{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8556042313575745,
        "class": 2
      }
    ],
    "prob": 0.85560423,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.19859298,
        "class": 0
      },
      {
        "m": "az/archive",
        "prob": 0.102757506,
        "class": 0
      },
      {
        "m": "az/msi",
        "prob": 0.85560423,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T12:03:55Z"
  },
  "path": "40b62662e85cefe2b1b30a13cbb7acf8b95ddea535b0ddc8eb2cb1556aee81e2.msi",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C₂)H(Db)",
        "k": {
          "summary.title": "Installation Database",
          "summary.author": "Nano Labs",
          "summary.application": "Software distribution package"
        },
        "x": 1,
        "id": 0,
        "ms": {
          "file": {
            "size": 28930048.0
          },
          "office": {
            "ole": {
              "page_count": 500.0,
              "word_count": 10.0,
              "stream_count": 23.0,
              "storage_count": 1.0
            },
            "doc_type": "msi"
          }
        },
        "sz": 28930048,
        "ts": [
          {
            "c": 1.0,
            "d": "Document metadata: title: Installation Database, author: Nano Labs, app: Software distribution package",
            "i": "metadata/format/properties::doc-properties",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.8999999761581421,
            "d": "Windows executable filename in bytecode",
            "e": [
              "p4K6nC2ZVAja3Oe3IczG86Df1yme6GF0cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download::windows-exe-temp-staging",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1105",
            "c": 0.8199999928474426,
            "d": "cmd.exe /c pair in Java bytecode",
            "e": [
              "cmd.exe /c"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download::java-cmd-exe-c-pair",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8799999952316284,
            "d": "Java invoke reference",
            "e": [
              "invoke"
            ],
            "i": "objectives/command-and-control/backdoor/loader/classloader::invoke-string",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "RAR member contains WSH script",
            "e": [
              ".js"
            ],
            "i": "micro-behaviors/data/archive/rar::wsh-script-member-extension",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "RAR member contains shell script",
            "e": [
              ".cmd"
            ],
            "i": "micro-behaviors/data/archive/rar::shell-script-member-extension",
            "l": 1
          }
        ],
        "sha": "40b62662e85cefe2b1b30a13cbb7acf8b95ddea535b0ddc8eb2cb1556aee81e2",
        "path": "40b62662e85cefe2b1b30a13cbb7acf8b95ddea535b0ddc8eb2cb1556aee81e2.msi",
        "type": "msi"
      }
    ],
    "tv": "51ad9"
  }
}