{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9988067746162415
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9783623,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/ole",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9988068,
    "analyzed_at": "2026-05-31T06:09:02Z"
  },
  "path": "6833264099ffdbea6afdded5c29eff9d87516a7f15db852f8745fd013ce0f826.unknown",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(Ag₂)",
        "x": 43,
        "ff": {
          "m": {
            "file": {
              "size": 884224.0,
              "entropy": 6.01,
              "size_bytes": 884224.0
            },
            "office": {
              "stream_count": 3.0,
              "ole.stream_count": 2.0,
              "ole.storage_count": 1.0,
              "dangerous_clsid_count": 1.0,
              "ole.dangerous_clsid_count": 1.0,
              "is_macro_enabled_extension": 0.0
            }
          },
          "v": {
            "file.stem": "6833264099ffdbea6afdded5c29eff9d87516a7f15db852f8745fd013ce0f826",
            "office.kind": "ole2",
            "file.basename": "6833264099ffdbea6afdded5c29eff9d87516a7f15db852f8745fd013ce0f826.unknown",
            "office.streams[0]": "/",
            "office.streams[1]": "/\u0001oLe10nATiVe",
            "office.streams[2]": "/8LopVNUgRQ6r8w6XMcAA8V38",
            "office.features[0]": "dangerous_clsid",
            "office.dangerous_clsids[0].name": "Equation Editor",
            "office.dangerous_clsids[0].clsid": "0002ce02-0000-0000-c000-000000000046",
            "office.dangerous_clsids[0].storage": "/"
          },
          "id": "ole"
        },
        "id": 0,
        "sz": 884224,
        "ts": [
          {
            "c": 1.0,
            "d": "OLE10Native embedded object: 43431490 bytes in /\u0001oLe10nATiVe",
            "i": "metadata/format/embedded::ole10-native-object",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Equation Editor 3.0 (CVE-2017-11882) (CLSID: 0002ce02-0000-0000-c000-000000000046) on /",
            "i": "metadata/format/clsid::dangerous-clsid",
            "l": 4
          },
          {
            "c": 0.9200000166893005,
            "d": "Embedded Microsoft cabinet header",
            "e": [
              "MSCF"
            ],
            "i": "metadata/binary/installer/database::embedded-mscf-cabinet",
            "l": 2
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "MSI embeds encoded command flag",
            "e": [
              "-E"
            ],
            "i": "objectives/command-and-control/dropper/execution/installer::msi-encoded-command-raw",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor",
            "e": [
              "B9dEOh@bmuzYTFj5=k@5KZCi8ZT9\\dY~^avE[j;b \u003cxor\u003e",
              "c\\xGJ{=vB]5:|9Cx;\\Nh}nUe:meH\u003czdZfJ_JUa5i \u003cxor\u003e",
              "\\uh`U\\?fKm}kf[J{eZ|z|N}x:5z8iTxt`?\u003c{M;J? \u003cxor\u003e",
              "bCGF;aEHJHd8fyY@Hdf4V`@uN`8\u003em{VUHc\u003cB[`dz \u003cxor\u003e",
              "GZKJuZj:Z|J\u003c?nyBIVe\u003cBDAu8VkeyMfK[bez|JV8 \u003cxor\u003e",
              "xC~VEyBu\\x`N{=^O\u003ca[\u003ckfvuxz4U^cD?G;ezBO{\u003e \u003cxor\u003e",
              "goXjF\\xBiEc9EHcM\u003c^KVgjY\\t;4b9=ctAEvYfmOu \u003cxor\u003e",
              "njAU@F4\\[}UF[t4?=CHv;eo}nAktmc]mKI\u003ch94C^ \u003cxor\u003e",
              "g\u003ejdTN\u003ck}d\\u~AUDy_`Y\u003cE8GXI[^zebj_guY5Yk~ \u003cxor\u003e",
              "cubb9F_\u003e{Odb\\|?B5XdzO\\xV~\u003eY[yEb`:Jmj|\u003e[9 \u003cxor\u003e",
              "cHGJ:_mbx\u003e5CA:xnkm@xN4bAZA}CNH}xB`tZz;ND \u003cxor\u003e",
              "_md@ONbdZ^aa\\mu^}5zx~DJ99\\km]5_T\u003c]}zBxv5 \u003cxor\u003e",
              "[EF\u003cie\u003cEza_@~=|H[EAdtmvkb?{x;]{}e[F8G9mZ \u003cxor\u003e",
              "JzNUK=gVIEizIGe\\uaVX5CVC=IthND^UdMfO^:oT \u003cxor\u003e",
              "|]\u003c;@^__[Tm9y|mdXKO\\xnhz4`ayEKhmku8f4Ifd \u003cxor\u003e",
              "gIO{9yDiJg8i]tY]HTM^HYVo~^Y}\\D`v\\JMt5Jd4 \u003cxor\u003e"
            ],
            "i": "metadata/encoded-payload/xor",
            "l": 3,
            "el": [
              "offset:314834",
              "offset:695730",
              "offset:731636",
              "offset:132667",
              "offset:222164",
              "offset:872099",
              "offset:476816",
              "offset:71467",
              "offset:298169",
              "offset:690109",
              "offset:792688",
              "offset:751589",
              "offset:357174",
              "offset:263023",
              "offset:464175",
              "offset:493219"
            ]
          }
        ],
        "sha": "6833264099ffdbea6afdded5c29eff9d87516a7f15db852f8745fd013ce0f826",
        "path": "6833264099ffdbea6afdded5c29eff9d87516a7f15db852f8745fd013ce0f826.unknown",
        "type": "ole"
      }
    ],
    "tv": "52045"
  }
}