{ "llm": { "conf": 0.99300003, "grade": "hostile", "model": "Qwen/Qwen3.6-27B", "outcome": "hostile", "interpretation": "ISO contains .NET reflection loader" }, "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.9640728, "rte": "az", "prob": 0.9640728 } ], "prob": 0.99, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9900000095367432, "type": "iso" } ], "version": "v18.18", "analyzed_at": "2026-08-02T18:05:11Z" }, "path": "5af59971935a51d745d4305e4c352f4ef384f3623ad7a7b4473b113a97c1b9ec.iso", "raw": { "v": "8", "files": [ { "id": 0, "ctx": [ { "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!fBUcNbzF7gFf!$Brf!+HvgAW!.arR^HarR^HarR^b000000000^0rr9100bB!000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c[!J2m8^Z0SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao", "n": [ { "c": 5, "d": "ISO .NET reflection resource loader", "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "o": 32769, "z": 5, "cf": 0.9900000095367432 } ], "ln": 32641 }, { "b": "FY\u003eKF[[s*muN\u003cuw)q-+YUvoH]hJZf?(V}sb6u%58DhNs{h]!9{zxxFS*w.=pDp4W{C*:[!A[Jpt1\u003cOF^Dr2=^\u003eWf{MOji12KbiEi.%QJ8Y.KWwT\u003c4Ht)}ILcMR-.:@%6c=Tr\u0026KQwJ*7]002OVpdhlKv1F:^00000lq{Gy0rrc2000005c8XgB#g*9e\u0026bgqf/Yjl00000000r9V\u0026y7a!ewq!byPQ)H-lr][hggCbu5Y8x(mN800000CU[Cv**f%XbumUxriMu55c8Xgbs+:9l\u0026Wh!wuV4l7ZZlybsli+vGlxdE7xpT5c8Xgbs+:9l\u0026Wh!JjF#?1onA4bu5Y8x(mN800000KH+z(1onA4bsli+vGlxdL!3?{1onA4bu58=wO\u003e\u0026Q000000SUE^s6}YB2)QCg0qW#$02tLm0SSi2tl1T6df6tFeDt+J.2KDnsPwB44/=OfFb/MH0@@r3f-RgN0rr91aPIGx5=.[i8VP\u003cr", "n": [ { "c": 5, "d": "ISO stages a .NET resource payload", "i": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "o": 609176, "z": 4, "cf": 0.9900000095367432 } ], "ln": 609048 }, { "b": "z*i#praQq@lt}8GluNx(z/dpplU{EDyxc!DwO#PQA+xB[B7Gl1wPv=Z07pKxAbP/e0aY!+AbP/izF5@vzFsibvqGU7wKyxMAbPS9zGC(1qE$2.A=U!\u003cgxqGrASwNorSEkMCYS{-uQ+3p0aV7buQjVTB8$]fvR*q\u0026q*ACawO\u003c4$wOb:\u0026v@#B6zua+Us6[(arc-B]0c!G*Dh{xvl\u0026Zg$CVjVxA:-\u003cbw]zZb0cR^!B.7NjFudWWT(s\u003e(\u0026^^3FFq-AqT(s(l\u0026^!8?FV[6-TM1/l\u0026^!5*FudWXT(s\u003e\u003e\u0026^!5*Fu4QWS]wPk\u0026^[n(Fuv*YTM1/i\u0026^[b?FreYuJn/wE\u0026^[e\u0026FVW{.T(s\u003e?\u0026^!b\u0026FuE)ZI@Gq\u003e\u0026^^9HFu4QWS]wMh\u0026^[h\u003cFuw(tz/fVqz!]BkFq-ArUhT$\u0026\u0026^[q)FV[6-Kk+.\u003e\u0026^[b?Fq-AqS]wL/\u0026^[k\u003eFu4QVJ]COH\u0026^^0EFVN\u003cYJ]CR)\u0026^[q)FVW{ZJ]CO?\u0026^^9HFu4QVJ]CR\u003e\u0026S", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 616654, "z": 17, "cf": 0.9399999976158142 } ], "ln": 616526 }, { "b": "\u0026^[k\u003eFq\u0026GrKk+.[\u0026^^6GFuE)ZKk+.]\u0026^!b\u0026FVE^YT(s]n\u0026^!h\u003eFVvZXUhU2n\u0026^[k\u003eFV[6:T(s]j\u0026^!h\u003eFr5StJn/wD\u0026^[e\u0026FVN\u003cZUI$7[\u0026^[k\u003eFq\u0026GsTM1/j\u0026^!b\u0026FreYvT(s(l07H)Ez82b)A+frgB-H#6o\u003c}]tqE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4$wPI^jA:@W40chT(z/{8gwKyPRBAIRn07g)BBAIRnnP5cU08[e:By/qwm@i9MvqGU7vruj4zuarXByd{SB8Mhwv}wwyzEEf?ASx--BydyTy\u0026\u003c/uwDl^.BydyTy\u0026\u003c/uwDlvOBydHV0oeNj\u0026^!e\u003cFuv*YJ]CR(\u0026^^0EFudWWI@Gq\u003e\u0026^^0EFVvZWJPbFE\u0026^^0EFVN\u003cYT(s]j\u0026^^0EFVN\u003cYTkXYh\u0026^!b\u0026FVW{.TkXYh\u0026^^6GFu4QWUhT$\u0026\u0026^[n(FV[6-J]CO\u003c\u0026^[b?Fu4QWT(s]j\u0026^!5*Fq@MsUhT#m0oeNj\u0026^!8?FVW{ZJ]CM", "n": [ { "c": 3, "d": ".NET resource loader marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-resource-loader", "o": 622911, "z": 15, "cf": 0.949999988079071 } ], "ln": 622783 }, { "b": "uQF:HBAhqoA@XHpwb]IsB9hthoKSi+B-WQWwPzy3A=1GUD2E?E090(7xKL{EA=LPl0b2\u003e+uRC3Gxlm!!xjVf(lUG[GA@Y9HAbn@)wDkkiBx0K8wKZYUzaF8MwnC/SlVl\u003c=wPz\u003e)mSJA:lsB}Dhz^^mvraUOA::j[nP5Y\u0026yH{jKzdm6%07QQxrc-B]07?6IwPzi?BzkVh07gghy^JzxvqPMQnP5Y\u0026yH)G!wPRoLwQan%wPRoNz!9zVxjVf(k#QcxnDqa#wNPW(l$G\u003eGD2N\u003ezASx6VvqZc#z/PX:x(mu}ltQNIyxc\u003eoBw)p4x(mL-xjVf(l349Uzdmsb07QQxpHX6Iv@}YpAbYScv{%E[z/bLzzEE0\u003cwMAI^BZY8+BA}XlA@YcIBvf$-Aa9\u003c5vR/QPwQ5q{wO#3\u0026A+PA7l$G$sB.(d1qGV\u003cSmSir:vrqGnwmOwxB94yUB-Ri@mq^9/wP.L:xjVf(p\u0026Zb\u003cx(wcn0b2\u003e+uRUfSBo2iI", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 629610, "z": 12, "cf": 0.9399999976158142 } ], "ln": 629482 }, { "b": "0#hD0HYNU\u003eBohQ*0rJ]m4f($I5}C=t0$]XS5{alY0TG5i006hK9rs7FP?*B.+=3EN[Gd-h0000000000003aT2(\u003c@900000003)[2(\u003c@F0000000000000000000000000003y-2(\u003c@900000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Embedded .NET runtime string marker", "i": "metadata/file/format/structured::embedded-dotnet-runtime-string", "o": 657006, "z": 11, "cf": 0.9599999785423279 } ], "ln": 656878 } ], "mol": "O₂(AsC)Md", "sha": "5af59971935a51d745d4305e4c352f4ef384f3623ad7a7b4473b113a97c1b9ec", "path": "5af59971935a51d745d4305e4c352f4ef384f3623ad7a7b4473b113a97c1b9ec.iso", "risk": 239, "size": 661504, "type": "iso", "facts": { "metrics": { "file": { "size": 661504.0, "entropy": 7.53, "size_bytes": 661504.0 }, "binary": { "overall_entropy": 7.53, "peak_region_bytes": 540672.0, "peak_region_entropy": 7.85 } } }, "traits": [ { "id": "metadata/file/format/iso::iso-dotnet-metadata-marker", "conf": 0.9900000095367432, "crit": 3, "desc": ".NET metadata signature marker", "spans": [ [ 609176, 4 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-resource-loader", "conf": 0.949999988079071, "crit": 3, "desc": ".NET resource loader marker in opaque content", "spans": [ [ 622911, 15 ] ] }, { "id": "metadata/file/format/structured::primary-volume-descriptor", "conf": 1.0, "crit": 2, "desc": "ISO-9660 primary volume descriptor marker", "spans": [ [ 32769, 5 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "conf": 0.9399999976158142, "crit": 3, "desc": ".NET reflection marker in opaque content", "spans": [ [ 616654, 17 ], [ 629610, 12 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-runtime-string", "conf": 0.9599999785423279, "crit": 3, "desc": "Embedded .NET runtime string marker", "spans": [ [ 657006, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO .NET reflection resource loader", "spans": [ [ 32769, 5 ], [ 609176, 4 ], [ 616654, 17 ], [ 622911, 15 ], [ 629610, 12 ] ] }, { "id": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO stages a .NET resource payload", "spans": [ [ 32769, 5 ], [ 609176, 4 ], [ 616654, 17 ], [ 622911, 15 ], [ 629610, 12 ], [ 657006, 11 ] ] } ] } ] } }