{
  "ml": {
    "v": "7",
    "lvl": 0,
    "conf": 100,
    "mods": [
      {
        "cls": 0,
        "raw": 0.96093506,
        "rte": "az",
        "prob": 0.96093506
      },
      {
        "cls": 2,
        "raw": 0.9923249,
        "rte": "az/documents",
        "prob": 0.9923249
      },
      {
        "cls": 2,
        "raw": 0.9996766,
        "rte": "az/ole",
        "prob": 0.9996766
      }
    ],
    "prob": 0.9923249,
    "files": [
      {
        "id": 0,
        "lvl": 0,
        "conf": 100,
        "prob": 0.9923248887062073
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-10T07:30:51Z"
  },
  "path": "7699736a5572277fb3a5e7a0335559f5ff77db67f9799824b84d776ed640a1b7.unknown",
  "raw": {
    "v": "7",
    "tv": "46abf",
    "files": [
      {
        "id": 0,
        "mol": "Md₂(Ag₂)",
        "sha": "7699736a5572277fb3a5e7a0335559f5ff77db67f9799824b84d776ed640a1b7",
        "fact": {
          "id": "ole",
          "met": {
            "file": {
              "size": 2114560.0,
              "entropy": 7.54,
              "size_bytes": 2114560.0
            },
            "binary": {
              "overall_entropy": 7.54
            },
            "office": {
              "stream_count": 3.0,
              "ole.stream_count": 2.0,
              "ole.storage_count": 1.0,
              "dangerous_clsid_count": 1.0,
              "ole.dangerous_clsid_count": 1.0,
              "is_macro_enabled_extension": 0.0
            },
            "consistency": {
              "extension_content_mismatch": 1.0,
              "extension_content_mismatch.document_as_unknown": 1.0
            }
          },
          "val": {
            "file.stem": "7699736a5572277fb3a5e7a0335559f5ff77db67f9799824b84d776ed640a1b7",
            "office.kind": "ole2",
            "file.basename": "7699736a5572277fb3a5e7a0335559f5ff77db67f9799824b84d776ed640a1b7.unknown",
            "office.streams[0]": "/",
            "office.streams[1]": "/\u0001ole10NAtIVE",
            "office.streams[2]": "/5g7AAAosrprslij0M9w4Npy",
            "office.features[0]": "dangerous_clsid",
            "office.dangerous_clsids[0].name": "Equation Editor",
            "office.dangerous_clsids[0].clsid": "0002ce02-0000-0000-c000-000000000046",
            "office.dangerous_clsids[0].storage": "/"
          }
        },
        "find": [
          {
            "id": "metadata/format/embedded::ole10-native-object",
            "conf": 1.0,
            "crit": 3,
            "desc": "OLE10Native embedded object: 2095548 bytes in /\u0001ole10NAtIVE"
          },
          {
            "id": "metadata/format/clsid::dangerous-clsid",
            "conf": 1.0,
            "crit": 4,
            "desc": "Equation Editor 3.0 (CVE-2017-11882) (CLSID: 0002ce02-0000-0000-c000-000000000046) on /"
          },
          {
            "ev": [
              "-e"
            ],
            "id": "objectives/command-and-control/dropper/execution/installer::msi-encoded-command-raw",
            "atk": "T1059.001",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "MSI embeds encoded command flag"
          },
          {
            "ev": [
              "I\\Tc=V`EGm4NzJ4V|YkK\u003cVz]NENn8jDxjk\u003e\\u]\u003et \u003cxor\u003e",
              "buZbf54exJ_MCCAjm?a\\o_C_:K_?OV\u003c5}:JJGo5[ \u003cxor\u003e",
              "|cU`UbAKYxVGBJczyvbfV9nI][AuYe{\u003e??M}\\x84 \u003cxor\u003e",
              "?}ZVjJc@TK9fyg:TOt\\4:XZ9eXJtN;\\BCEkC=Tg? \u003cxor\u003e",
              "ETcnEDTavfgd|itB9HXY9mhUZdG^9_c\u003eYzoO^v{u \u003cxor\u003e",
              "\\J:GUoc\u003cK\\uJd{MVEd[yAVyzxC]gik\u003c`ZeZ|tkan \u003cxor\u003e",
              "aEf[=@o=E\\uTNott5A\u003cN^fAz;Bd]C^9fI \u003cxor\u003e",
              "jECC{\\m_:=jkHmmGFXU}aNBcagOz\u003eUFFy;@OUXoj \u003cxor\u003e",
              "Dz\\x9OfgDmxZ[dBcmj5b=[A?`uH8I@;eVe=4NY;b \u003cxor\u003e",
              ";CX`gy8a[@g:f^TkG~bV=4E__biVb{teX}jVNueA \u003cxor\u003e",
              "ej5hU9A|ejm_NFf=o}}|NhCoVD5VXktEuD:BTUi} \u003cxor\u003e",
              "F\\Ff9G:?KmMT;_VYt\u003e~~EcFCKU_85A|~\\uuogC`@ \u003cxor\u003e",
              "X5Ck\u003c{;V]`gdI|On?H~^F@va]b\\\\:EZYy\u003c\\u?u_H \u003cxor\u003e",
              ";T@Ck`HC;\\k8ND;~bj_XOyU\u003eAHUTVgcVAzaKj9AZ \u003cxor\u003e",
              "uCnZ]Ji`jet=hb\u003e\u003cJ[_CTo^ezk{[cKfb\\TyX}thZ \u003cxor\u003e",
              "zgVd;]8{[8eA^MDTok`N[mAifX\\ojB|HTvoJT\u003cej \u003cxor\u003e"
            ],
            "id": "metadata/encoded-payload/xor",
            "loc": [
              "offset:2013555",
              "offset:1881921",
              "offset:1471366",
              "offset:1415801",
              "offset:1678475",
              "offset:1889772",
              "offset:1476416",
              "offset:1205197",
              "offset:2056625",
              "offset:1286393",
              "offset:1951744",
              "offset:1289147",
              "offset:1698272",
              "offset:1988059",
              "offset:1540228",
              "offset:1266462"
            ],
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: xor"
          }
        ],
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-06/7699736a5572277fb3a5e7a0335559f5ff77db67f9799824b84d776ed640a1b7.unknown",
        "risk": 42,
        "size": 2114560,
        "type": "ole"
      }
    ]
  }
}