{
  "llm": {
    "conf": 0.6696417,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.8-27B",
    "before": {
      "lvl": 25,
      "prob": 0.9994653,
      "class": "hostile"
    },
    "outcome": "suspicious",
    "interpretation": "Archive path traversal and batch script"
  },
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": 3000,
    "conf": 54,
    "mods": [
      {
        "cls": 2,
        "raw": 0.9994653,
        "rte": "az",
        "prob": 0.9994653
      }
    ],
    "prob": 0.6696417,
    "files": [
      {
        "id": 0,
        "lvl": 3000,
        "conf": 54,
        "prob": 0.6696416735649109,
        "type": "rar"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000018417835235595703,
        "type": "text"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-28T07:27:22Z"
  },
  "path": "780c18b21278006e67d4298c1564f228.rar",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "qEKO?8v3oy]wLq!3JQzo00SD8FpJdIWswRMb)1eR\u0026SYLB1%v:IH\u003epcS010dKvrccoBA?)m0%jf*y)Uu3?2RFaA=VepvqE62zF0!@3t%o?wJy@xwmor$v@bN]yH)}Zvp%djatC\u003e=3t16.x(2*Mv}YN]wnc9{z/Px5vqXtyzddc{e[n*p4glJOwo8m5",
            "ln": 0
          }
        ],
        "mol": "O(C₂)H(Db)Md₂(Pa)",
        "sha": "6c296f0c211f0c111fe210f80f14d157c32956118890f58516a396b4df5e4a30",
        "path": "/home/gauntlet/.cache/gauntlet/blobs/6c296f0c211f0c111fe210f80f14d157c32956118890f58516a396b4df5e4a30/780c18b21278006e67d4298c1564f228.rar",
        "risk": 120,
        "size": 1631855,
        "type": "rar",
        "facts": {
          "metrics": {
            "rar": {
              "solid": 0,
              "locked": 0,
              "volume": 0,
              "recovery": 0,
              "acl_count": 0,
              "quick_open": 0,
              "end_present": 1,
              "split_count": 0,
              "blake2_count": 0,
              "encrypted_header": 0,
              "ntfs_stream_count": 4,
              "child_header_count": 4,
              "file_version_count": 0,
              "unknown_extra_count": 0,
              "service_header_count": 4,
              "unknown_header_count": 0,
              "v1_compression_count": 0,
              "mapped_unix_name_count": 0,
              "header_crc_mismatch_count": 0
            },
            "file": {
              "size": 1631855,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 1629807,
              "peak_region_entropy": 7.86
            },
            "archive": {
              "file_count": 5,
              "member_count": 5,
              "prefix_bytes": 0,
              "script_count": 1,
              "trailing_bytes": 0,
              "zip_bomb_ratio": 1.97,
              "compressed_size": 1631076,
              "directory_count": 0,
              "executable_count": 0,
              "extra_field_size": 594,
              "noise_file_count": 0,
              "compression.ratio": 0.69,
              "hidden_file_count": 0,
              "uncompressed_size": 2378568,
              "max_filename_length": 168,
              "rtlo_filename_count": 0,
              "nested_archive_count": 0,
              "path_traversal_count": 2,
              "security.setgid_count": 0,
              "security.setuid_count": 0,
              "security.sticky_count": 0,
              "double_extension_count": 0,
              "duplicate_member_count": 0,
              "security.symlink_count": 0,
              "unicode_filename_count": 0,
              "homoglyph_filename_count": 0,
              "security.encrypted_count": 0,
              "timing.mtime_unique_count": 1,
              "timing.mtime_unique_ratio": 1,
              "misplaced_executable_count": 0,
              "timing.mtime_dominant_count": 1,
              "timing.mtime_spread_seconds": 0,
              "timing.sentinel_mtime_count": 4,
              "security.world_writable_count": 0,
              "timing.mtime_dominant_fraction": 0.2,
              "compression.method_counts.stored": 1,
              "compression.method_counts.rar-normal": 4
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix",
            "conf": 0.55,
            "crit": 3,
            "desc": "Gmail consumer email domain suffix",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/naming::archive-bat-member",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive member is a batch script"
          },
          {
            "id": "metadata/package/files/archive-member::archive-batch-member",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive member is a batch file"
          },
          {
            "id": "micro-behaviors/data/archive/rar::ads-parent-traversal",
            "conf": 0.95,
            "crit": 3,
            "desc": "RAR member ADS parent traversal"
          },
          {
            "id": "micro-behaviors/data/archive/rar::rar-ntfs-stream-member",
            "conf": 0.95,
            "crit": 3,
            "desc": "RAR carries an NTFS alternate stream"
          },
          {
            "id": "micro-behaviors/data/archive/rar::shell-script-member-extension",
            "conf": 0.9,
            "crit": 1,
            "desc": "RAR member has .bat/.cmd/.ps1 extension"
          },
          {
            "id": "metadata/file/naming::archive-member-under-10kb",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive has a sub-10KB member"
          },
          {
            "id": "micro-behaviors/data/archive/rar::rar-ads-traversal-burst",
            "conf": 0.95,
            "crit": 3,
            "desc": "RAR member bursts parent-path traversal"
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/document::rar-ads-traversal-script-delivery",
            "atk": "T1204.002,T1564.004",
            "conf": 0.97,
            "crit": 5,
            "desc": "RAR ADS traversal smuggles a script payload",
            "uses": [
              4,
              5
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/rar::rar-ads-tiny-member",
            "atk": "T1027.002,T1204.002,T1564.004",
            "conf": 0.94,
            "crit": 5,
            "desc": "Tiny RAR uses ADS parent traversal",
            "uses": [
              4,
              6
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/rar::rar-ads-traversal-burst-dropper",
            "atk": "T1027.002,T1204.002,T1564.004",
            "conf": 0.94,
            "crit": 5,
            "desc": "RAR ADS name repeats parent traversal",
            "uses": [
              3,
              7
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "AaK6hz/f01azC.9zW^4\u003evqPNpayO!?z6it8vrcc{4glJRwJy}*isMsbzddc{iV}{Cx(mD}B7ocewnbE\u0026kXB}xx(2ziz/2{\u003cvpS[?wPI]NatLVbax8=-z/oCml3u/\u003cavyfXB98OtwP]WFmOB{XgbQ\u003cC4glV*xL}J]x([RYaAI:rwnc9#4gl=Wx\u003eIa3at$P5asF%7hY#QEdgDSdwOC^\u003cBugK8iuS9IasG02fD+sMB-7-hdgDQ[3uGY\u003cz/oC33ub",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 866,
              "entropy": 5.19
            },
            "binary": {
              "peak_region_bytes": 866,
              "peak_region_entropy": 5.19
            }
          }
        },
        "id": 1,
        "path": "/home/gauntlet/.cache/gauntlet/blobs/6c296f0c211f0c111fe210f80f14d157c32956118890f58516a396b4df5e4a30/780c18b21278006e67d4298c1564f228.rar!!clark.txt",
        "pid": 0,
        "risk": 1,
        "sha": "c9ddbb4046bdeeac41ffbf5853944262f2aa93aa98d9e2404e939cf40a1fa6d2",
        "size": 866,
        "traits": [
          {
            "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix",
            "conf": 0.55,
            "crit": 3,
            "desc": "Gmail consumer email domain suffix",
            "spans": [
              [
                64,
                10
              ]
            ]
          }
        ],
        "type": "text"
      }
    ],
    "rev": "c1ea9",
    "v": "8"
  }
}