{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9988067746162415
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9783623,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/ole",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9988068,
    "analyzed_at": "2026-05-31T08:08:25Z"
  },
  "path": "893176f311f500159a40d549806220ce224089a3e88ed275f7c6520e9bbccb59.unknown",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(Ag₂)",
        "x": 42,
        "ff": {
          "m": {
            "file": {
              "size": 1047552.0,
              "entropy": 6.24,
              "size_bytes": 1047552.0
            },
            "office": {
              "stream_count": 3.0,
              "ole.stream_count": 2.0,
              "ole.storage_count": 1.0,
              "dangerous_clsid_count": 1.0,
              "ole.dangerous_clsid_count": 1.0,
              "is_macro_enabled_extension": 0.0
            }
          },
          "v": {
            "file.stem": "893176f311f500159a40d549806220ce224089a3e88ed275f7c6520e9bbccb59",
            "office.kind": "ole2",
            "file.basename": "893176f311f500159a40d549806220ce224089a3e88ed275f7c6520e9bbccb59.unknown",
            "office.streams[0]": "/",
            "office.streams[1]": "/2GSSAdUMow",
            "office.streams[2]": "/\u0001ole10nAtivE",
            "office.features[0]": "dangerous_clsid",
            "office.dangerous_clsids[0].name": "Equation Editor",
            "office.dangerous_clsids[0].clsid": "0002ce02-0000-0000-c000-000000000046",
            "office.dangerous_clsids[0].storage": "/"
          },
          "id": "ole"
        },
        "id": 0,
        "sz": 1047552,
        "ts": [
          {
            "c": 1.0,
            "d": "OLE10Native embedded object: 30200689 bytes in /\u0001ole10nAtivE",
            "i": "metadata/format/embedded::ole10-native-object",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Equation Editor 3.0 (CVE-2017-11882) (CLSID: 0002ce02-0000-0000-c000-000000000046) on /",
            "i": "metadata/format/clsid::dangerous-clsid",
            "l": 4
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "MSI embeds encoded command flag",
            "e": [
              "-e"
            ],
            "i": "objectives/command-and-control/dropper/execution/installer::msi-encoded-command-raw",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor",
            "e": [
              "jSFf8EKMn8PALY^OsF8m_0?SFlF_G]d:ccX0n[{X \u003cxor\u003e",
              "n|XHLl@SBgzH{Z@fDz^8EBJ1{\\|aBzm?moX\\XoFx \u003cxor\u003e",
              "q_nPsscA\\nAxDoe@[NeN;EJKey{\u003co\\8X] \u003cxor\u003e",
              "LMsJ}:MQ=\u003eP0Q?bZ@8\\x_kPm_cqOEFhnEbxLqDdG \u003cxor\u003e",
              "a^b[qQSQ?~=NknG|??k:[8CyfKEYMy9dJnAygp[\\ \u003cxor\u003e",
              "QEoGD\\^\u003eZPn}md|bfCD[bl1\u003cKX{:\u003eYb:Xx`kmx|k \u003cxor\u003e",
              "jdcpn\u003c]:g=|g\\EAYxsDA0\\x1{d~Mg`1ykaE?X^09 \u003cxor\u003e",
              "Oq9eZF`{`Je]fB[P\\xP\\\u003eze\u003ecd1;?Zs?C;s\u003eEeZ9 \u003cxor\u003e",
              "j[Yn8D]OBd]bloP\\h_E_a~~LJnChzk{LDJM:^0Eq \u003cxor\u003e",
              "c?ESKy1X\u003eeG|GJo]k=f=9YMchHl\\BKK\\x[EY1lm= \u003cxor\u003e",
              ":8`eC:E{Y~X`g\u003e\u003eJ9gYSN\u003eYqAelqDl~_npL:p\\xs \u003cxor\u003e",
              "zJd{|gAd\u003coabd=AyBAE{fGm[q\\{OD1SZq{Hmn\u003eCo \u003cxor\u003e",
              "}~19eCXNqJmNLjdyyNzn=D@^ZyDNco=jXjEbQ8HG \u003cxor\u003e",
              "0zXcDPkc;bhGmo8elCOqcGYSfQ{keyy]:GL[yC|\u003c \u003cxor\u003e",
              "xgH\u003cK_LaAnX=ZQ88kYfeDGE1S=^8fdC1Ddbz@xOS \u003cxor\u003e",
              "o~^fCCc[xblEZJoE_Kk\u003ebqs:|qyOGQFpA}F?cNF: \u003cxor\u003e"
            ],
            "i": "metadata/encoded-payload/xor",
            "l": 3,
            "el": [
              "offset:481023",
              "offset:776075",
              "offset:531775",
              "offset:224506",
              "offset:999741",
              "offset:405779",
              "offset:219961",
              "offset:956137",
              "offset:1020901",
              "offset:414419",
              "offset:217903",
              "offset:833465",
              "offset:898665",
              "offset:501900",
              "offset:537470",
              "offset:276000"
            ]
          }
        ],
        "sha": "893176f311f500159a40d549806220ce224089a3e88ed275f7c6520e9bbccb59",
        "path": "893176f311f500159a40d549806220ce224089a3e88ed275f7c6520e9bbccb59.unknown",
        "type": "ole"
      }
    ],
    "tv": "52045"
  }
}