{
  "llm": {
    "conf": 0.8,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "suspicious",
    "interpretation": "Compiled AutoIt script with admin rights"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 3000,
    "conf": 54,
    "mods": [
      {
        "cls": 0,
        "raw": 0.82624024,
        "rte": "az",
        "prob": 0.82624024
      }
    ],
    "prob": 0.8,
    "files": [
      {
        "id": 0,
        "lvl": 3000,
        "conf": 54,
        "prob": 0.800000011920929,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T19:14:55Z"
  },
  "path": "297f9d27a2ba7faf80b2da9090fdb7dbb83e037337a60fe3f4ab994e6e74e6c8.iso",
  "raw": {
    "v": "8",
    "rev": "3fe0e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!9llGe}q6m8ri50iBfD.FXarR^HarR^HarR^HarR^b000000002i0@@r300x\u003el00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "00000li6BOmf3c:00000k(:*-lJyf/00000k(:\u003c:k(:TW00000l\u0026YTQlJv8^mf3A\u0026pYHE}lJxTSqucW%k(:*-lJv8^lJx)ZqVD^$00000J06aXwb[s:vGlxdblgHtzu8%5BPuH-zVAueBo2ktBo2.HASygYqugndx8(SCA@ZpZwDl-J00000blhV.ASxIFx8(=Gve}zIv/QAEz2!IPx-I@HwDhYgblh-:wDlYIBPuaQASxUJve%*rz2!nIzu6UpblhATzuaeDyYFOTwb{fveDxX?zuaeDwDhYgblhPYzVB\u003eVASxIFC(RKUv/QAEzu6Upwb[v+h2]rgz2=l\u002600000wb[s:fAt}\u0026fAq7Mwb[E!z2",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 657396,
                "z": 1,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 657300
          },
          {
            "b": "c)eG\u0026diFP\u003c%nSc0qVD^$l\u0026Wh!qVGO[mGux/r@+I^qufb=tMva\u003eyYE(zA@ZmYwDl=KtMs:7tMva\u003eoAm#\u003enDqcU00000tMw1e00000tMvs}pYJ\u0026.bME/A00000ra]#!azC)tvixV9x(W-oAa9^eC{3Qnze:i9wN(]HB-.K[BrCTmA+PGme=U\u003eKa]?PyASyjZzua8BA@Vgumf4udASy1TASviZve$9zyYFwNv/P{qBo31PzuaqHaollUwDlMEzVB!TC(PC%00000qVHwek(+%aA@Y[Ox8(/HpYLIox-I#Ive$rFC(Q!zzVBLMwDlPFpYLIox-JqRx-I@HwDluywDhYgqVHwenDrSdv/QJHwDlcsA@Y+Kq2\u003e.szVB\u003eVve%a7ASx!NB]VjRyYF2Dx8(Gy00000qVHweli7A]v/",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 809332,
                "z": 45,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 809236
          },
          {
            "b": "vGw@swO1LHvSC)$C(P@eoMauIoLE%RvrcSV002B?m}D^sA=kCNwmPZ(B8}rYsoIMlBvyj\u003cz/OM\u003cwmU-v6AQ^oBwlW:B.\u003eRUx(4uQvqPNS000Pms7#hRlUG[GrbUGNy\u0026\u003cwTD30P$ncF",
            "n": [
              {
                "c": 1,
                "d": "GetProcAddress API-resolution reference",
                "i": "metadata/file/format/iso::iso-native-api-get-proc",
                "o": 824974,
                "z": 14,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 824942
          },
          {
            "b": "A=kD0B8%]-004AIq!p5EA+PDjx([R/y*?ya002j=oMauIoLE%RvrcS{008l^r+VO@BZY8Ly\u0026131002UXqCGUOgCQN[y?%7KQx0X[B98CvC$zH:zu7dFo\u003ewx!vp%drz*jLFeDFvM",
            "n": [
              {
                "c": 1,
                "d": "LoadLibraryW API-resolution reference",
                "i": "metadata/file/format/iso::iso-native-api-load-library",
                "o": 826826,
                "z": 12,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 826794
          },
          {
            "b": "x8\u0026wxo\u003ewx!vp%drwO2/XTn\u003eU5vqG\u003c{lt}9Bvrb^[r@\u00266$oMauIq/)4]zF92JaP\u003e+Xoj-xEv{%mR002d.m}D^nwQdi@vru5XlifO/Bw3g\u003cvSbW}wk^OUBy+BLMi6#@Bw3g\u003cvSbW}wk^OUBy+BL2lvtaBu%$[zEVsJC#F/[By+BLB]\u003ePNzE=sRAclm5fAV94D17q\u003ewP?T5Bo7Ueq*ACawO\u003emLA:-/@By/GlnP5cUr@\u00266%mRM:Js7#L.z*bm.^e=*WnN(WRx\u003e4byLlaV]BvHg?wOg",
            "n": [
              {
                "c": 3,
                "d": "GetKeyboardState API string",
