{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000011424224,
        "rte": "az",
        "prob": 0.000011424224
      },
      {
        "cls": 0,
        "raw": 0.0000014702479,
        "rte": "az/documents",
        "prob": 0.0000014702479
      }
    ],
    "prob": 0.000011424224,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001142422388511477,
        "type": "ole"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-12T19:41:20Z"
  },
  "path": "Virus.MSPPoint.Poison",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "mol": "Md(Ag)",
        "sha": "2b62d6416b7409b887eae2b87f4f71a98484e7314c36ea841027d262e6ec6150",
        "path": "Virus.MSPPoint.Poison",
        "risk": 1,
        "size": 15360,
        "type": "ole",
        "facts": {
          "metrics": {
            "file": {
              "size": 15360,
              "entropy": 4.3
            },
            "binary": {
              "peak_region_bytes": 1024,
              "peak_region_entropy": 6.27
            },
            "office": {
              "macro_count": 1,
              "stream_count": 11,
              "ole.stream_count": 10,
              "ole.storage_count": 1,
              "is_macro_enabled_extension": 0
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.document_as_unknown": 1
            }
          }
        },
        "traits": [
          {
            "id": "metadata/format/macro::ole2-has-vba",
            "atk": "T1059.005",
            "conf": 1.0,
            "crit": 3,
            "desc": "OLE2 document contains VBA macros (0 modules: )"
          }
        ]
      }
    ]
  }
}