{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Reversed base64 encoded executable detected"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.9989227,
        "rte": "az",
        "prob": 0.9989227
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T06:41:10Z"
  },
  "path": "5c3fcb461f5b36e00987e87a2b063ff3cf0773ffec00b3623a490b204fecf741.iso",
  "raw": {
    "v": "8",
    "rev": "59b94",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^ZfFUsoi50v1f/R3DarR^HarR^HarR^HarR^HarR^b000000001N0rr9100d/O00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "l@uD9o*I5@oHq3hog7lYeg-tieg-tvejz9vlm+C?k#*GNk$@)Yej8S*q9=-:eg:jQeg-tsk%YcHk}DUmej8S*en)*9xf!7!z=x1*eg:T:eo:PIl0m5JoHSU-k%Xpjeg-tif?C}Olp14ek#ZcoqbQmTeg-tAoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268!ten4mmeg-t6eg-t6eg-t6eg-tHeg-t+oHg%7fe2Qxml@F0k%Xv/r-x5=q+xvS009610000c0001xg+HEmgCyQtirf3V00Jvs0000Eli40gEGfwjli42Xx8?]Rq/)4]zFa1\u003c0001TSSi4a5Dz!Qrz@(.Yz}{y0000zm]-bG0000}Yz}%b5=.[RltQNH000000000200043?\u003eAsw9@(ov}xW]$761sn0001O0000G0001m0002(0rr9t0SSiS000030rr920001L00001000010001T0000n0000+0001l",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 565053,
                "z": 52,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": "Embedded .NET runtime marker",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
                "o": 565168,
                "z": 4,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 564925
          },
          {
            "b": "Xuj\u003e}M%]fDGYXRZw=LebA8Phcron?n\u003c!O)Rr7*s*\u003eBd6mC#Evsk(::CP$YS:S{cj\u003ey/atYn(wtL\u003eBd57qE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4$wPI^jA:@W40o{h\u003epgwiMp\u003cC/K07g)BBAIRnnP5cU08[e:By/qwm@i9MvqGU7vruj4zu9e/Xuj}.GJNuCJ9n+L(7L?8C0(t[NUk-JBw7-9T.yTRso8ltC4j0LzSO4fm[V-X0oQIDv}$a$J=KxYMGtQ",
            "n": [
              {
                "c": 3,
                "d": ".NET managed-resource loader marker",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 586051,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 585987
          },
          {
            "b": "00000002iN2MK\u0026E0000000000000000000000000001Zz2MK\u00268000000000000000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 3,
                "d": "Embedded .NET runtime marker",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
                "o": 618302,
                "z": 11,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 618238
          }
        ],
        "mol": "MdTh",
        "sha": "5c3fcb461f5b36e00987e87a2b063ff3cf0773ffec00b3623a490b204fecf741",
        "path": "5c3fcb461f5b36e00987e87a2b063ff3cf0773ffec00b3623a490b204fecf741.iso",
        "risk": 109,
        "size": 798720,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 798720.0,
              "entropy": 6.76,
              "size_bytes": 798720.0
            },
            "binary": {
              "overall_entropy": 6.76,
              "peak_region_bytes": 385024.0,
              "peak_region_entropy": 7.84
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET managed-resource loader marker",
            "spans": [
              [
                586051,
                15
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-runtime-marker",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "Embedded .NET runtime marker",
            "spans": [
              [
                565168,
                4
              ],
              [
                618302,
                11
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                565053,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}