{
  "llm": {
    "conf": 0.9993665,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.8-27B",
    "before": {
      "lvl": 150,
      "prob": 0.99905455,
      "class": "suspicious"
    },
    "outcome": "suspicious",
    "interpretation": "GIF header anomaly suggests obfuscation"
  },
  "ml": {
    "v": "7",
    "eng": "2.11.0",
    "lvl": 150,
    "conf": 82,
    "mods": [
      {
        "cls": 1,
        "raw": 0.99905455,
        "rte": "az",
        "prob": 0.99905455
      },
      {
        "cls": 0,
        "raw": 0.9632523,
        "rte": "az/media",
        "prob": 0.9632523
      }
    ],
    "prob": 0.99905455,
    "files": [
      {
        "id": 0,
        "lvl": 150,
        "conf": 82,
        "prob": 0.9990545511245728,
        "type": "gif"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-14T06:06:40Z"
  },
  "path": "1DF9B4DC693CE7250F51CBC7CED53AD0A6E1C587",
  "raw": {
    "v": "8",
    "rev": "c7f7e",
    "files": [
      {
        "id": 0,
        "mol": "Th",
        "sha": "79bc1595ad701ab8a72874a96bcfb94986daeee26b996241e691f3d53f7ec53a",
        "path": "1DF9B4DC693CE7250F51CBC7CED53AD0A6E1C587",
        "risk": 108,
        "size": 334093,
        "type": "gif",
        "facts": {
          "metrics": {
            "file": {
              "size": 334093,
              "entropy": 6.84
            },
            "media": {
              "gap_bytes": 0,
              "stowaway_bytes": 334068,
              "trailing_bytes": 334065,
              "stowaway_entropy": 6.84
            },
            "binary": {
              "peak_region_bytes": 81920,
              "peak_region_entropy": 7.8
            }
          }
        },
        "traits": [
          {
            "id": "third_party/SigBase/SUSP/GIF/Anomalies",
            "conf": 0.9,
            "crit": 5,
            "desc": "Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type"
          }
        ]
      }
    ]
  }
}