{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Encoded executable payload detected"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.999518,
        "rte": "az",
        "prob": 0.999518
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T11:49:17Z"
  },
  "path": "3c4f10ba31cc2056b9c543638d6371484f3fbf11aea9fbb7e563046bef82b9c9.iso",
  "raw": {
    "v": "8",
    "rev": "935ec",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.m%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^]l%\u0026?/o=$M3arR^HarR^HarR^HarR^HarR^HarR^b000000002J0rr9100gWK00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "k%YYYxf[)Ik%W!5k%W!5m)PBbk%W!5k%YcIk%YcHk%W!5q9^Gpk%W!5k$a7-k%W!5q9^Glk$Mh\u003ek%W!5k%Xvmm)/NdlnRt3whEdHoHSUYk%Xpjk%W!5k%W!5l0k{CA7Az-mNYQxk%XvCq9)Mmk%W!5k%W!eoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268!tk%W!Hk%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!lk%W!5k%W!5l1-\u003eSk@ZIJk%W!5ml%j9k$%Thqe]So00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 215908,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 215780
          },
          {
            "b": "000000000000000000000000000000000000000000000000000000000000w{503BzkVhayM%DzEWQaBAICiwgg@7wP?T9wPI@AwmYy+y*?B1z/d1JC42zlvrcE3A+PD5x\u003c(78vrld7jZ*3-z!%YuwPh6]z/{aHdlzMYBAIRwayM%DzEWQaBAICiwiBKEzEW^5z/c$Ax(4%7A=U@9wH}!sy\u003cy8kAa9N3B-P0UB7]DlwPz\u003cawmW]Bx(4%7AS",
            "n": [
              {
                "c": 2,
                "d": "Decoded unicode-escape content",
                "i": "metadata/encoded-payload/unicode-escape",
                "o": 536576,
                "z": 57,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 536528
          },
          {
            "b": "lp$iGm[)/1r77s#x?zw=xI@[dzB!UGlT+aYyc+(\u0026k$2N5qChmEC#lCelQ=o6x??Aksx5)CD1q8tmNz5Wq=3CazawO!ryo8czCB+eCt0c.q^a6cDr93.r.M1rl}{Aok$K{(gFgRDlSX7)r6\u003eXfmOC:Km)*Z2xJd/9lq*lHk#gx\u003exg(]nlQtD/xf{k+x?-[xqb6}#gfEd!moIx\u0026rzcs^s7MC*qCh7ElQ-$rlRzwUxh\u00265EC#/8?f?URmr:!--Do$eDqbqgBxgM6sxHaduDp.Nur828sr7.g5qa-Yrqu",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: xor",
                "i": "metadata/encoded-payload/xor",
                "o": 923694,
                "z": 41,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 923630
          }
        ],
        "mol": "MdTh",
        "sha": "3c4f10ba31cc2056b9c543638d6371484f3fbf11aea9fbb7e563046bef82b9c9",
        "path": "3c4f10ba31cc2056b9c543638d6371484f3fbf11aea9fbb7e563046bef82b9c9.iso",
        "risk": 109,
        "size": 964608,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 964608.0,
              "entropy": 6.02,
              "size_bytes": 964608.0
            },
            "binary": {
              "overall_entropy": 6.02,
              "peak_region_bytes": 218112.0,
              "peak_region_entropy": 7.83
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/xor",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: xor",
            "spans": [
              [
                923694,
                41
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                215908,
                52
              ],
              [
                216051,
                13
              ]
            ]
          }
        ]
      }
    ]
  }
}