{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "AsyncRat malware detected in ISO"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.99834424,
        "rte": "az",
        "prob": 0.99834424
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T05:31:42Z"
  },
  "path": "17126bc9d8ea2be7a405c7ddb1a6ce5983a65f4ff506976ec446c9c7fd5920b9.iso",
  "raw": {
    "v": "8",
    "rev": "c0cd9",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!ape\u0026=vl}epwarR^HarR^HarR^HarR^HarR^HarR^b000000002(00000008V(00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "000000000000000000000000000000000000000008[e:By/qwq!oDYA+PSve\u003cTS4xK#76x\u003e7N[x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9=@fGzHiA==2cx)1I^CYWImB7]Mg0b2\u003e+uR:Q3wPz\u003caz/bLND2[7sz7XyQe\u003c\u003cL]Ab]JhB7]Mg06$Nyy?Wx/BzkVh0axOV0b2\u003e+uQF%RA+fcgl#M{Jx(i]EvrlK4vRGYWnPNgdze0\u003e/n]FAY07QQxmRMWIpgn0Js7#+\u0026z!j2RB3:!-y?m3)07.rFwjHiG0bMj:0aPXRy?dM$zu9ytx(i]Mh843TxKLQ)0aPXJx(i]pAbXi-zbK!Wwn=q+nKEJzAcc1$A:-\u003cbw]zZb08mJEp*)\u003cHmq^l+09shPBy^^Sz!@#[zu9TOlt{^UwNPDRq/8IkD2mzfBAh89l2pgLA+PSez2=\u003eyD2mzfBAh89l2pgLA+PSez2^anB7^\u003cQxk.*8BzbH\u003erb#X\u0026002\u0026oz!B90z2!iWBydQYwO?AWwPRoJB2C\u003cwx()c\u0026wPzj3x(mMZD2[7sz2={",
            "n": [
              {
                "c": 5,
                "d": "detect AsyncRat in memory",
                "i": "third_party/JPCERT/Asyncrat",
                "o": 263959,
                "z": 8,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 263848,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 263784
          },
          {
            "b": "A^qRCz/L?HzGFY%ASx3-B97#gD2[7sz7Xg]y\u00260V)BzkVhB1Q3MzGP/cA:-A[wIcF:Bvy7\u0026zdN-@Bz(g1l1t1JC42GhASv.4Bz(g14fDOg002#poMbb^ASwKGA=k%#nKWJtzdN-@Bz(g1o\u003c}{FxjU{\u003ezGFV-ygQ)%mq^l+wPzj3z/L?R3QsW)00030%nS91000000000c0SSi2qb.:YBy/qwl#(ZWx(mMmaxA5]B7]MgjV1=Be?![iefEr5yY",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 267355,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 267291
          },
          {
            "b": "00000000000000000000000000000000000000000001j0c[Mq06{P+080r4051s]0bITT0000000000000000000000000000000000000000000000001A09r(Lwn=WknN#yIBzk\u0026x07?lbB.\u003e\u003e\u0026AZ:?:BA)\u0026^0000dqVGt*k(-Uuh2]Jm0d.t205\u003c)z06{Q6A^mT-wPQ*Yxk8BeA^mU6A9(4NBZY92BA)\u003e8A9(gOwPq\u003c3y?X0p08[e:By/qwpgXJ1q!oDYA+PSawo8m5B4fOPx(54{ltQNIyEr2VC(Q]^x()]Mx(mv1C(Q/ZltpsCA^mT$wPRoTD2[7sza58UwN/*PwQanNwOkZ#BAhU1wQan.yH}+\u003eq*ACawO\u003c4#wN/\u003e6x([RMlVND\u003eBz\u003e/jvq][906$WEwO\u003e))C(QceBZ!0PC(Qlzy?mZ1q/#LxwQanKAaJ]=BZ!0PC(RF*Byd\u003c!vR/:*oj-wGuTX80xIh[",
            "n": [
              {
                "c": 5,
                "d": "detect AsyncRat in memory",
                "i": "third_party/JPCERT/Asyncrat",
                "o": 269518,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 269390
          },
          {
            "b": "0ce6Z0cncp0ce6T0000000000000000000000000000000000000000000000001g0aM1K0ce6N0cwi^07c-$0b.^U0a=dJ05sJOjYqt(0bITD0aM1J03zm\u003e03znN0ce6T0bRYU06{Q50cncZ0at\u003ez0bITD0aV6f2#yRu0b.^H000x%0ce6T0cFoX000gc09/H7d{J6{0b?\u003cQ0cwiC08\u0026(r0a(jH0ce6R0at\u003eB0aM1u000Qc0at\u003eG0cwiL0aC}x0b.=p6f#Ro0cwiP0cOuR0ce6Z0cnbu6g\u0026gC0b8uj4]@Ww0ce6X0bhBK0b.=p3QB=60bRZI0b.=p33le/0cFoM000ys0at\u003ez0cncK000*i0a=dx0cwhv10vNz2#*[B0cFoM000x+05KW+0bhBP000x@0at\u003ez0cncK000x.05sK-0bhBP000s40at\u003ez0bhBA0b.^U07^fd0a(jH000r@09od(07l!!2#{$D0a=dJ000f#08\u0026\u003c$6hnEv0aM1H0b?\u003cU0b?\u003cN073W70c!Fz7Ggry0bhBA07l*60bIS/0aV7C0bISn5K=Xu0ce",
            "n": [
              {
                "c": 5,
                "d": "detect AsyncRat in memory",
                "i": "third_party/JPCERT/Asyncrat",
                "o": 289400,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 289272
          },
          {
