{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Obfuscated .NET executable with reflection"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.99900556,
        "rte": "az",
        "prob": 0.99900556
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T00:03:10Z"
  },
  "path": "257dec559bb1396032d28ac26304ec0f5c96ba323ab770e6a23c692ff2219c79.iso",
  "raw": {
    "v": "8",
    "rev": "d9759",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!6vrcDjoLFM\u0026arR^HarR^HarR^HarR^HarR^HarR^b000000001N0rr9100d/O00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "l@uD9o*I5@oHq3hog7lYeg-tieg-tvejz9vlm+C?k#*GNk$@)Yej8S*q9=-:eg:jQeg-tsk%YcHk}DUmej8S*en)*9xf!7!z=x1*eg:T:eo:PIl0m5JoHSU-k%Xpjeg-tif?C}Olp14ek#ZcoqbQmTeg-tAoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268!ten4mmeg-t6eg-t6eg-t6eg-tHeg-t+oHg%7fe2Qxml@F0k%Xv/r-x50076QRlid5!0000001n\u0026c0cQgKfFkdngCH(\u0026000050bISn0mjTA03={)06BiX0c3Y[03+A:A+PA7A@Vgu0iv\u003cP0os:)03+Gx0fxLG01Ybg03+0lnKJKU0h8WW0l=nW03:*Dz^\u0026XD0000000ic20AXfMd*Wo$008\u003cwgxnf\u003c009610e7sL06ykY0aV6f04F6J02#4u05KVQ0q=-@009610d$mK00961009610kXZo02CRn073U=",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 527891,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 527763
          },
          {
            "b": "\u0026^!8?FudWXTM1+*\u0026^!e\u003cFVN\u003cZS]wPi\u0026^[e\u0026FV!0.JPbFH\u0026^[h\u003cFq@MsUhT$\u0026\u0026^^9HFuw(tz/6DizE)ZcqE%]/B-H#6o\u003c}{FxjV8-\u0026^[q)FVW{ZJPbI)\u0026^[b?Fq\u0026GrI@Gn?\u0026^[q)Fr5SuT(s]m\u0026^[h\u003cFV[6-J]COH\u0026^^9HFq@MsI@GnC\u0026^!e\u003cFV!0-TM1/h\u0026^!h\u003eFVE^YUI$8k\u0026^[q)Fu4QVI@Gq\u003e\u0026^^6GFuE)ZT(s]m\u0026^!h\u003eFq\u0026GrTM1+\u003c\u0026^!fi\u0026^={",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 553210,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 553146
          },
          {
            "b": "A@+xWSDWEbWQAou\u003e9Ib@Bzp*qXqTzHMYC6r\u003ecI-{s:1%-vGo[XA.2kBTA\u0026{7X-]*4t2$X\u0026B8$]fvR*q\u0026q*ACawO\u003c4$wOb:\u0026v@#B6zue!3W=-)EB7Oo}l#\u003eP]\u0026^!e\u003cFq@MsUhU2m\u0026^^3FFVW{ZS]wMh\u0026^^3FFuE)ZS]wPk\u0026^^9HFVvZWJPbF\u003c\u0026^[e\u0026FVN\u003cZTM1+\u003e\u0026^!h\u003eFVE^YS]wL/\u0026^[q)FV[6:UI$8k\u0026^=%DFum:XS]wPj\u0026^^3FFq-AqUhT$\u0026\u0026^^9HFD",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 568147,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 568083
          },
          {
            "b": "l2}0OC(Q-NAbn@)wDk8ozGYPiBo1^Jz/4*HB7El^q/)4]zF5@twPQ)%AaG2twPQTTBzbP607?6Kz!\u0026[:nP5Y\u0026yH{jKzdm6%0b2\u003e+uQn:OwO\u003e))C(QuCBw)p4x(mL-lUG[G090#:p*[x=wDkqyl${pFBo1:DAccv9m}D^ex([y@lv0V:07?6Ip\u0026{ZTz/x5LCYmFkv}*2+nPNEvw[=c%BA)\u003c+x(mN1wDkqtBt+@Qry}7Ihz+zlnP5Sag5%)-BtkVN",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 605360,
                "z": 12,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 605296
          },
          {
            "b": "C42A9vqZe!o\u003c@cNxK#k+xjVf(m@\u0026J\u003cAb#1SwO(vewDlT/uRbcDADLYax([R2p*[x=wDk2rvqV6jz/YN(l1t1JC42GhASwEEwNPW(nP5P\u003evqYN^08l)D0b2\u003e+uSQ@LBz7U!wPRoIwOC^\u003cBo1WDze-{7wMiNF0000lgxo9eaolD.wDliuzVBUPwb{VJ06KD+zVB[Waol3OzVB\u003eVaok*IyYFnKaolG-xAhPzaok*Izua.TCk#gOASydXaolAZx-",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 605942,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 605878
          },
          {
            "b": "002iJ2MK\u0026E0000000000000000000000000001Zv2MK\u0026800000000000000000000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 3,
                "d": "Embedded .NET runtime string marker",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-string",
                "o": 617278,
                "z": 11,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 617214
          }
        ],
        "mol": "MdTh",
        "sha": "257dec559bb1396032d28ac26304ec0f5c96ba323ab770e6a23c692ff2219c79",
        "path": "257dec559bb1396032d28ac26304ec0f5c96ba323ab770e6a23c692ff2219c79.iso",
        "risk": 109,
        "size": 798720,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 798720.0,
              "entropy": 6.69,
              "size_bytes": 798720.0
            },
            "binary": {
              "overall_entropy": 6.69,
              "peak_region_bytes": 340992.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                568147,
                17
              ],
              [
                605360,
                12
              ],
              [
                605942,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-runtime-string",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "Embedded .NET runtime string marker",
            "spans": [
              [
                617278,
                11
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                553210,
                15
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                527891,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}