{
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.94006515,
        "rte": "az",
        "prob": 0.94006515
      }
    ],
    "prob": 0.94006515,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.9400651454925537,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-01T17:31:50Z"
  },
  "path": "40c26c825bdfa2d7feec7f7cde369c443a15223782a8830fa5822e8ce325f7f7.iso",
  "raw": {
    "v": "8",
    "rev": "6096e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "yYFOTwb{fv00000blhV.ASxIFx8(=Gve}zIv/QAEz2!IPx-I@HwDhYgblhPYzVB\u003eVASxIFC(RKUv/QAEzu6Upblh-:wDlYIBPuaQASxUJve%*rz2!nIzu6UpblgHtzu8%5BPuH-zVAueBo2ktBo2.HASygYqugndx8(SCA@ZpZwDl-J00000blhATzuaeDyYFOTwb{fveDxX?zuaeDwDhYgblhiNzVBROz2!bEzua+UA@W=(A@ZpZve$rFBn#pvblhiNA@VgublhiNzVBROz2!bEzua+UA@W=(wDlPFwb(PfblhiNwDhYg-7@R#/crV-k(:NUq#=)#li6pKlJx:VqVGR]k(:mLmf0q/li6{:00",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 702236,
                "z": 1,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 702140
          },
          {
            "b": "@]=YHN=M)paELN%qVD^$l\u0026Wh!qVGO[mGux/r@+I^qufb=tMva\u003eyYE(zA@ZmYwDl=KtMs:7tMva\u003eoAm#\u003enDqcU00000tMw1e00000tMvs}pYJ\u0026.bME/A00000ra]#!azC)tvixV9x(W-oAa9^eC{3Qnze:i9wN(]HB-.K[BrCTmA+PGme=U\u003eKa]?PyASyjZzua8BA@Vgumf4udASy1TASviZve$9zyYFwNv/P{qBo31PzuaqHaollUwDlMEzVB!TC(PC%00000qVHwek(+%aA@Y[Ox8(/HpYLIox-I#Ive$rFC(Q!zzVBLMwDlPFpYLIox-JqRx-I@HwDluywDhYgqVHwenDrSdv/QJHwDlcsA@Y+Kq2\u003e.szVB\u003eVve%a7ASx!NB]VjRyYF2Dx8(Gy00000qVHweli7A]v/",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 787192,
                "z": 45,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 787096
          },
          {
            "b": "rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAf20rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40uest)!M2QHrAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAi40rAf",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: base64",
                "i": "metadata/encoded-payload/base64",
                "o": 847536,
                "z": 22,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 847472
          },
          {
            "b": "zuaqHaolD.wDlVHve$rFve$xHzVB!Taok)KxAhDvASxIFv/QPJwDl-Jaok*Iw=M]MwDl-JaolfSwDl#QCk#KYASxRIe=U\u003eK00000QEX4(M#2x]Nm{J^HsO[zk#/Y:ml@Q=o@O8kb=r=#Dj]:XTIHa-yEulxRMx*#\u0026K.b]R77D\u003e\u003el)Ufk!VcB?HF82OOHqg!uNOEi(\u003cF7=[\u003ezgUGE-RLMu:SI2H}IvDU6[8U:pj4B%\u003c:d\u003c79L9V6J1V$uQ-@\u003c#\u003e}fnq]{h9O%0GkL]dx*rSqX?u87OEi./)LUyljd\u003cIrwo9.rC#63f/RYe\u003e?Na%l.wSHsAy^Q#pW%:j58cOsk:FII98a\u003cxa{K^au1YyTU(]MLA9}fJpac^z",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 913344,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 913248
          }
        ],
        "mol": "MdTh",
        "sha": "40c26c825bdfa2d7feec7f7cde369c443a15223782a8830fa5822e8ce325f7f7",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-06/40c26c825bdfa2d7feec7f7cde369c443a15223782a8830fa5822e8ce325f7f7.iso",
        "risk": 37,
        "size": 1521664,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 1521664.0,
              "entropy": 7.1,
              "size_bytes": 1521664.0
            },
            "binary": {
              "overall_entropy": 7.1,
              "peak_region_bytes": 564224.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/base64",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: base64",
            "spans": [
              [
                847536,
                22
              ]
            ]
          },
          {
            "id": "third_party/bartblaze/generic/AutoIT/autoit_script",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
            "spans": [
              [
                702236,
                1
              ],
              [
                787192,
                45
              ],
              [
                913344,
                8
              ]
            ]
          }
        ]
      }
    ]
  }
}