{
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 500,
    "conf": 78,
    "mods": [
      {
        "cls": 1,
        "raw": 0.9989665,
        "rte": "az",
        "prob": 0.9989665
      }
    ],
    "prob": 0.9989665,
    "files": [
      {
        "id": 0,
        "lvl": 500,
        "conf": 78,
        "prob": 0.9989665150642395,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T05:22:55Z"
  },
  "path": "1849fafdfb36ee9cc045f969e9e1acf285364c9fa8b5d4d44d9ea20ace213aef.iso",
  "raw": {
    "v": "8",
    "rev": "59b94",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.m%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!4mor?%pFs+.mpd=biw?{4arR^HarR^HarR^HarR^b000000001Y0rr9100ehZ00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "l@uD9o*I5@oHq3hog7lYeg-tieg-tvejz9vlm+C?k#*GNk$@)Yej8S*q9=-:eg:jQeg-tsk%YcHk}DUmej8S*en)*9xf!7!z=x1*eg:T:eo:PIl0m5JoHSU-k%Xpjeg-tif?C}Olp14ek#ZcoqbQmTeg-tAoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268!ten4mmeg-t6eg-t6eg-t6eg-tHeg-t+oHg%7fe2Qxml@F0k%Xv/r-zr:0rr91%nSc00rr91000003\u003c3ze08VWuB97#ge\u003c%.*Cwg@cefE#8A=U@kzAP*efFk4ifF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!EC#OY$wO%UufF^q#w\u0026BrRf\u003erc}vkzr}0rr916\u0026Py0By/qwl#(ZWx(mMoltpKUvq(kE000c\u0026vrt].0S\u0026u400@-c000Ji0000ax9FtqIbl@q4gj0X0000dnK#lE0004u0004u2Ngne0o+X9",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 309273,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 309145
          },
          {
            "b": "O-/qG[+d5U!+i]w{i)vXTyOK\u0026g]5yPqAwPBN0mwJdgWl):aI32Pz[@e@80sNgVZN@0000\u003cmnumNlstxMlq{Gy0rrc2000005c8XgB#g*9e\u0026bgqf/Yjl00000000r9V\u0026y7aXiH2]byPQ)y^w43f.LFDbu5Y8x(mN800000OhQDG\u003cqO70bumUxFkVEG5c8Xgbs+:9l\u0026Wh!Kw=eWUNgvgbsli+vGlxdkWBD\u003e5c8Xgbs+:9l\u0026Wh!p*Ke5",
            "n": [
              {
                "c": 3,
                "d": "Embedded .NET runtime marker",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
                "o": 729144,
                "z": 4,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 729080
          },
          {
            "b": "\u0026^[b?Fuv*YI@GnF\u0026^!e\u003cFr5SuT(s(j\u0026^[h\u003cFu4QVT(s\u003e\u0026\u0026^!e\u003cFuv*YJn/wF\u0026^^0EFuw(tz/6DizE)ZcqE%]/B-H#6o\u003c}{FxjV8-\u0026^[e\u0026FVvZXUhT$\u0026\u0026^[h\u003cFVE^XS]wPk\u0026^[q)Fq-AqKk+XI\u0026^[e\u0026Fuv*ZUI$bl\u0026^[n(FudWWTM1+\u003e\u0026^^0EFV[6:TM1+*\u0026^^6GFV!0.J]COF\u0026^!b\u0026Fq-ArT(s]j\u0026^=%DFreYuJ]COH\u0026^!8?FVW{.T(s\u003e\u003c\u0026^!fi\u0026^!c",
            "n": [
              {
                "c": 3,
                "d": ".NET managed-resource loader marker",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 747492,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 747428
          },
          {
            "b": "007\u003e(3JHeH0000000000000000000000000007wZ3JHeb00000000000000000000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 3,
                "d": "Embedded .NET runtime marker",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
                "o": 818910,
                "z": 11,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 818846
          }
        ],
        "mol": "MdTh",
        "sha": "1849fafdfb36ee9cc045f969e9e1acf285364c9fa8b5d4d44d9ea20ace213aef",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-08/1849fafdfb36ee9cc045f969e9e1acf285364c9fa8b5d4d44d9ea20ace213aef.iso",
        "risk": 109,
        "size": 821248,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 821248.0,
              "entropy": 7.26,
              "size_bytes": 821248.0
            },
            "binary": {
              "overall_entropy": 7.26,
              "peak_region_bytes": 456704.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "Embedded .NET runtime marker",
            "spans": [
              [
                729144,
                4
              ],
              [
                818910,
                11
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET managed-resource loader marker",
            "spans": [
              [
                747492,
                15
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                309273,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}