{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Known malware Neshta detected"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.84259397,
        "rte": "az",
        "prob": 0.84259397
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T14:46:22Z"
  },
  "path": "7de5607a4d813b02830c68e50fcef26e5a647865d5ba65e4a2fa6b57b940c038.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^#r7fIWuRB3\u0026r3iqaarR^HarR^HarR^HarR^HarR^b000000002i00000006Ui00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "rG3i1Z/t53z9O8i%1E#uaPzR7RA+c7d1:WARA+aYBpj!7RA+bT\u003eU6z8%g4oOkMH1@.#G+D\u003cD8Rb\u003eYsVw%1?C]sY]o(5ni$skMFZ^@jSdg(?B=6GdS4VkMy\u00265rG3i{-an]F%5h%1gT.bBwDhYfI$/9zrCqqEkMCu{fL31.JFh9D%nL]eMJd0=\u003eO@1J%1\u0026A}t-ni8\u003ekLzY0f8T?y5!kkq0uSY%nN-n1-#$^GF^Gz%nRrIXbVE\u003cl3a=qGF^Gz%nRrsXbVE\u003cluBreG\u003egk-%b93#y5!kk\u003e\u003cMB?%bidM%nSaS:lk\u003ed%nNR!1t^\u0026J.*]x6y5!kk0cKO-Z/\u003c(zwqH\u003eh18Zv7JFg{y%nRqJ.VfUN\u003e}x:I%lG4",
            "n": [
              {
                "c": 4,
                "i": "third_party/elastic/Windows_Virus_Neshta/windows/virus/neshta",
                "o": 86336,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 86240
          },
          {
            "b": "k(Z(+mRM:JmRM):BvG$XwKcp@002G5zE=aJz/YE\u0026002z#y?mZ1mRMWIk(Z(+lVM:DBy!f?By/X.00000lVM:DBy^{Qy?k)j002xbwNPW(l${WMv@#TfC%IAg002x5z/YFXvqYQ(wDlvNx!}H%wnD5Z002@tA+fu5xHCAUx([y@002@eBvnX!x([y@002@ey?m9#pHX6Iv@}XJ002J2BwDvXwN/*F00000m}D^gnKvckA@Vgul$HgCBy!lSygQ(",
            "n": [
              {
                "c": 3,
                "d": "CreateFileA API string",
                "i": "metadata/file/format/iso::iso-createfilea",
                "o": 94920,
                "z": 11,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 94856
          },
          {
            "b": "?W!Z{\u003e.?wr7(Pzz5!]q$zvm#8*Mbuyxc*rsw5(X!I^*w4sTAeQV./MiyWhy0aGSoS000310rsk+00031aontK00031000000000000000000000000000000l$HgNxLx5uxK@q}wPI@CavZG-yANLcw/$I#y-)?kwGV28B962SpgXGWByupDe?!zxvpS{(x(k4WwO+^}B-PeT=*Z?\u003ey4yiH)D2FZ[OdtjE!EHv\u0026nTU2EJWRh(!}p7[N7M}((+xL%mu0y]5e\u003c!aI^sy(HA*1\u003cNsqs}@vbl\u0026nOFBefJ%g((+(S(HA*0\u00262\u003e6faJ0Np\u003c)z%*eG\u003cuu[a2Y3@#*^*[zC]Ke*d%}y2X7u}#m=\u003caNwdT{#7lR)}H!taS%9.B95KBwOkB(woe\u003eGaxin@zfWm5vqG\u003cmax}PVB$CE6fG0bUD2E?CB0aWPDtc!#B.\u003e/3avf@",
            "n": [
              {
                "c": 4,
                "i": "third_party/elastic/Windows_Virus_Neshta/windows/virus/neshta",
                "o": 102624,
                "z": 67,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 102528
          },
          {
            "b": "x*N8!wMiOHx\u003eg^xxKL]Y{Y9^7wO1LHvSC)$C(TGrm}D^sA=kCNwmPZ(B8}rYqVYThvpS5CvSC)$C%#%z004GHm}D^pz!a0bwK{lEwnC*y003g6m}D^hCXIm!z!9AQA=kD0B8}rYKok",
            "n": [
              {
                "c": 1,
                "d": "GetProcAddress API-resolution reference",
                "i": "metadata/file/format/iso::iso-native-api-get-proc",
                "o": 370525,
                "z": 14,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 370493
          }
        ],
        "mol": "MdTh",
        "sha": "7de5607a4d813b02830c68e50fcef26e5a647865d5ba65e4a2fa6b57b940c038",
        "path": "7de5607a4d813b02830c68e50fcef26e5a647865d5ba65e4a2fa6b57b940c038.iso",
        "risk": 37,
        "size": 385024,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 385024.0,
              "entropy": 7.03,
              "size_bytes": 385024.0
            },
            "binary": {
              "overall_entropy": 7.03,
              "peak_region_bytes": 248832.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/iso::iso-createfilea",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "CreateFileA API string",
            "spans": [
              [
                94920,
                11
              ]
            ]
          },
          {
            "id": "third_party/elastic/Windows_Virus_Neshta/windows/virus/neshta",
            "conf": 0.8999999761581421,
            "crit": 4,
            "spans": [
              [
                86336,
                3
              ],
              [
                102624,
                67
              ]
            ]
          }
        ]
      }
    ]
  }
}