque content",
            "spans": [
              [
                740560,
                8
              ],
              [
                764830,
                28
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                753929,
                17
              ],
              [
                756087,
                12
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET runtime marker in opaque content",
            "spans": [
              [
                691556,
                4
              ],
              [
                1124014,
                11
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                756383,
                15
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                854202,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}