{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Obfuscated .NET payload with reflection"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.8651014,
        "rte": "az",
        "prob": 0.8651014
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T00:12:03Z"
  },
  "path": "4093c7ea8074372cfdef4478cfba0566f602cceef573dbe10785ea8758b68d1b.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^)BAy@3xK$Y%pgXR(pJx#SAV=FEarR^HarR^HarR^b00000000200rr9100f8100000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "Fm?.BoHSUY(.Yv4R*}OeRIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFh?vnBZ[6gl}6yv(.Yv4R*}Sxq9)OmRIarlFA%7=)5by1RIarlFA%7=)5bwaoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268*tRIarlFA%7=)5bwDlf\u003ez3)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5by1RIarlFA%7=)5bwhlf\u003ez3)5by1RIarlFA%7=)5by1",
            "n": [
              {
                "c": 4,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 308377,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 308281
          },
          {
            "b": "x(!xcAZs\u003eSx(4i!y?k}EzEENhl$7gCnO@A.wO(0@Byxo9z/bLNxM53fwk3]Iwk)?[wPE\u0026qB8$]fvR*q\u0026q*ACawO\u003c4$wOb:\u0026v@#B6zua9^B7Gh$y\u003cu1DwmOISx(dNax)a5!D2Nto06$dal349Uzdmsbrc-B]A@X^Mr://Uwi$0FvrcSYvrt{SD2Nr{l1BI9D2Nr{m}D^vxM4{kpgn0J0aYIWve@(um}DNHA+P2.D2Nr{lVM:DBy^%NzE)\u003c5v]N.)wDkkiBn",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 830992,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 830928
          },
          {
            "b": "BA{k(ze-{7wPzfk0b2\u003e+uQOEqvrDyd07H)EzddI^nK^SszddJ.A=lbnwmY=YqE%/-vpJ\u003cGm}D^wD2Nr{nP5Y\u0026yH{jKzdm6%077yqwmY=Yo\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv/PhhBy^^MzE^E0x8\u003eUuv@=Hez!s8zr+VR$vqFnsB7]bplVl*Xx(4v3q!o#)x\u003e7Z}08c*ywK*rN08)#Wx(mN808)#WqE$2.A=U^(mSJA:lsB}Dhz!uOA+PA707?6I",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 850574,
                "z": 12,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 850510
          },
          {
            "b": "lVl*Jx(mFZxjVf(l349Uzdmsb07QQxpHX6Iv@}YxzGEV\u002607y^FzdN-@Bz(g1o\u003c}*Gm}DNHA+P2.D2Nr{l1t1JC42GhASwEBAcRBNwPQBNzE)\u003c5v)LcFB.$YcBAmBNB3T\u003e*x\u003eIr(vR/QBA=k^{xjVf(nPNykzE)\u003c5v]N.)wDkp?z!%l3v@#B6zu9QHzF9=%077Qxy?m3)07y^FzdN-@vR/PQq*ACawO\u003c4[x(m[\u003cl2puqxjVf(r://!wDlvOBn",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 850812,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 850748
          }
        ],
        "mol": "MdTh",
        "sha": "4093c7ea8074372cfdef4478cfba0566f602cceef573dbe10785ea8758b68d1b",
        "path": "4093c7ea8074372cfdef4478cfba0566f602cceef573dbe10785ea8758b68d1b.iso",
        "risk": 37,
        "size": 872448,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 872448.0,
              "entropy": 7.26,
              "size_bytes": 872448.0
            },
            "binary": {
              "overall_entropy": 7.26,
              "peak_region_bytes": 442368.0,
              "peak_region_entropy": 7.84
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                830992,
                17
              ],
              [
                850574,
                12
              ],
              [
                850812,
                9
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                308377,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}