{
  "ml": {
    "v": "7",
    "eng": "2.13.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00030481815,
        "rte": "az",
        "prob": 0.00030481815
      }
    ],
    "prob": 0.00030481815,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00030481815338134766,
        "type": "rar"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-10-22T19:21:30Z"
  },
  "path": "Wolf-Jhomesia.rar",
  "raw": {
    "v": "8",
    "rev": "76e61",
    "files": [
      {
        "id": 0,
        "mol": "O(C)Md",
        "sha": "574b6a59c05e70e1e4a64d36c6cc8fb93e6908d4deed273c968e7bc0bf1a3954",
        "path": "/data/samples/incoming/forager/sighted/sha256/triage/Wolf-Jhomesia.rar",
        "risk": 2,
        "size": 354456,
        "type": "rar",
        "facts": {
          "metrics": {
            "rar": {
              "solid": 0,
              "locked": 0,
              "volume": 0,
              "recovery": 0,
              "acl_count": 0,
              "quick_open": 1,
              "end_present": 1,
              "split_count": 0,
              "blake2_count": 0,
              "quick_open_size": 111,
              "headers_encrypted": 0,
              "ntfs_stream_count": 0,
              "child_header_count": 0,
              "file_version_count": 0,
              "unknown_extra_count": 0,
              "service_header_count": 1,
              "unknown_header_count": 0,
              "v1_compression_count": 0,
              "mapped_unix_name_count": 0,
              "header_crc_mismatch_count": 0
            },
            "file": {
              "size": 354456,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 354304,
              "peak_region_entropy": 7.86
            },
            "archive": {
              "file_count": 1,
              "member_count": 1,
              "script_count": 0,
              "leading_bytes": 0,
              "trailing_bytes": 0,
              "zip_bomb_ratio": 2.63,
              "compressed_size": 354192,
              "directory_count": 0,
              "executable_count": 1,
              "extra_field_size": 67,
              "noise_file_count": 0,
              "compression.ratio": 0.38,
              "hidden_file_count": 0,
              "uncompressed_size": 931328,
              "max_filename_length": 17,
              "rtlo_filename_count": 0,
              "nested_archive_count": 0,
              "path_traversal_count": 0,
              "security.setgid_count": 0,
              "security.setuid_count": 0,
              "security.sticky_count": 0,
              "double_extension_count": 0,
              "duplicate_member_count": 0,
              "security.symlink_count": 0,
              "unicode_filename_count": 0,
              "homoglyph_filename_count": 0,
              "security.encrypted_count": 1,
              "timing.mtime_unique_count": 1,
              "timing.mtime_unique_ratio": 1,
              "misplaced_executable_count": 1,
              "timing.mtime_dominant_count": 1,
              "timing.mtime_dominant_ratio": 1,
              "timing.mtime_spread_seconds": 0,
              "timing.sentinel_mtime_count": 0,
              "security.world_writable_count": 0,
              "compression.method_counts.rar-normal": 1
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/archive::archive-encrypted-member",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive declares an encrypted member"
          },
          {
            "id": "metadata/file/archive::archive-member-over-200kb",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive has member larger than 200 KB"
          },
          {
            "id": "metadata/file/archive::archive-misplaced-executable-member",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive executable placement heuristic matched"
          },
          {
            "id": "metadata/file/archive::archive-windows-executable-entry",
            "conf": 0.86,
            "crit": 3,
            "desc": "Windows executable archive member"
          },
          {
            "id": "metadata/file/archive::partial-extraction",
            "conf": 1.0,
            "crit": 3,
            "desc": "Archive could only be read in part (1 extraction problem)"
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/rar::rar-fat-exe-member",
            "atk": "T1027.002,T1204.002,T1564.004",
            "conf": 0.94,
            "crit": 3,
            "desc": "RAR wraps a large Windows executable",
            "uses": [
              1,
              3
            ]
          }
        ]
      }
    ]
  }
}