{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9988067746162415
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/ole",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9988068,
    "analyzed_at": "2026-05-31T02:58:27Z"
  },
  "path": "7b76ab5d84aa1dbc7018596e725a2e6a5379bd4cf66679bf2481881829fc2da3.unknown",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md(Ag)",
        "x": 1,
        "ff": {
          "m": {
            "file": {
              "size": 165896.0,
              "entropy": 7.95,
              "size_bytes": 165896.0
            },
            "office": {
              "is_encrypted": 1.0,
              "stream_count": 11.0,
              "ole.stream_count": 10.0,
              "ole.storage_count": 1.0,
              "is_macro_enabled_extension": 0.0
            }
          },
          "v": {
            "file.stem": "7b76ab5d84aa1dbc7018596e725a2e6a5379bd4cf66679bf2481881829fc2da3",
            "office.kind": "ole2",
            "file.basename": "7b76ab5d84aa1dbc7018596e725a2e6a5379bd4cf66679bf2481881829fc2da3.unknown",
            "office.streams[0]": "/",
            "office.streams[1]": "/\u0006DataSpaces",
            "office.streams[2]": "/\u0006DataSpaces/Version",
            "office.streams[3]": "/\u0006DataSpaces/DataSpaceMap",
            "office.streams[4]": "/\u0006DataSpaces/DataSpaceInfo",
            "office.streams[5]": "/\u0006DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace",
            "office.streams[6]": "/\u0006DataSpaces/TransformInfo",
            "office.streams[7]": "/\u0006DataSpaces/TransformInfo/StrongEncryptionTransform",
            "office.streams[8]": "/\u0006DataSpaces/TransformInfo/StrongEncryptionTransform/\u0006Primary",
            "office.streams[9]": "/EncryptionInfo",
            "office.features[0]": "encryption",
            "office.streams[10]": "/EncryptedPackage"
          },
          "id": "ole"
        },
        "id": 0,
        "sz": 165896,
        "ts": [
          {
            "a": "T1027",
            "c": 1.0,
            "d": "OLE2 document is encrypted",
            "i": "metadata/format/encrypted::ole2-encrypted",
            "l": 3
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "MSI embeds encoded command flag",
            "e": [
              "-e"
            ],
            "i": "objectives/command-and-control/dropper/execution/installer::msi-encoded-command-raw",
            "l": 1
          }
        ],
        "sha": "7b76ab5d84aa1dbc7018596e725a2e6a5379bd4cf66679bf2481881829fc2da3",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-12/7b76ab5d84aa1dbc7018596e725a2e6a5379bd4cf66679bf2481881829fc2da3.unknown",
        "type": "ole"
      }
    ],
    "tv": "52045"
  }
}