{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000013609727,
        "rte": "az",
        "prob": 0.000013609727
      },
      {
        "cls": 0,
        "raw": 0.000002503395,
        "rte": "az/documents",
        "prob": 0.000002503395
      },
      {
        "cls": 0,
        "raw": 0.00003097455,
        "rte": "az/pdf",
        "prob": 0.00003097455
      }
    ],
    "prob": 0.000013609727,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000013609726920549292,
        "type": "pdf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-12T19:10:25Z"
  },
  "path": "Exploit.Win32.Pidief.cjp",
  "raw": {
    "v": "8",
    "rev": "c7f7e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "b#v00eIO\u003em4gjAv\u003ciMf-3nAUSaA7.74gkiWfi0jowGSS[vrt{]z!ygCpJZ+}x(mH6auR+tlVm9+BrAmWfi0jowGST4B-.ClzE)(Mj%hHPvp%d)atL5[aw%snp*[0FoKSi+B-X-Vq!ZbZy?lBKx8",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "vRMtVjuLn:A+eW3z/M%Gp^^+}oLE%RvrcSog+HTrgBTC1rb3C\u003cwGT9zvpqtxfhMXcwozx[AV==bl}ep)x\u003c#9\u003eA^n=+e\u0026bandiHofB-.qnAV^F5vQ-}efF$T#vM2]JwI#Lchdnu@gbAI#hA9uJvQ%1katlx0D3sgEwoe\u003eQvprN}vQ-^$v}f1jatlYmvq{f%wfrJ",
            "ln": 7045,
            "col": 7,
            "line": 42
          }
        ],
        "mol": "Md(Pd₂)",
        "sha": "3519d6565e4668803b1973232ee8029e5b5cdedbd6425038772dc9f141060fa3",
        "path": "Exploit.Win32.Pidief.cjp",
        "risk": 1,
        "size": 7696,
        "type": "pdf",
        "facts": {
          "metrics": {
            "pdf": {
              "eof_count": 1,
              "page_count": 1,
              "action_count": 1,
              "header_count": 1,
              "object_count": 10,
              "stream_count": 2,
              "trailer_count": 1,
              "startxref_count": 1,
              "flate_filter_count": 1,
              "risky_feature_score": 26,
              "annotations_per_page": 0,
              "visible_object_count": 10,
              "signature_object_count": 0,
              "javascript_action_count": 1,
              "unreferenced_object_count": 2,
              "stream_bad_delimiter_count": 0,
              "leading_bytes_before_header": 0,
              "stream_invalid_length_count": 0,
              "stream_missing_length_count": 0,
              "stream_length_mismatch_count": 0,
              "stream_missing_endstream_count": 0
            },
            "file": {
              "size": 7696,
              "entropy": 4.55
            },
            "binary": {
              "peak_region_bytes": 1024,
              "peak_region_entropy": 5.27
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.document_as_unknown": 1
            }
          }
        },
        "ident": {
          "title": {
            "value": "��",
            "source": "pdf.info.title",
            "verified": false
          },
          "trust": "unsigned",
          "authors": [
            {
              "name": "k��S�`�iu�\u0002?6q��",
              "role": "author",
              "source": "pdf.info.author"
            }
          ],
          "producer": {
            "value": "PDF Library 5.3.2",
            "source": "pdf.info.producer",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/document/pdf/properties::pdf-action-javascript",
            "atk": "T1059.007",
            "conf": 0.9,
            "crit": 3,
            "desc": "PDF JavaScript action present"
          },
          {
            "id": "metadata/document/pdf/properties::pdf-filter-chain-multi",
            "conf": 0.9,
            "crit": 3,
            "desc": "PDF stream uses multi-step filter chain"
          },
          {
            "id": "metadata/document/pdf/structure::pdf-names-javascript",
            "conf": 0.9,
            "crit": 3,
            "desc": "PDF Names tree includes JavaScript"
          }
        ]
      }
    ]
  }
}