{
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9680186,
        "rte": "az",
        "prob": 0.9680186
      }
    ],
    "prob": 0.99,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9900000095367432,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T16:19:22Z"
  },
  "path": "1ed52900ce861165d4656527c56841109ccd8d32b6d46e8975d5d3802ab9a6c1.iso",
  "raw": {
    "v": "8",
    "rev": "3fe0e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!6pAS1\u003erYA2@h8EcFi3os^arR^HarR^HarR^HarR^b000000002z00000007mz000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c[RK6d\u003e*10SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao",
            "n": [
              {
                "c": 5,
                "d": "ISO .NET reflection resource loader",
                "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader",
                "o": 32769,
                "z": 5,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 32641
          },
          {
            "b": "1@wziMy4U\u003c\u003c]tw*d1RB01]{aM6efB!3\u0026*nc0@@rk00jM]000igd/Y=6Q5Umwrr914DMi1=1AF5/0b@0!q#=[3c]?nc3mEC9019S:000uadXV[ADSHgE1Bzc?00EsN6AA7ND@ZjE1sMng017b9000vA8#]%C04E%Glq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnGC%)\u003ebyPQ)[ezucefj=\u003ebu5Y8x(mN80000096a61H.G*?bumUxQ!Q)\u00265c8Xgbs+:9l\u0026Wh!V}ZP3Fc=hQbsli+vGlxd000000SSi3s0ady2[E1o0qVZL02tLm0rr91Hx4qOaohxwr@-j2Jq@}UC(N*A0rr91\u003c]twY0@@r3k(Z(+e=U\u003eK2lj-76951j9@(ov3JHeb0rr911onA41][S61onA40SSi20rr91002v[0rr91000i6I3-CZ1{1u6(j\u003cH6I3Nx44/=}M000i6\u003cP(nb1]@DC",
            "n": [
              {
                "c": 5,
                "d": "ISO stages a .NET resource payload",
                "i": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager",
                "o": 78488,
                "z": 4,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 78360
          },
          {
            "b": "lum0*B75J]wKgAWA+P09By+Cvwncd7AZB!+Cxmh4y?k[OBAh88B-.f{lVl*xx(^#$y?k[OBAh88B-.f{l349Uzdmsbrb3C\u003cwKgAWA+P09By+CrB8$]fvR*r?A:-G\u0026zddE2l3di?x\u003c#jbwDkXrA+w%9mSI{OwP@6kyE95:A+P09By+CrB8$]fvR*rVx(4uYwPz\u003caz/d\u003c.BAh88B-.f{l349UzdmsblVl\u003cOx\u003eINevruj4zB5w^A+P09By+CrB8$]fvR*rTwPIv4x(Ffdz/d\u003c.BAh88B-.f{lVl*Xx(4j1x(v(!wO+!1vruj4zGw9=BAh88B-.f{l349Uzdmsbp\u0026ZF+BZ]IVBAzLqvS=^706$WEwO\u003e))C%=H?D2^RixMMKZBAh88B-.f{l349UzdmsblVl*XvqZuRBAzLqvS=^708^@SBzkP6lVl*Xvrui)x(4H9C%MK]A+P09By+C+wPRoWvqH6$099]LzF%-pr://!wDkXIC$hB/r://!wDl)Zy\u0026%p?q/uF}wDkiLT3V0lPgA.HS[sr9J=cKYCX3\u003e@wPRoTx)Ks\u003cB7GD2l3mo/q!ZL?0cqZ[uQFTzwO#P*x)Ks\u003cnMf+JAbP=snP5l:x\u003c\u003e*(DsW7=B-..zzztHdxKL^\u003ewNx4/A=2f8x)Ks\u003cqE%]-DsW7FzE^s6pI6Ptx8\u003e\u003eQB97#ge(VI8wNPa-zF5@rzEWP}x(mL-q*ACawO\u003c4$B-8qnzdLt2wPz\u003caz/fobx8\u003etrCw.kn",
            "n": [
              {
                "c": 3,
                "d": ".NET AssemblyCompanyAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-attr",
                "o": 88165,
                "z": 24,
                "cf": 0.9599999785423279
              },
              {
                "c": 3,
                "d": ".NET AssemblyTitleAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
                "o": 87917,
                "z": 22,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 87853
          },
          {
            "b": "wQ5q-z*jS/y\u0026%Pj0a*y]A+frkx(v\u003e?l2Z^Vx\u003e7N[x(v\u003e?B7GD2oMaAHBzkVh0cqZ[uSg(=zE=BVv{%E[z/bLAz/PYqy*/Xty?4Q7vruj4zu9QXB97#ge\u003c\u003cL{w[+[2A::67z/bLND2[7sz7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu97kByvWWx\u003egmUwP{HMy?#ESy\u00260V)BzkVh07gWxBAhqolVl^SwN/*@z/bLyvrt{FA+P5+x\u003eqGQz!%MkzBntUy?m9#x(v\u003e?pHX6Iv@$7Ry\u00260V)BzkVh07pmqvmLuLwl9zQCt-v6lVl^SwN/*@z/bLFwQcTYy\u00260V)BzkVh0aftXzEW^5z/bL@wPRoTByxiip\u0026yz?BzkVh07H)EzbUK+A=+b@B7]-gz/bL:B-..zzztHdxKL^\u003ewNx4/A=2f5z/YSmx(v\u003e?l$7gCr://UwmoN]z/e0*v}xR3x(v\u003e?piyz.wPy*Wy?WA*BzkVhmr\u0026rNAcb/jzu",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 90004,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 89876
          },
          {
