{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Executes PowerShell script via VBScript"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.9995678,
        "rte": "az",
        "prob": 0.9995678
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T03:37:36Z"
  },
  "path": "3da1cb0608f3709bf1331c4088fb258daf0200740b9b67afc6eec68a7f4b111a.iso",
  "raw": {
    "v": "8",
    "rev": "0ea32",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "ax7\u003c4atkw\u003cyD2d7r:5A%ph%(rx(v(\u003cy^IoGl@v8Vok!09xM^(Xk#y6BlqZ3)wQl^s4gj:wax7\u003c4atkw\u003co*JL+k}#wdltf7XqzpW!m%WE8lt64]lp2lUmqCIjsYY\u0026(vqXXJv@i@D4gj:wax7\u003c4atkw\u003cvqPT\u0026r-\u0026KwvPk=[o*HQak}#wdlu^SArwDpDt5ubPsYv*#o*SF.k}#wd4gj:wax7\u003c4atkw\u003clUyQvq8gdNvLQ\u00268nKVxvnKW(yvPNw1t31NCnMm#/lt64]lo$",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: base64",
                "i": "metadata/encoded-payload/base64",
                "o": 64002,
                "z": 22,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 63938
          },
          {
            "b": "ax7\u003c4atkw\u003cq*hwjr-gR-lpB:}qeeA-z:VG@p!s!FvmToIv)\u003elUoFPv*vNA20t31DM4gj:wax7\u003c4atkw\u003cvol#.oL)KFvPbo^t31DMvol#.ry*e8vN\u003elHq8gdEt2[yqs#4%OvR]TO4gj:wax7\u003c4atkw\u003cvLP}$rCCw^oL)KIvNJKwlt6}Klt5.Rlq.kVk#yK6o?c)YqFfc7olTJ94gj:wax7\u003c4atkw\u003clqZ-No*IAxpI\u003c=0wjP0AoNeTkv@td^v\u003e}81wjHDNvTf?CvLPSXrwEP\u00264gj:wax7\u003c4atkw\u003cwjHDNvLHh7s-5z5sUJP]t1qQ)vol#Zvoks7rC::twjxcAph8OfpbkK/4gj:wax7\u003c4atkw\u003cnQ1reolTJ9lqZ-No*IotmLXThwjP0AoNeTwsU\u0026/%oM0QwsU\u0026@{s#56W4gj:wax7\u003c4atkw\u003csU-0Vo*HE6lSm${q+pBOl@uxtl{T*sk@qe2k#x{rfeMvowhl\u003emvS3s44gj:wax7\u003c4atkw\u003cmPf",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: base64",
                "i": "metadata/encoded-payload/base64",
                "o": 67642,
                "z": 42,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 67578
          },
          {
            "b": "ax7\u003c4atkw\u003cs#nVxk#yGCo*@?/k}#wInoW%0o*}u(p\u0026O=Xz:XOnpE/7LwjP0AoNeTk4gj:wax7\u003c4atkw\u003cv@lBjv\u003e}81wjHDNvTf?CvLPSXrwEP\u0026wjHDNvLHh7s-5z5sUJP]t1qQ)4gj:wax7\u003c4atkw\u003cvol#Zvoks7q7$Ero)P@+sU\u0026V\u003eo?o4\u0026lQL]+k#ySKlu+\u003c+lpsm/o)PU\u003e4gj:wax7\u003c4atkw\u003clt6}Klt5.Rlq.lpl2P).vmToIv)\u003elUoFPv*wj5k2t31DMvol#.oL)KF4gj:wax7\u003c4atkw\u003cvPbo^t31DMvol#.ry*e8vN\u003elHq8gdEt2[yqs#4%OvR]Tzqc3nmph8O24gj:wax7\u003c4atkw\u003cv@td/nQ1reolTJ9lqZ-No*IotmLXThwjP0AoNeTwsU\u0026/%oM0QwsU\u0026@{4gj:wax7\u003c4atkw\u003cs#56WsU-0Vo*HE6lSm${q+pBOl@uxtl{T*sk@qe1xhI0igGcT@AA1/o4gj:wax7\u003c4atkw\u003cx\u0026C",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: base64",
                "i": "metadata/encoded-payload/base64",
                "o": 70666,
                "z": 42,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 70602
          },
          {
            "b": "lQs17k%W!5k#x{ll1ri8k%W!5k%W!5k%YcIk%W!5k%W!5l0lGtk$Kvdk%W!9k%W?6k%W!5k%W!5k%W!9k%W!5Dr9\u003cdk%W!5k#?LTk%Xvlz9*JOpEPE{xH$GQxgb3Kk%W!5k%W!5yeM)5hBI:Qlu+\u003c:k#*uNk%W!eBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268!tk%W!Fk%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!lk%W!5k%W!5k%W!5k%W!5k%W!5ml%j9k$a79g\u0026MF{s5SQHx(FeDlVM:DBy!lSygQ)%c)A.CwO=fnvq{g4x\u003e7N[x(v(kdk2WPwO=f]CX7xcBy=\u003cAAbP@iA=U]9y?$pDar\u0026yaCX7xcBzkVhp\u0026ye:v%Gg-D2NhkB0bBkB7GD4tWg]Zvrui(wId}yf^nd\u003ea%FMXb5.BizxZROfEY6)3jNs}fcBg+m\u003c6DravoTLx(k5m",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 718692,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 718564
          }
        ],
        "mol": "MdTh",
        "sha": "3da1cb0608f3709bf1331c4088fb258daf0200740b9b67afc6eec68a7f4b111a",
        "path": "3da1cb0608f3709bf1331c4088fb258daf0200740b9b67afc6eec68a7f4b111a.iso",
        "risk": 109,
        "size": 759808,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 759808.0,
              "entropy": 5.57,
              "size_bytes": 759808.0
            },
            "binary": {
              "overall_entropy": 5.57,
              "peak_region_bytes": 24576.0,
              "peak_region_entropy": 7.8
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/base64",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: base64",
            "spans": [
              [
                64002,
                22
              ],
              [
                67642,
                42
              ],
              [
                67810,
                42
              ],
              [
                70666,
                42
              ],
              [
                70834,
                42
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                718692,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}