            "b": "e=XYFyYFOTx8(SCzu6Uwqug?tzu6UEo-Pkmx8((Jve%^qyxatDqugndv/Q6ux-JqRwDk9#yYFnK02oLPwDlPFwb]BayYFOTx8(SCzu6UCnc05#A@Y\u003eNwDl=K00#f@ve$uGxAe2KpYLqiBPuH-Ck#4KASxUJtMs:gz#:!RzuaqH01A(EyYFOTx8(SCzu6UKA@YRGB]V7NpYLqiBPu4Ox-J2J00-@n00000wb{-Lv/QPJ02GeCx-JhOz#:XOve$MMp5[Y5z2!bE00=m0f91or00K[NaohxPqVH.ow=Ji7009610rr90@@A910000001n]e002\u003e{D2[7sz7Xj%vrVB6xdLfawPz\u003caz/dY{e?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH}xDvLxPIhd!^Vf!)h@fKV+C1PXP602nBTB97#ge\u003c%.*Cwg@ce\u003c:n]zddw:00004l$7gC2lB@b000rc0000",
            "n": [
              {
                "c": 5,
                "d": "detect AsyncRat in memory",
                "i": "third_party/JPCERT/Asyncrat",
                "o": 291414,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 291286
          },
          {
            "b": "00000000000000000000000000000000000a]?Sz0rt{@ASy1Twb{-Lv/QPJ00000000000000000000000000000000000000000000000000iSGD^0rt)}ASx!Nx8(SCzua8ByYD{8x-I@HwDlPFve$cAwDhYgqVH[tBPt\u003eJe=YC.CMqpP004oAASx!Nx8(PBBn#pv00000dGxFH0rt^[wDluyve$9zq#*}sve%*rwDlMEve$rFyxezQ000000043tzua8ByYEigve$cAwDhYgqVH[tBPt\u003eJe=YC.CMqpP00000cia5D0rt^[wDluyve$9zlJz38z#Zdz0rtN?x-I@HwDk:hwDl-JA@Y[OzVBUP00000f-S*afArZ9fArZ9fAq7Mg5}QX0rtW\u003ezua+UwDlcsz2!bE0000000000dGxFH0rtN?x-I@HwDk9#wDl=Kv/QJHx-J8LBo31PzVBUP0000000000fAr^",
            "n": [
              {
                "c": 5,
                "d": "detect AsyncRat in memory",
                "i": "third_party/JPCERT/Asyncrat",
                "o": 296451,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 296323
          },
          {
            "b": "g^Vmtz#.^=vKtXgr5cEM07ZPVdKe8lha?//ltpKUvq(i8w?cX5mrpmUAr79dhD.v[Do1Dn077*uw[t#.qE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!e[o0wASv.4v@#Tf07?6Ip\u0026{ZTB98B5hHcYpssM7pcuxeBs8PKlgKIU}A@Yc:B97#ge\u003c%zZxkRTeBzkla08[e:By/qwqGV(0x(dAlnP5SYA=k[}wPz%dv}xYYq*ACawO\u003c4",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 314460,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 314396
          }
        ],
        "mol": "MdTh",
        "sha": "17126bc9d8ea2be7a405c7ddb1a6ce5983a65f4ff506976ec446c9c7fd5920b9",
        "path": "17126bc9d8ea2be7a405c7ddb1a6ce5983a65f4ff506976ec446c9c7fd5920b9.iso",
        "risk": 145,
        "size": 501760,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 501760.0,
              "entropy": 5.7,
              "size_bytes": 501760.0
            },
            "binary": {
              "overall_entropy": 5.7,
              "peak_region_bytes": 59392.0,
              "peak_region_entropy": 7.8
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                314460,
                15
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                263848,
                17
              ],
              [
                267355,
                9
              ]
            ]
          },
          {
            "id": "third_party/JPCERT/Asyncrat",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "detect AsyncRat in memory",
            "spans": [
              [
                263959,
                8
              ],
              [
                269518,
                3
              ],
              [
                289400,
                3
              ],
              [
                289463,
                3
              ],
              [
                291414,
                3
              ],
              [
                296451,
                3
              ]
            ]
          },
          {
            "id": "third_party/JPCERT/asyncrat/asyncrat",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "detect AsyncRat in memory",
            "spans": [
              [
                263959,
                8
              ],
              [
                269518,
                3
              ],
              [
                289400,
                3
              ],
              [
                289463,
                3
              ],
              [
                291414,
                3
              ],
              [
                296451,
                3
              ]
            ]
          }
        ]
      }
    ]
  }
}