{
  "llm": {
    "conf": 0.99300003,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "ISO contains .NET reflection loader dropper"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9692215,
        "rte": "az",
        "prob": 0.9692215
      }
    ],
    "prob": 0.99,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9900000095367432,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T19:36:40Z"
  },
  "path": "40ba01aaffa0dad87807e0b8fe4f0d3d5a8da63bd5d7193b56706d4cc0003a89.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^{z*c8nz^^f-rb#zSyIvW0uS7DEwPzv1v}vnFiw8#=000000001%0rr9100e$$000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c[O=0STIH0SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao",
            "n": [
              {
                "c": 5,
                "d": "ISO .NET reflection resource loader",
                "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader",
                "o": 32769,
                "z": 5,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 32641
          },
          {
            "b": "0UbxZ2ls/c0UbA.2MT]ddTz6@@UlTT00ii7Ef/]O1oFZO3ipbf0Ti#W0rrlL*5IiN6^J+V0S\u0026EL3\u0026{th0T9]X0rrl71:{\u003cY00Auk1BQ^Y00Auk1:{{.00Auk27m6:00B=T00rcmc\u0026:kG0T0\u0026=0rrl71BR3^00B+Klq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn\u003eW%\u003e}byPQ)ra(miPG@LTbu5Y8x(mN800000]R?/\u003c93b7WbumUx5xB?K5c8Xgbs+:9l\u0026Wh!aJKJ.Bq+bVbsli+vGlxd000000SSi3sdM6m2{fcE0qVZL02tLm0rr91=\u0026s4CdGxCG76aynjotG.Z5XilSq##03JHebBoqHy0SSi2sPwB47xsBn^/ovFBo8vw3ig5a1onA40rr911][S64GDFe4fcwd1][S69rl6t0SSi2002t40rr91000i6[F8(}1]%-27+(i{Kq7?K4/\u0026sW000i6",
            "n": [
              {
                "c": 5,
                "d": "ISO stages a .NET resource payload",
                "i": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager",
                "o": 110608,
                "z": 4,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 110480
          },
          {
            "b": "lum0*B75J]wKgAWA+P09By+Cvwncd7AZB!+Cxmh4y?k[OBAh88B-.f{lVl*xx(^#$y?k[OBAh88B-.f{l349Uzdmsbrb3C\u003cwKgAWA+P09By+CJByx5$vrb)Mz!a0bwKgAWA+P09By+Cyx\u003eg^Hz!a0bwLMVJwKgAWA+P09By+CuwNY^{xjV9ZBy/z\u003cxMw3lxj%OMBAh88B-.f{l349Uzdmsbrb#zTwO\u003e\u003c@yE95:A+P09By+CKvrc0(BvHpVzdN{fA+^%.BAh88B-W",
            "n": [
              {
                "c": 3,
                "d": ".NET AssemblyTitleAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
                "o": 142672,
                "z": 22,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 142608
          },
          {
            "b": "vruj4zC\u003e4Zvr=j5x(v)gl3di?x\u003c#jbwDk2qB7Gh$y\u003cw\u0026$z!a02Bu$1\u003cA+P09By+CrB8$]fvR*rSz/x#xx\u003eIa3l3di?x\u003c#jbwDkbbBy!A=zdM7MzGx]dzGFf^BAh88B-.f{lV)D(z/4\u003cWzGx]dzGFf^BAh88B-.f{l349UzdmsblVl*XvqZuRBAzLqvS=^708^@SBzkP6lVl*Xvrui)x(4H9C%MK]A+P09By+Crv}f7\u003eB7F(YxMw3lxj$aZz/xodBA{e]BAh88B-.f{B7GD2rDz.IxK#0@mr\u0026xNB-.f{xjVf(o\u003e!G/By+CsD30P$B7GD2r://!wDlNOra{q-vpSqUvrui[r://!wDk!CBza9^wO#Qhr://!wDkkiBwDvXwN/*.vqH6$0cR^!B.7LKvrMhZqE%Y-C4yUwx(^^8wPRT8zEENhl1sZ-wQ4+^xjVf(q!ZL?0cqZ[uSgV+wDlvOBye0=Byw#:x)Ks\u003cB7GD2o\u003c@oXzfoX]x)Ks\u003cB7GD2l3mo/",
            "n": [
              {
                "c": 3,
                "d": ".NET AssemblyCompanyAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-attr",
                "o": 143067,
                "z": 24,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 142939
          },
          {
            "b": "0b2\u003e+uRbcBy?W=}BzkVh08ESAx()^1nP53Ox(mv3x(v\u003e?q*ACawO\u003c4!z/ff3xlwl6BzkVh07y)5B-.5lx(v\u003e?n\u003c(3+ze:Stvruj4zu9QXB97#ge\u003eo.@vQT7!Dsp]fz/bLxA^qRCz:v(Px(v\u003e?nP5SYA:-E1x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9TRwO1RPwmXbDy\u00260V)BzkVh090xoy?lpGD2E?ElVl^-zeJo]D2d4Vz!%l3v@#B6zu9TAvR/QHvr(^lBw^43q/)q3wKyxLy?m9#x(v\u003e?raflLwLuJTz/{d?z/fVqz!}^Vy\u00260V)BzkVh090(Py/tB@x(DT=wO\u003c!My\u00260V)BzkVh08E6swN/*Hz!%l3v@#B6zu97sA+e:5x(v\u003e?l1jzCA::67z/d{XA=L-3BzkVh08mfGv[7PUv@#B6zu9^nz/YSmx(v\u003e?sX%3Tx([6czu9\u003cpz/YSmx(v\u003e?mpQdgz/YSmx(v\u003e?q/#$FwP7y-B7]-gz/bLzAr",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 147863,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 147735
          },
          {
            "b": "pHX6Iv@$K/z*2\u00269wPv=/uQF:GAclnlA.*dVwN/*UA=lbnwmY=Yzc{1.s7L\u0026twPz%dv}xZSvRPE:BwN0@C4\u003eF#ASx@-o)GiDA=2\u003e[vRPE:BwN0@C4\u003eF#ASx--BydEWx\u003eg^)v}wtLv@1RNy?d9$0cqZ?wmY=YxjVf(qE%]/B-H#6o\u003c}{FxjV8-zc}c\u003eB8$]gxjV8-xjVf(zdN^fwO#c(ASye(Bye(@B8$]gxjV8-lsB}Ds8Sa{wPv=rz/oVbx(mv3wPH{\u003eA+/lb0axzGwN[tuzE^M{ASwHoByw6Uv}xv$wN[kMwO#PXvqYQ(wPv=uz/PXZy\u0026sxezF8yYwO#PXvqYQ(wPv=HxMXAcz*c7/C4CMknmuyDy?mR!p*[6QBvyv:zGFATzE^M{ASx6VwO1[RwP{N^wO#PXvqYQ(wPv=HD2[7sz7Xg]wmXeEz7Xg]ze:i9wPv=Ix(dB407/K@zGGr3zE)?*B7GD2nPNQpx*V/RByw)3wPv=xzFT1",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 148993,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 148865
