{
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 40,
    "conf": 91,
    "mods": [
      {
        "cls": 1,
        "raw": 0.9995755,
        "rte": "az",
        "prob": 0.9995755
      }
    ],
    "prob": 0.9995755,
    "files": [
      {
        "id": 0,
        "lvl": 40,
        "conf": 91,
        "prob": 0.9995754957199097,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-01T19:31:18Z"
  },
  "path": "1ded7387c39ab747dfcb6f77c6e524c1e78a2c971f3068513b3c844c7105d1df.iso",
  "raw": {
    "v": "8",
    "rev": "6096e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "1{j\u003c.4l$a108-[N1{j\u003cj6*I%90da/51{j\u0026i06*.\u003c0hGYK1{j\u003cS0yc?\u003e04E$61{j\u0026u0ZD}(05:\u003cD1{j(304d%M009=Y1{j\u0026C6EK7!02L.\u003e1{j\u0026w6^\u003cg/0cn\u002641{j\u003c30ziK#06I2z1{j\u0026p0vF6N0n4#k1{j\u003ep6EK7!0qvfP1{j\u003eT0wK=X09o\u003cZ1{j\u003cZ6EK7!0a#u{1{j\u003eb0Y{O*0q#%X1{j\u003e\u003e6di$^0hykQ1{1YGawSgx03-S91P[+(0lCxD0ilaA1P[:Ma\u003eW2300%B*1P[-Ma\u003c*C}0qNwS1P[-zaP",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: xor",
                "i": "metadata/encoded-payload/xor",
                "o": 143717,
                "z": 41,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 143653
          },
          {
            "b": "k%Xvlk$118k%W!5k%W!5ml%j9k%W!5k%W!6k%YcHk%W!5xf!*Hk%^\u003e6k$a7xk%W!5xf!*Hlu^l(k%W!5k%W!5of\u003e\u003cflnR7@l0m5JoHSU-k%Xpjk%W!5k%W!5k@ryhzB)q-mmxHwk%XvCq9)Mmk%W!5k%W!eoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268!tk%W!Hk%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!lk%W!5k%W!5l1-\u003eSk@ZIJk%W!5ml%j9k$%Thqe]So0qTqg0m5:QZ5Xil0fElY0bLOVB97#ge(Dn4z/{8gwPGF4wPI^jA:@VUwNPaXAX5tIB7ocey?WufaxA5]B7]MgjU!Sze?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-zARC/h^[NNh8WfHgC\u0026U%i5@iZD2[7sz7XZ$B8Mhwv}xZlqGV(0x(dAVwPI^jA:@VVwPN$N0006200031003XhD2[7sz7Xj%vrVB6xd=I+BzUD9efE(pB97#ge\u003c%.*Cwg@cefE#8A=U@kzAP:cfFk4ifF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!E",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 306835,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 306707
          }
        ],
        "mol": "MdTh",
        "sha": "1ded7387c39ab747dfcb6f77c6e524c1e78a2c971f3068513b3c844c7105d1df",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-07/1ded7387c39ab747dfcb6f77c6e524c1e78a2c971f3068513b3c844c7105d1df.iso",
        "risk": 109,
        "size": 555008,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 555008.0,
              "entropy": 6.87,
              "size_bytes": 555008.0
            },
            "binary": {
              "overall_entropy": 6.87,
              "peak_region_bytes": 254976.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/xor",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: xor",
            "spans": [
              [
                143717,
                41
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                306835,
                52
              ],
              [
                306978,
                13
              ]
            ]
          }
        ]
      }
    ]
  }
}