{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9333333373069763,
        "class": 2
      }
    ],
    "prob": 0.93333334,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.6687533,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 0.93333334,
        "class": 2
      },
      {
        "m": "az/pdf",
        "prob": 0.7314271,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-15T19:51:45Z"
  },
  "path": "5348a4476f38e590f7caf95d7335faa15103f6e6149e6ec7337edba4da89a65c.pdf",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "H(Db)Md(Pd)",
        "k": {
          "header.version": "1.7",
          "shape.eof_count": 1,
          "filter_chains[0]": "FlateDecode,DCTDecode",
          "filter_chains[1]": "FlateDecode,DCTDecode",
          "filter_chains[2]": "FlateDecode",
          "filter_chains[3]": "FlateDecode",
          "filter_chains[4]": "FlateDecode",
          "filter_chains[5]": "FlateDecode",
          "filter_chains[6]": "Standard",
          "filter_chains[7]": "FlateDecode",
          "filter_chains[8]": "FlateDecode",
          "shape.object_count": 13,
          "header.header_count": 1,
          "shape.startxref_count": 1,
          "form_fields[0].value_length": 1
        },
        "x": 2,
        "id": 0,
        "ms": {
          "pdf": {
            "page_count": 2.0,
            "object_count": 13.0,
            "objstm_count": 1.0,
            "stream_count": 8.0,
            "xobject_count": 2.0,
            "startxref_count": 1.0,
            "form_field_count": 1.0,
            "xref_stream_count": 1.0,
            "risky_feature_score": 8.0,
            "visible_object_count": 13.0,
            "unreferenced_object_count": 6.0
          },
          "file": {
            "size": 31746.0
          }
        },
        "sz": 31746,
        "ts": [
          {
            "c": 0.75,
            "d": "PDF chained stream filter array",
            "e": [
              "/Filter ["
            ],
            "i": "micro-behaviors/data/encode/custom::pdf-multi-filter",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "PDF stream uses multi-step filter chain",
            "e": [
              "FlateDecode,DCTDecode"
            ],
            "i": "metadata/document/pdf/properties::pdf-filter-chain-multi",
            "l": 3
          }
        ],
        "sha": "5348a4476f38e590f7caf95d7335faa15103f6e6149e6ec7337edba4da89a65c",
        "path": "/data/samples/bad/datasets/various/MalwareBazaar/pdf/5348a4476f38e590f7caf95d7335faa15103f6e6149e6ec7337edba4da89a65c.pdf",
        "type": "pdf"
      }
    ],
    "tv": "08128"
  }
}