{
  "llm": {
    "conf": 0.8,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "suspicious",
    "interpretation": "Compiled AutoIt script with encoded payload"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 3000,
    "conf": 54,
    "mods": [
      {
        "cls": 0,
        "raw": 0.94497955,
        "rte": "az",
        "prob": 0.94497955
      }
    ],
    "prob": 0.8,
    "files": [
      {
        "id": 0,
        "lvl": 3000,
        "conf": 54,
        "prob": 0.800000011920929,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T14:01:07Z"
  },
  "path": "7152cdacb9430f83384a080a02fff0200e365fd698501f74f50c2f1e0f7ebb54.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^ZfFUsoh8c%}f!+BwarR^HarR^HarR^HarR^HarR^b000000000k0@@r300r]n00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "yYFOTwb{fv00000blhV.ASxIFx8(=Gve}zIv/QAEz2!IPx-I@HwDhYgblhPYzVB\u003eVASxIFC(RKUv/QAEzu6Upblh-:wDlYIBPuaQASxUJve%*rz2!nIzu6UpblgHtzu8%5BPuH-zVAueBo2ktBo2.HASygYqugndx8(SCA@ZpZwDl-J00000blhATzuaeDyYFOTwb{fveDxX?zuaeDwDhYgblhiNzVBROz2!bEzua+UA@W=(A@ZpZve$rFBn#pvblhiNA@VgublhiNzVBROz2!bEzua+UA@W=(wDlPFwb(PfblhiNwDhYg-7@R#/crV-k(:NUq#=)#li6pKlJx:VqVGR]k(:mLmf0q/li6{:00",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 702236,
                "z": 1,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 702140
          },
          {
            "b": "@]=YHN=M)paELN%qVD^$l\u0026Wh!qVGO[mGux/r@+I^qufb=tMva\u003eyYE(zA@ZmYwDl=KtMs:7tMva\u003eoAm#\u003enDqcU00000tMw1e00000tMvs}pYJ\u0026.bME/A00000ra]#!azC)tvixV9x(W-oAa9^eC{3Qnze:i9wN(]HB-.K[BrCTmA+PGme=U\u003eKa]?PyASyjZzua8BA@Vgumf4udASy1TASviZve$9zyYFwNv/P{qBo31PzuaqHaollUwDlMEzVB!TC(PC%00000qVHwek(+%aA@Y[Ox8(/HpYLIox-I#Ive$rFC(Q!zzVBLMwDlPFpYLIox-JqRx-I@HwDluywDhYgqVHwenDrSdv/QJHwDlcsA@Y+Kq2\u003e.szVB\u003eVve%a7ASx!NB]VjRyYF2Dx8(Gy00000qVHweli7A]v/",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 787192,
                "z": 45,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 787096
          },
          {
            "b": "S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80SXVB!gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygxmy*gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*DIMiXRS\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80R/KTIgCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygxmy!gCZ*ygCZ*ygCZ*y",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: hex",
                "i": "metadata/encoded-payload/hex",
                "o": 880673,
                "z": 36,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 880609
          },
          {
            "b": "S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A7yCqz3hgCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*y000PAgCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygDphDIMiXRS\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026z$vCxkL@gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*y000PygCZ*ygCZ*ygCZ/",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: hex",
                "i": "metadata/encoded-payload/hex",
                "o": 880978,
                "z": 35,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 880914
          },
          {
            "b": "S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S=@VhCqz3hgCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ/!01/!RgCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*DH\u003e{\u003eyIMiXRS\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80R*0ueCxkL@gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ/!01/!PgCY",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: hex → base64",
                "i": "metadata/encoded-payload/hex-base64",
                "o": 881283,
                "z": 26,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 881219
          },
          {
            "b": "S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A7yCxXmPCqz3hgCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCY1h5FkP*gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygDphDH\u003e{\u003eyIMiXRS\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026z$vCxXmPCxkL@gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCY1h5FkP!gCZ*ygCZ*ygx",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: hex",
                "i": "metadata/encoded-payload/hex",
                "o": 881588,
                "z": 33,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 881524
          },
          {
            "b": "S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S=@VhCxXmPCqz3hgCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygxmy!5FkP*gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*DH\u003e{\u003eyH\u003e{\u003eyIMiXRS\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80R*0ueCxXmPCxkL@gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygxmy!5FkP!gCZ*ygCZ*y",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: hex",
                "i": "metadata/encoded-payload/hex",
                "o": 881893,
                "z": 32,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 881829
          },
          {
            "b": "S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A7yCxXmPCxXmPCqz3hgCZ*ygCZ*ygCZ*ygCZ*ygCZ*y000Py5FkP*gCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygCZ*ygDphDH\u003e{\u003eyH\u003e{\u003eyIMiXRS\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026A80S\u0026z$vCxXmPCxXmPCxkL@gCZ*ygCZ*ygCZ*ygCZ*ygCZ*y000Py5FkP!gCZ*ygCZ/",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: hex",
                "i": "metadata/encoded-payload/hex",
                "o": 882198,
                "z": 31,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 882134
          },
          {
            "b": "zuaqHaolD.wDlVHve$rFve$xHzVB!Taok)KxAhDvASxIFv/QPJwDl-Jaok*Iw=M]MwDl-JaolfSwDl#QCk#KYASxRIe=U\u003eK00000QEX4(M#2x]Nm{J^HsO[zk#/Y:ml@Q=o@O8kb=r=#Dj]:XTIHa-yEulxRMx*#\u0026K.b]R77D\u003e\u003el)Ufk!VcB?HF82OOHqg!uNOEi(\u003cF7=[\u003ezgUGE-RLMu:SI2H}IvDU6[8#6ykyDt.O+}tv+oq:l0Y/B9h?wU[Yv5mpgneJct.#QRH\u003e\u003c9B*}a(LXeEqVdDx1}ol\u003cYL@*4dF}-6*8Xh}7rETP9{J/mNqk-fYj\u003c(1Svd.-]44bmyCA\u00269?J*E2Am%2p:Pcs17Ao0S8@=R({(D",
            "n": [
              {
                "c": 4,
                "d": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
                "i": "third_party/bartblaze/generic/AutoIT/autoit_script",
                "o": 913344,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 913248
          }
        ],
        "mol": "MdTh",
        "sha": "7152cdacb9430f83384a080a02fff0200e365fd698501f74f50c2f1e0f7ebb54",
        "path": "7152cdacb9430f83384a080a02fff0200e365fd698501f74f50c2f1e0f7ebb54.iso",
        "risk": 38,
        "size": 1613824,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 1613824.0,
              "entropy": 7.21,
              "size_bytes": 1613824.0
            },
            "binary": {
              "overall_entropy": 7.21,
              "peak_region_bytes": 657408.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/hex",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: hex",
            "spans": [
              [
                880673,
                36
              ],
              [
                880978,
                35
              ],
              [
                881588,
                33
              ],
              [
                881893,
                32
              ],
              [
                882198,
                31
              ]
            ]
          },
          {
            "id": "metadata/encoded-payload/hex-base64",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: hex → base64",
            "spans": [
              [
                881283,
                26
              ]
            ]
          },
          {
            "id": "third_party/bartblaze/generic/AutoIT/autoit_script",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Identifies AutoIT script.  This rule by itself does NOT necessarily mean the detected file is malicious.",
            "spans": [
              [
                702236,
                1
              ],
              [
                787192,
                45
              ],
              [
                913344,
                8
              ]
            ]
          }
        ]
      }
    ]
  }
}