            "b": "vq{f%vr8unxKL]Yq/)4\u003evqO[NvpS}\u0026090JOBw=WUwmY=YnK^SszddJ.A=lbnwmY=YBy/Yslt}96uT[a/vru6/w]zG@wPzc}vqPN.w]zY%Bzbk)w]zG@wPv=WB-..zzztHdA+eW3wNx4/y?d9$0cqZ?wmY=YxjVf(qE%]/B-H#6o\u003c}{FxjV8-oMaMRwPv=BwPRQ7wjZVZz!\u0026{807HWswMJ!\u003cyH}I^mqMyKB7F(JC4CMknmuyDy?mR!mSir:lU{WZx(mMLC4CMknmuyDy?mR!l$7gCm@\u0026rOr+Vb?qG3+FC4CMknmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!rb3hXASwV#z/fV9x(mH508)#Wx(mMOwO=r%ASx3WA+eV@s8@1%wPv=IwQ5q#A+PSbASx]:vR6vguVY$4wNPaRv@DHcBy/E)mSir:B.\u003eF+z!%PdASx6SoMbb^ASw{OCv+^{q/u!@wkE8JD1z0@rbVL-zFsAdASyd",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 90731,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 90603
          },
          {
            "b": "x(mN1wKZxIwK*rHwPzj3z/Marhzc{vfFk3V00\u0026P90SSi200000V\u0026y7a=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx000000000008L%H",
            "n": [
              {
                "c": 3,
                "d": ".NET ResourceReader reference in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-reader",
                "o": 101092,
                "z": 24,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 101028
          }
        ],
        "mol": "O₂(AsC)Md",
        "sha": "1ed52900ce861165d4656527c56841109ccd8d32b6d46e8975d5d3802ab9a6c1",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-02/1ed52900ce861165d4656527c56841109ccd8d32b6d46e8975d5d3802ab9a6c1.iso",
        "risk": 239,
        "size": 419840,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 419840.0,
              "entropy": 7.2,
              "size_bytes": 419840.0
            },
            "binary": {
              "overall_entropy": 7.2,
              "peak_region_bytes": 302080.0,
              "peak_region_entropy": 7.84
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/iso::iso-dotnet-metadata-sig",
            "conf": 0.9700000286102295,
            "crit": 3,
            "desc": ".NET metadata signature string in ISO content",
            "spans": [
              [
                78488,
                4
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                90004,
                17
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-reader",
            "atk": "T1027.009",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET ResourceReader reference in opaque content",
            "spans": [
              [
                101092,
                24
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::primary-volume-descriptor",
            "conf": 1.0,
            "crit": 2,
            "desc": "ISO-9660 primary volume descriptor marker",
            "spans": [
              [
                32769,
                5
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                90731,
                15
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyCompanyAttribute marker",
            "spans": [
              [
                88165,
                24
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyTitleAttribute marker",
            "spans": [
              [
                87917,
                22
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader",
            "atk": "T1027,T1140,T1620",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO .NET reflection resource loader",
            "spans": [
              [
                32769,
                5
              ],
              [
                78488,
                4
              ],
              [
                90004,
                17
              ],
              [
                90731,
                15
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager",
            "atk": "T1027,T1140,T1620",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO stages a .NET resource payload",
            "spans": [
              [
                32769,
                5
              ],
              [
                78488,
                4
              ],
              [
                88165,
                24
              ],
              [
                90004,
                17
              ],
              [
                90731,
                15
              ]
            ]
          }
        ]
      }
    ]
  }
}