{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9961373209953308,
        "class": 1
      }
    ],
    "prob": 0.9961373,
    "class": 1,
    "oprob": 0.8505155,
    "models": [
      {
        "m": "az",
        "prob": 0.8505155,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-13T05:58:39Z"
  },
  "path": "18e2a00ad50e5e2cd4a332ebad8e6aca9a023dc4e3a68ec39f3056723d84ff39.lnk",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 68,
        "id": 0,
        "ms": {
          "lnk": {
            "has_arguments": true,
            "has_link_info": false,
            "has_working_dir": false,
            "has_icon_location": true,
            "args_whitespace_total": 10.0,
            "args_max_whitespace_run": 1.0,
            "has_link_target_id_list": true,
            "args_excessive_whitespace": false
          },
          "file": {
            "size": 1768.0
          }
        },
        "ss": [
          [
            0,
            "-ExecutionPolicy UnRestricted $L=@(9215,9221,9210,9222,9203,9138,9210,9222,9222,9218,9221,9164,9153,9153,9205,9207,9216,9222,922"
          ],
          [
            0,
            "%SystemRoot%\\System32\\imageres.dll"
          ],
          [
            137,
            "Windows"
          ],
          [
            305,
            "WindowsPowerShell"
          ],
          [
            417,
            "v1.0"
          ],
          [
            491,
            "powershell.exe"
          ]
        ],
        "sz": 1768,
        "ts": [
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "LNK has command-line arguments",
            "e": [
              "lnk.has_arguments = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::has-arguments",
            "l": 1
          },
          {
            "a": "T1564.003",
            "c": 0.699999988079071,
            "d": "LNK contains powershell.exe target",
            "e": [
              "powershell.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/window-hiding::lnk-text-powershell-target",
            "l": 1,
            "m": "F0008"
          },
          {
            "a": "T1027.003",
            "c": 0.8999999761581421,
            "d": "JavaScript function keyword in non-code file",
            "e": [
              "function T("
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::js-function-in-noncode",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK runs minimized without activation",
            "e": [
              "7"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::minimized-window",
            "l": 4
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "LNK working directory is System32",
            "e": [
              "25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52 00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/conhost-curl::working-directory-system32",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies PowerShell artefacts in shortcut (LNK) files.",
            "e": [
              "$",
              "powershell",
              "PowerShell"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/ps_in_lnk",
            "l": 4
          }
        ],
        "sha": "18e2a00ad50e5e2cd4a332ebad8e6aca9a023dc4e3a68ec39f3056723d84ff39",
        "path": "18e2a00ad50e5e2cd4a332ebad8e6aca9a023dc4e3a68ec39f3056723d84ff39.lnk",
        "type": "lnk"
      }
    ],
    "tv": "92e78"
  }
}