{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "WarHawk backdoor detected in ISO"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.99726284,
        "rte": "az",
        "prob": 0.99726284
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-01T21:53:20Z"
  },
  "path": "58b3686e4255d32dbcf7dee9dac1d5be6d4692d086cde167da1e1a5e0e1b315a.iso",
  "raw": {
    "v": "8",
    "rev": "f11ae",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "008z-Vh^@ax-J2Jwb{JFCk#W:000=ms]ZnS00000fi5Pf5cbTOB97#ggCO}gli4q(1ov]8HFJa+gGtCQe=U\u003eK*6^@Y000310000000000000000065-Jq#(SC(R)=Bo2\u003eLz2=u(g5}pO7YWOpg5}q\u003c1op[\u0026B8A92v@k:ewQ4+^kMz8\u003c1ov]8mPjwCgGvKoe=U\u003eKa/UIx0003100000Fb/MH00000002SdP-wN5z2!8De=YC.CMqpP000=m002Q\u003e000#s00031000#s001OJ00000002N\u003c000Ph00093007Otu\u0026Q-r0000^i:t:2zE^WfB6IT?B97#ggCSiBzdCngCX3\u003cPbMGB%e=YbRe=WH7tMuwRe=YbRe=WH7tMv?9x-J2Jwb{JFCk#W:tMvX5C(R)=Bo2\u003eLz2=u(g5$LVv/QuCwb[jZwDl@PwDj^(f92FZaoksuq#/h:qufU@aoj4{li5bdqug!syYD:3BPt}Lx-J5",
            "n": [
              {
                "c": 5,
                "d": "Detect the WarHawk backdoor used by the SideWinder intrusion-set",
                "i": "third_party/Sekoia/Backdoor/Win/Warhawk",
                "o": 61753,
                "z": 7,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 61625
          },
          {
            "b": "ADlbxB-}$ND3R+ylQTvjm[uizoh55PpF:[^q=D:$s6eQefFLssg=mfIi5{%slPLhEtoA[Cl@DPSmpe}Yo\u00261!Qlqf/Fl@DPSmpe}Yo\u00261.S00000l@DPSmpf4\u0026ohnn:p5\u003em]l@DPSmpeIQsvCQTl@DPSmpezIqCQ0!DT4+jvqPNXb03\u0026Ka%?qna$K\u003cwb6n9HwN3Auay39pB6G]qefB])b}}8+fc@qcwg]ltarR%:ggSA(fFWesdLrgJe=U\u003eKe?Nb700000DMVMqzEEx[tP#iKtP$FntP$ZwtQ1l6DsZt9iV}VKtP$ZwtQ136wlZrtay39pB6G[uay3ajD2Nt1b03\u0026Kb1uo.wGUP6y?d9$tP$qsec2UI00000DMVMqzEEx[tP#iKtP$FntP$ZwtQ136wlZrtay39pB6G[uay3ajD2Nt1b03\u0026Ka%?qna$K\u003cwb6dEAwN3Auay39pBZcakEjLu#t(T\u003c8DMTItxM[f3b03?\u003cc37mYar\u003ef8x(4u$xl4u\u0026z/fbgiV]R*A=\u003e}qefDczA+frhz/fScb03?\u003cc37mMEe\u003clEDMTItxM[f3b03?\u003cc37mYar\u003efmvrlidiV]R*A=\u003e}qaBKj\u0026fAq7MuUK3JuVZNjwDhYguV*y900000f-RgNz/xo900000DMTItxM[f3b03?\u003cc37mYar\u003efmvrli\u003ewn=u%b03?\u003cBAhIna$K\u0026XuUK3{iV]Q)B0q-P00000g5}pOgxmyPDMTItxM[f3b03?\u003cc37mYar\u003ef5zdB?Kar\u003e]FB.8:tEe\u003clEe[eKj00000fjMaJB09T?c364^v@k:ewQ4+^DMTItxM[f3b03?\u003cc37mYar\u003ef5zdE0:z/fbgiV]R*A=\u003e}qefDczA+frhz/fScb03?\u003cc37mMEe\u003clEDMTItxM[f3b03?\u003cc37mYar\u003ef8x(4u$xl2gSar\u003e]FB.8:tEe\u003clEwo8ycwDhYgDMTItxM[f3b03?\u003cc37mMEe\u003clEp\u0026ZF+BZ]I*vqPMQq+]\u003eZs3Y.MtUO{xA=l2qw]}oVx(mE1Cxj)4r9R!kA=L-eBxh%[B7]Mg0000000000DMTItxM[f3b03?\u003cc37mYar\u003ef5z/6DoBy/FpiV]Q)B0rdTb42FlwPzV%zdK[Lar\u0026aMa$K\u0026XuVg0fiV]Q)B0q-P00000DMTItxM[f3b03?\u003cc37mYar\u003efix(mMciV]R*A=\u003e}qaBKj\u0026000000000000000k(",
            "n": [
              {
                "c": 5,
                "d": "Detect the WarHawk backdoor used by the SideWinder intrusion-set",
                "i": "third_party/Sekoia/Backdoor/Win/Warhawk",
                "o": 387336,
                "z": 37,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 387208
          },
          {
            "b": "0000000000000000000000000000000000m0000000000000cd2)*[A2)*[A2)}1F5eb%bcOvwujV#7{k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5k%W!5a0hNDa0hNDa0hNDa0gE.0000000000000000000000000000000000000@@r2)*[A2)*Oi000000000000000000000000000000000000000000000002T#2)*[A2)*[A2)*[A2)*Oi00000000",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: base64",
                "i": "metadata/encoded-payload/base64",
                "o": 1541470,
                "z": 22,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 1541406
          }
        ],
        "mol": "MdTh",
        "sha": "58b3686e4255d32dbcf7dee9dac1d5be6d4692d086cde167da1e1a5e0e1b315a",
        "path": "58b3686e4255d32dbcf7dee9dac1d5be6d4692d086cde167da1e1a5e0e1b315a.iso",
        "risk": 109,
        "size": 7254016,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 7254016.0,
              "entropy": 5.14,
              "size_bytes": 7254016.0
            },
            "binary": {
              "overall_entropy": 5.14,
              "peak_region_bytes": 211968.0,
              "peak_region_entropy": 7.81
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/base64",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: base64",
            "spans": [
              [
                1541470,
                22
              ]
            ]
          },
          {
            "id": "third_party/Sekoia/Backdoor/Win/Warhawk",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detect the WarHawk backdoor used by the SideWinder intrusion-set",
            "spans": [
              [
                61753,
                7
              ],
              [
                387336,
                37
              ],
              [
                387416,
                81
              ],
              [
                387584,
                61
              ],
              [
                387648,
                34
              ],
              [
                387720,
                52
              ],
              [
                387784,
                33
              ],
              [
                387848,
                57
              ]
            ]
          }
        ]
      }
    ]
  }
}