          },
          {
            "b": "z/L?RwPQ:?z!-\u0026[Bvyj\u003cz/L?Sz/oC\u003cBAh8mq!o]RA::6dASwW1zGP/cA::6dASwQvBvy7\u0026zdN-@Bz(g1l1t1JC42GhASv.4Bz(g1e[nykz/L?Lz/fohz/L?BA+eW3wKH9tA^qRCz/L?BA+eW3wKQGDA^qRCz/L?DA=Id)wPRoIz/{72q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SAx\u003e8g4B8LVje((XcBZY8Mvrlc)e\u003c%n]x\u003e7Z}0b2\u003e+uSQ/Fq!o#)x-",
            "n": [
              {
                "c": 3,
                "d": ".NET Activator reflection marker",
                "i": "metadata/file/format/structured::embedded-dotnet-activator-reference",
                "o": 149617,
                "z": 9,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 149553
          },
          {
            "b": "A@VgN0rrQ7C}JffvPc\u0026UC4\u003eC$A@VgK0rrH4C}J3bBAzkmxla4MV\u0026y7a=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx000000000008L%H",
            "n": [
              {
                "c": 3,
                "d": ".NET ResourceReader reference in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-reader",
                "o": 168636,
                "z": 24,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 168572
          }
        ],
        "mol": "O₂(AsC)Md",
        "sha": "40ba01aaffa0dad87807e0b8fe4f0d3d5a8da63bd5d7193b56706d4cc0003a89",
        "path": "40ba01aaffa0dad87807e0b8fe4f0d3d5a8da63bd5d7193b56706d4cc0003a89.iso",
        "risk": 239,
        "size": 866304,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 866304.0,
              "entropy": 7.59,
              "size_bytes": 866304.0
            },
            "binary": {
              "overall_entropy": 7.59,
              "peak_region_bytes": 689152.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                147863,
                17
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-reader",
            "atk": "T1027.009",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET ResourceReader reference in opaque content",
            "spans": [
              [
                168636,
                24
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-metadata-sig",
            "conf": 0.9700000286102295,
            "crit": 3,
            "desc": ".NET metadata signature string in ISO content",
            "spans": [
              [
                110608,
                4
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-activator-reference",
            "atk": "T1620",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET Activator reflection marker",
            "spans": [
              [
                149617,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                148993,
                15
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::primary-volume-descriptor",
            "conf": 1.0,
            "crit": 2,
            "desc": "ISO-9660 primary volume descriptor marker",
            "spans": [
              [
                32769,
                5
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyTitleAttribute marker",
            "spans": [
              [
                142672,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyCompanyAttribute marker",
            "spans": [
              [
                143067,
                24
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader",
            "atk": "T1027,T1140,T1620",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO .NET reflection resource loader",
            "spans": [
              [
                32769,
                5
              ],
              [
                110608,
                4
              ],
              [
                147863,
                17
              ],
              [
                148993,
                15
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager",
            "atk": "T1027,T1140,T1620",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO stages a .NET resource payload",
            "spans": [
              [
                32769,
                5
              ],
              [
                110608,
                4
              ],
              [
                143067,
                24
              ],
              [
                147863,
                17
              ],
              [
                148993,
                15
              ]
            ]
          }
        ]
      }
    ]
  }
}