{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9815003871917725,
        "class": 1
      },
      {
        "id": 1,
        "prob": 0.9461491107940674,
        "class": 0
      }
    ],
    "prob": 0.9815004,
    "class": 1,
    "oprob": 0.9461491,
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-05-01T10:23:40Z"
  },
  "path": "4f644f0415f7f74f2f8a5883310b93984df6f564e2c8864323e803b208ba451d.zip",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO(Ca)",
        "x": 119,
        "id": 0,
        "ss": [
          [
            23,
            "https://www.avira.com/en/support-threats-summary/tid/29207/threat/ADWARE.OSX.Xamloader.A.1"
          ]
        ],
        "sz": 449634,
        "ts": [
          {
            "c": 0.949999988079071,
            "d": "Xamloader readme archive member",
            "e": [
              "Xamloader/readme.txtUT"
            ],
            "i": "well-known/malware/dropper/xamloader::xamloader-readme-name",
            "l": 4
          },
          {
            "c": 0.9800000190734863,
            "d": "Xamloader DMG archive member",
            "e": [
              "Xamloader/Xamloader.dmgUT"
            ],
            "i": "well-known/malware/dropper/xamloader::xamloader-dmg-name",
            "l": 4
          },
          {
            "c": 0.949999988079071,
            "d": "Xamloader basename token",
            "e": [
              "Xamloader.zip"
            ],
            "i": "well-known/malware/dropper/xamloader::basename-xamloader",
            "l": 4
          },
          {
            "a": "T1566",
            "c": 0.8500000238418579,
            "d": "Cordova config allows external domain origin",
            "e": [
              "https://www.avira.com/"
            ],
            "i": "objectives/credential-access/phishing/workflow::cordova-external-origin",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Xamloader encrypted archive sample",
            "e": [
              "Xamloader/Xamloader.dmgUT",
              "Xamloader.zip",
              "Xamloader/readme.txtUT",
              "Xamloader/Xamloader.dmg"
            ],
            "i": "well-known/malware/dropper/xamloader::xamloader-archive",
            "l": 5
          }
        ],
        "sha": "4f644f0415f7f74f2f8a5883310b93984df6f564e2c8864323e803b208ba451d",
        "path": "/data/samples/bad/harvest/macos/Xamloader.zip",
        "type": "zip"
      },
      {
        "dp": 1,
        "id": 1,
        "ms": {
          "text": {
            "digit_ratio": 0.26,
            "space_count": 2.0,
            "total_lines": 7.0,
            "char_entropy": 5.32,
            "unique_chars": 51.0,
            "avg_line_length": 33.43,
            "max_line_length": 116.0,
            "empty_line_ratio": 0.29,
            "last_line_length": 116.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.03,
            "most_common_ratio": 0.06,
            "line_length_stddev": 44.72,
            "max_inline_whitespace_run": 1.0
          }
        },
        "ss": [
          [
            0,
            "XAMLOADER"
          ],
          [
            11,
            "writeup(s):"
          ],
          [
            23,
            "https://www.avira.com/en/support-threats-summary/tid/29207/threat/ADWARE.OSX.Xamloader.A.1"
          ],
          [
            124,
            "Xamloader.dmg -\u003e https://www.virustotal.com/#/file/11ae97b5418847560a75e60beec470c86a593febd7492f8431dcc94650188e18/"
          ]
        ],
        "sz": 240,
        "sha": "e41e59680633f1f0182043b3fb26c57afde885d26428a0955e906ecf5ba25256",
        "path": "/data/samples/bad/harvest/macos/Xamloader.zip!!Xamloader/readme.txt",
        "type": "text"
      }
    ],
    "tv": "50726"
  }
}