{ "llm": { "conf": 0.85, "grade": "hostile", "model": "Qwen/Qwen3.6-27B", "outcome": "hostile", "interpretation": "Obfuscated .NET malware with reflection" }, "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.86977273, "rte": "az", "prob": 0.86977273 } ], "prob": 0.85, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.8500000238418579, "type": "iso" } ], "version": "v18.18", "analyzed_at": "2026-08-03T15:23:58Z" }, "path": "7b24e9a8334000a1e10dd9cdf66e92e46f890e5a89f77c6bd7e1957a2a97320b.iso", "raw": { "v": "8", "files": [ { "id": 0, "ctx": [ { "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.m%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^{mn(\u0026UpF-eRarR^HarR^HarR^HarR^HarR^HarR^b00000000120SSi200lj400000000000000000", "n": [ { "c": 2, "d": "ISO-9660 primary volume descriptor marker", "i": "metadata/file/format/structured::primary-volume-descriptor", "o": 32769, "z": 5, "cf": 1.0 } ], "ln": 32721 }, { "b": "aoizZaPJI.a]\u0026R-ble.:bMF?+000009SRYI07YBSm}T?w06$WEwO\u003e))C%=H?D2^RixMMKZBAh88B-.f{q*ACawO\u003c4$wOb:\u0026v@#B6zuaJ{v@Dy7x\u003c}5{v@#Tf09j2Lwb]LNB97#g08)#Wx(mL-l349Uzdmsbrb#zTwO\u003e\u003c@yE95:A+P09By+CrB8$]fvR*r^A=kGhv@$1UBAh88B-.f{l349UzdmsblVl\u003cOx\u003eINevruj4zB5w^A+P09By+CrB8$]fvR*rSzV", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 1051528, "z": 17, "cf": 0.9399999976158142 } ], "ln": 1051464 }, { "b": "q!ZL?jUX[@wKwmxwi$6wC5/D-B4nJoA.lscf?kqNyHQvP077%MwDk2qB7Gh$y\u003cu1JwPQ)%AaG2GD2Nr{nP5Y\u0026yH{jKzdm6%077yqwnb{]mR(HCA@XKvzE^s008^xEy***+07y:zBA)\u003cNz/f-fA=.pJA=k!Yvrl0rg/FHpx(mL-oMauI07oaelSMYTq^/VAn[pK-yEzO=w(}I)x*DVaASwJ#wKOvuq9[8Cy\u0026%o1zBv0f0c6+@yI#:Onlok6AZ\u0026I\u003e", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 1053192, "z": 12, "cf": 0.9399999976158142 } ], "ln": 1053128 }, { "b": "swKchlORIap\u0026]\u003e}k%]e.v{}62r-A^em(b9{lPmT@zd9A^s6wHjm[43iltY4BgEU.}gxo%FxF%Q9mRLZ1qE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4$wPI^jA:@W4075CVvovbus1\u003cRwB.(exA+d*Ww]vVFD2[7sz7Xs{z^)c\u003ex)Kifx(v\u003e?vNt9OxN8)jBYh)*A8wz\u003eD1Wg\u003cwPRoSwPI^jA:@VPvqYH^wPv=vwPQ)%AaIHVz/53NzE^M{08^@SBzkP6rc-A", "n": [ { "c": 3, "d": ".NET resource loader marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-resource-loader", "o": 1053481, "z": 15, "cf": 0.949999988079071 } ], "ln": 1053417 }, { "b": "A+PA70bVj\u003ege{!BiEaa#l3l^mh=?\u003cpm}D^hCX7xcBzkS9l349Uzdmsb0bD7wsz}$]vLRQ!A5gQ0nj[dcm}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2^o/x\u003eRi$CxL/rBwbK\u003crb+PJ077MToh6LxAcB(yoFHQ1yCFJ.yhL\u003e8vTf\u003emiB:^TAyJq@D1)sHgc5cAxMXAtz7{0joI!R=l\u0026YL/Bvf$:C4CYowPv=Iz+j?*gCO@yyFl:foe}8[o!Za2xjB?rso8rsnP5SdgYRx7xA", "n": [ { "c": 3, "d": ".NET resource loader marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-resource-loader", "o": 1054196, "z": 25, "cf": 0.949999988079071 } ], "ln": 1054132 }, { "b": "0bs@iw\u003ed56D07bkwPHjVD2N\u003ezq!o#)x\u003e7ZJA=lbnwmY=Yq*ACawO\u003c4!z/Py?qFx(-wmo4=o\u003c}{FxjUPNl1t1JC42GhASwEEwNPW(nP5P\u003evqYN^08E6swN/*MvqYQ(wDkUOB97#ge(D?fBzkP6e(Dm$z//Yhx8\u003e}HCxdbh0d4BinOyO9nLe$IA^qRCz:OCXw[+(TxjVf(l2pvQCtA9)C$8H!B3TRPz/PMlxL?!\u003cyFd8NBXlZ#zVAH1ha8zfz#", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 1057014, "z": 9, "cf": 0.9399999976158142 } ], "ln": 1056950 }, { "b": "Bo2\u003eLv/QPJ01hN5z#:CHzu7^V01R)aASy1Tv/Q6uA@ZmY01zo}yYFwNA@Y+KaohxJnc05#zuahEyYF2D01S\u0026BwDl-JzuakFyYCNT01yZ:g5@{bwb{ACyYBC\u003eDJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvNbfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvNbfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cop=9JpVSn*B9^Y8Z\u0026YxX5H7xBHGlVl{?A+Pf1BrFD1arSA[gbw[", "n": [ { "c": 4, "d": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.", "i": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor", "o": 1060981, "z": 3, "cf": 0.8999999761581421 } ], "ln": 1060885 } ], "mol": "MdTh", "sha": "7b24e9a8334000a1e10dd9cdf66e92e46f890e5a89f77c6bd7e1957a2a97320b", "path": "7b24e9a8334000a1e10dd9cdf66e92e46f890e5a89f77c6bd7e1957a2a97320b.iso", "risk": 37, "size": 1245184, "type": "iso", "facts": { "metrics": { "file": { "size": 1245184.0, "entropy": 1.89, "size_bytes": 1245184.0 }, "binary": { "overall_entropy": 1.89, "peak_region_bytes": 143360.0, "peak_region_entropy": 7.85 } } }, "traits": [ { "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "conf": 0.9399999976158142, "crit": 3, "desc": ".NET reflection marker in opaque content", "spans": [ [ 1051528, 17 ], [ 1053192, 12 ], [ 1057014, 9 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-resource-loader", "conf": 0.949999988079071, "crit": 3, "desc": ".NET resource loader marker in opaque content", "spans": [ [ 1053481, 15 ], [ 1054196, 25 ] ] }, { "id": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor", "conf": 0.8999999761581421, "crit": 4, "desc": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.", "spans": [ [ 1060981, 3 ], [ 1061033, 3 ], [ 1061189, 3 ], [ 1061241, 3 ] ] } ] } ] } }