{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.43011733889579773
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9997334,
        "class": 2
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/rtf",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.43011734,
    "analyzed_at": "2026-05-30T11:26:05Z"
  },
  "path": "1df65a33ccd8e28652eeba4ce116e3940e9b1eb23b13a254f70d1b099f5896d7.doc",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "MdTh",
        "x": 149,
        "ff": {
          "m": {
            "rtf": {
              "group_depth_max": 5.0,
              "control_word_count": 18.0
            },
            "file": {
              "size": 117689.0,
              "entropy": 2.9,
              "size_bytes": 117689.0
            }
          },
          "v": {
            "file.stem": "1df65a33ccd8e28652eeba4ce116e3940e9b1eb23b13a254f70d1b099f5896d7",
            "rtf.version": "1",
            "file.basename": "1df65a33ccd8e28652eeba4ce116e3940e9b1eb23b13a254f70d1b099f5896d7.doc",
            "rtf.features[0]": "object",
            "rtf.features[1]": "objupdate",
            "rtf.features[2]": "objemb",
            "rtf.features[3]": "objdata",
            "rtf.shape.brace_count": 16,
            "rtf.shape.group_depth_max": 5,
            "rtf.shape.control_word_count": 18
          },
          "id": "rtf"
        },
        "id": 0,
        "sz": 117689,
        "ts": [
          {
            "c": 0.8500000238418579,
            "d": "RTF info.author is missing",
            "e": [
              "field 'rtf.info.author' does not exist"
            ],
            "i": "metadata/document/rtf/properties::rtf-info-author-missing",
            "l": 2,
            "el": [
              "value:rtf.info.author"
            ]
          },
          {
            "a": "T1036.005",
            "c": 1.0,
            "d": "File extension claims OleDoc but content is Rtf",
            "e": [
              "expected=OleDoc, actual=Rtf"
            ],
            "i": "metadata/file-extension-mismatch",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.",
            "e": [
              "\\objemb",
              "\\objdata",
              "\\objupdate"
            ],
            "i": "third_party/Ditekshen/INDICATOR/RTF/Malver/Objects",
            "l": 5,
            "el": [
              "offset:0x187f",
              "offset:0x18b6",
              "offset:0x18a2"
            ]
          }
        ],
        "sha": "1df65a33ccd8e28652eeba4ce116e3940e9b1eb23b13a254f70d1b099f5896d7",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-11/1df65a33ccd8e28652eeba4ce116e3940e9b1eb23b13a254f70d1b099f5896d7.doc",
        "type": "rtf"
      }
    ],
    "tv": "ca5ef"
  }
}