{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9983508586883545,
        "class": 0
      }
    ],
    "prob": 0.99835086,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8985075,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 0.99835086,
        "class": 0
      },
      {
        "m": "az/xls",
        "prob": 0.99691355,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-18T03:24:50Z"
  },
  "path": "5ccf54469dc24d71ebf3e7de65ffd5d110e8be394544abdbdb454b7f57a628d0.xls",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(Er)H(Po)",
        "x": 2,
        "id": 0,
        "ms": {
          "file": {
            "size": 672256.0
          },
          "office": {
            "ole": {
              "stream_count": 3.0,
              "storage_count": 1.0
            },
            "doc_type": "xls"
          }
        },
        "sz": 672256,
        "ts": [
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "MSI embeds encoded command flag",
            "e": [
              "-E"
            ],
            "i": "objectives/command-and-control/dropper/execution/installer::msi-encoded-command-raw",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "AI_FileDownload target archive filename",
            "e": [
              "summary1.zip"
            ],
            "i": "objectives/command-and-control/dropper/delivery/msi::ai-payload-zip-name",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has .xls extension",
            "e": [
              "5ccf54469dc24d71ebf3e7de65ffd5d110e8be394544abdbdb454b7f57a628d0.xls"
            ],
            "i": "objectives/evasion/masquerade/document::basename-xls-extension",
            "l": 3
          },
          {
            "c": 0.9399999976158142,
            "d": "Multiple hardcoded payload URLs",
            "e": [
              "http://www.apple.com/DTDs/PropertyList-1"
            ],
            "i": "micro-behaviors/process/create/shell/lang::multi-url-download-list",
            "l": 3
          }
        ],
        "sha": "5ccf54469dc24d71ebf3e7de65ffd5d110e8be394544abdbdb454b7f57a628d0",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-09/5ccf54469dc24d71ebf3e7de65ffd5d110e8be394544abdbdb454b7f57a628d0.xls",
        "type": "xls"
      }
    ],
    "tv": "60127"
  }
}