                "i": "metadata/file/format/iso::iso-getkeyboardstate",
                "o": 827980,
                "z": 16,
                "cf": 0.9700000286102295
              },
              {
                "c": 3,
                "d": "GetKeyState API string",
                "i": "metadata/file/format/iso::iso-getkeystate",
                "o": 827966,
                "z": 11,
                "cf": 0.9700000286102295
              }
            ],
            "ln": 827902
          },
          {
            "b": "r@-:hltQNIyE@z.B-WP-ciu$ZwO%\u003eKx(EK1vrb(U:]L7PlU{EQvSbW}wjyGTzddJLC4293vpB4:000=nm}D^fy?W\u0026$z^^V%l$7gC002N\u003clU{WZwKyoFAai-]A+2dIrSCH9B-8p*y?W\u0026$z^^V%mSir:vruL\u003c!C@3PAccv)y?W\u0026$z^^V%004-Pq!p5ry?W\u0026$z^^V%l$7gC006e6q!p5GwN//Z0@$R$yisPts7#L.z*b8\u003cv@$d:002%#lVl{?nO})GwDoZK",
            "n": [
              {
                "c": 3,
                "d": "GetClipboardData API string",
                "i": "metadata/file/format/iso::iso-getclipboarddata",
                "o": 828668,
                "z": 16,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 828604
          },
          {
            "b": "zuaqHaolD.wDlVHve$rFve$xHzVB!Taok)KxAhDvASxIFv/QPJwDl-Jaok*Iw=M]MwDl-JaolfSwDl#QCk#KYASxRIe=U\u003eK00000QEX4(M#2x]Nm{J^HsO[zk#/Y:ml@Q=o@O8kb=r=#Dj]:XTIHa-yEulxRMx*#\u0026K.b]R77D\u003e\u003el)Ufk!VcB?HF82OOHqg!uNOEi(\u003cF7=[\u003ezgUGE-RLMu:SI2H}IvDU6[8#6ykyDt.O+}tv+oq:l0Y/B9h?wU[Yv5mpgneJct.#QRH\u003e\u003c9B*}a(LXeEqVdDx1}ol\u003cYL@*4dF}-6*8Xh}7rETP9{J/mNqk-fYj\u003c(1Svd.-]44bmyCA\u00269?J*E2Am%2p:Pcs185GAR\u003c+yRMQ=C",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 924608,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 924512
          }
        ],
        "mol": "MdTh",
        "sha": "297f9d27a2ba7faf80b2da9090fdb7dbb83e037337a60fe3f4ab994e6e74e6c8",
        "path": "297f9d27a2ba7faf80b2da9090fdb7dbb83e037337a60fe3f4ab994e6e74e6c8.iso",
        "risk": 37,
        "size": 1957888,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 1957888.0,
              "entropy": 7.42,
              "size_bytes": 1957888.0
            },
            "binary": {
              "overall_entropy": 7.42,
              "peak_region_bytes": 1004544.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/iso::iso-getkeyboardstate",
            "atk": "T1056.001",
            "conf": 0.9700000286102295,
            "crit": 3,
            "desc": "GetKeyboardState API string",
            "spans": [
              [
                827980,
                16
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-getclipboarddata",
            "atk": "T1115",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "GetClipboardData API string",
            "spans": [
              [
                828668,
                16
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-getkeystate",
            "atk": "T1056.001",
            "conf": 0.9700000286102295,
            "crit": 3,
            "desc": "GetKeyState API string",
            "spans": [
              [
                827966,
                11
              ]
            ]
          },
          {
            "id": "third_party/bartblaze/generic/AutoIT/autoit_script",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
            "spans": [
              [
                657396,
                1
              ],
              [
                809332,
                45
              ],
              [
                924608,
                8
              ]
            ]
          }
        ]
      }
    ]
  }
}