{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9862487316131592,
        "class": 0
      }
    ],
    "prob": 0.98624873,
    "skip": [
      {
        "m": "az/xls",
        "why": "uncalibrated"
      }
    ],
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.060943644,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 0.98624873,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T07:45:15Z"
  },
  "path": "native_000%2F3.548320.AJ0ACEVCKQIUJS4ZF42IGUIW4VORBEW4B.1.xls",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)H(Po)",
        "x": 2,
        "ff": {
          "m": {
            "file": {
              "size": 145920.0,
              "entropy": 2.85,
              "size_bytes": 145920.0
            },
            "office": {
              "stream_count": 50.0,
              "ole.stream_count": 49.0,
              "ole.storage_count": 1.0,
              "is_macro_enabled_extension": 0.0
            }
          },
          "v": {
            "office.kind": "doc",
            "office.created": "1999-11-09T15:34:27Z",
            "office.creator": "acook",
            "office.streams[0]": "/",
            "office.streams[1]": "/\u0001CompObj",
            "office.streams[2]": "/Workbook",
            "office.streams[3]": "/MBD03885CC0",
            "office.streams[4]": "/MBD03885CC0/\u0001Ole",
            "office.streams[5]": "/MBD03885CC0/Data",
            "office.streams[6]": "/MBD03885CC0/1Table",
            "office.streams[7]": "/MBD03885CC0/\u0001CompObj",
            "office.streams[8]": "/MBD03885CC0/ObjectPool",
            "office.streams[9]": "/MBD03885CC0/WordDocument",
            "office.application": "Microsoft Excel",
            "office.streams[10]": "/MBD03885CC0/\u0005SummaryInformation",
            "office.streams[11]": "/MBD03885CC0/\u0005DocumentSummaryInformation",
            "office.streams[12]": "/MBD03889345",
            "office.streams[13]": "/MBD03889345/\u0001Ole",
            "office.streams[14]": "/MBD03889345/Data",
            "office.streams[15]": "/MBD03889345/1Table",
            "office.streams[16]": "/MBD03889345/\u0001CompObj",
            "office.streams[17]": "/MBD03889345/ObjectPool",
            "office.streams[18]": "/MBD03889345/WordDocument",
            "office.streams[19]": "/MBD03889345/\u0005SummaryInformation",
            "office.streams[20]": "/MBD03889345/\u0005DocumentSummaryInformation",
            "office.streams[21]": "/MBD03889616",
            "office.streams[22]": "/MBD03889616/\u0001Ole",
            "office.streams[23]": "/MBD03889616/Data",
            "office.streams[24]": "/MBD03889616/1Table",
            "office.streams[25]": "/MBD03889616/\u0001CompObj",
            "office.streams[26]": "/MBD03889616/ObjectPool",
            "office.streams[27]": "/MBD03889616/WordDocument",
            "office.streams[28]": "/MBD03889616/\u0005SummaryInformation",
            "office.streams[29]": "/MBD03889616/\u0005DocumentSummaryInformation",
            "office.streams[30]": "/MBD038C2A1C",
            "office.streams[31]": "/MBD038C2A1C/\u0001Ole",
            "office.streams[32]": "/MBD038C2A1C/Data",
            "office.streams[33]": "/MBD038C2A1C/1Table",
            "office.streams[34]": "/MBD038C2A1C/\u0001CompObj",
            "office.streams[35]": "/MBD038C2A1C/ObjectPool",
            "office.streams[36]": "/MBD038C2A1C/WordDocument",
            "office.streams[37]": "/MBD038C2A1C/\u0005SummaryInformation",
            "office.streams[38]": "/MBD038C2A1C/\u0005DocumentSummaryInformation",
            "office.streams[39]": "/MBD038C2D6E",
            "office.streams[40]": "/MBD038C2D6E/\u0001Ole",
            "office.streams[41]": "/MBD038C2D6E/Data",
            "office.streams[42]": "/MBD038C2D6E/1Table",
            "office.streams[43]": "/MBD038C2D6E/\u0001CompObj",
            "office.streams[44]": "/MBD038C2D6E/ObjectPool",
            "office.streams[45]": "/MBD038C2D6E/WordDocument",
            "office.streams[46]": "/MBD038C2D6E/\u0005SummaryInformation",
            "office.streams[47]": "/MBD038C2D6E/\u0005DocumentSummaryInformation",
            "office.streams[48]": "/\u0005SummaryInformation",
            "office.streams[49]": "/\u0005DocumentSummaryInformation",
            "office.last_printed": "2000-06-15T23:40:27Z",
            "office.compobj.prog_id": "Excel.Sheet.8",
            "office.last_modified_by": "acook",
            "office.compobj.user_type": "Microsoft Excel Worksheet",
            "office.compobj.app_version": "Excel.Sheet.8",
            "office.compobj.clipboard_format": "Biff8"
          },
          "id": "xls"
        },
        "id": 0,
        "sz": 145920,
        "ts": [
          {
            "c": 1.0,
            "d": "Document metadata: author: acook, last_author: acook",
            "i": "metadata/format/properties::doc-properties",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "CompObj declares Excel sheet",
            "e": [
              "Excel.Sheet.8"
            ],
            "i": "objectives/evasion/masquerade/document::compobj-claims-excel",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has .xls extension",
            "e": [
              "native_000%2F3.548320.AJ0ACEVCKQIUJS4ZF42IGUIW4VORBEW4B.1.xls"
            ],
            "i": "objectives/evasion/masquerade/document::basename-xls-extension",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "Reference to NORMAL.DOT default template",
            "e": [
              "normal.dot"
            ],
            "i": "micro-behaviors/process/create/macro/office::wordbasic-normal-dot-ref",
            "l": 3
          }
        ],
        "sha": "2750a40a5c6992f0abed6e15c61cba5132caff26b036bdefbfd7ff2dfe5ca04e",
        "path": "/data/samples/good/datasets/xls/enron_xls/edrm/native_000%2F3.548320.AJ0ACEVCKQIUJS4ZF42IGUIW4VORBEW4B.1.xls",
        "type": "xls"
      }
    ],
    "tv": "9ea7c"
  }
}