{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.005723374895751476,
        "class": 0
      }
    ],
    "prob": 0.005723375,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.005723375,
        "class": 0
      },
      {
        "m": "az/archive",
        "prob": 0.0023474556,
        "class": 0
      },
      {
        "m": "az/tar.gz",
        "prob": 0.0038693047,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9953178,
      0.9991311
    ],
    "analyzed_at": "2026-05-02T23:30:00Z"
  },
  "path": "opensearch-3-reporting-3.4.0-r4.apk",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(AsC)Md",
        "x": 1,
        "id": 0,
        "sz": 6931592,
        "ts": [
          {
            "c": 0.8799999952316284,
            "d": "Java invoke reference",
            "e": [
              "invoke"
            ],
            "i": "objectives/command-and-control/backdoor/loader::invoke-string",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Gzip-compressed data blob",
            "e": [
              "1f 8b"
            ],
            "i": "objectives/anti-static/obfuscation/payload/data-file::gzip-magic-data-blob",
            "l": 1,
            "m": "F0001"
          },
          {
            "a": "T1036.005",
            "c": 1.0,
            "d": "File extension claims Zip but content is TarGz",
            "e": [
              "expected=Zip, actual=TarGz"
            ],
            "i": "metadata/file-extension-mismatch",
            "l": 3
          }
        ],
        "sha": "528559d52174cb2e03e6e73e39163948b65c82fc1deb0321791a5580cfefdc2d",
        "path": "/data/samples/good/harvest/wolfi/opensearch-3-reporting-3.4.0-r4.apk",
        "type": "tar.gz"
      }
    ],
    "tv": "b2c18"
  }
}