{
  "llm": {
    "conf": 0.9076907,
    "error": "no LLM endpoint of http://10.9.8.149:8000/v1 became healthy within 60s",
    "model": "Qwen/Qwen3.8-27B",
    "outcome": "benign"
  },
  "ml": {
    "v": "7",
    "eng": "2.11.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9076907,
        "rte": "az",
        "prob": 0.9076907
      },
      {
        "cls": 0,
        "raw": 0.33685496,
        "rte": "az/media",
        "prob": 0.33685496
      }
    ],
    "prob": 0.9076907,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.907690703868866,
        "type": "gif"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-15T12:37:03Z"
  },
  "path": "Backdoor.Win32.Frauder.lz",
  "raw": {
    "v": "8",
    "rev": "e86a6",
    "files": [
      {
        "id": 0,
        "mol": "MdTh",
        "sha": "96b48a6dd6d49d730e6740224e380171220f985bf549f53ba559606f94f3846a",
        "path": "/data/samples/bad/datasets/vxheaven/win32/backdoor/Backdoor.Win32.Frauder.lz",
        "risk": 109,
        "size": 1648682,
        "type": "gif",
        "facts": {
          "metrics": {
            "file": {
              "size": 1648682,
              "entropy": 8
            },
            "media": {
              "gap_bytes": 0,
              "stowaway_bytes": 1641543,
              "trailing_bytes": 1641540,
              "stowaway_entropy": 8
            },
            "binary": {
              "peak_region_bytes": 1636352,
              "peak_region_entropy": 7.86
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.image_as_unknown": 1
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/media::media-stowaway-high-entropy",
            "conf": 0.92,
            "crit": 3,
            "desc": "Unclaimed asset bytes are compressed"
          },
          {
            "id": "metadata/file/format/media::media-structure-problem-reported",
            "conf": 0.95,
            "crit": 3,
            "desc": "Container structure failed validation"
          },
          {
            "id": "metadata/file/format/media::media-trailing-data",
            "conf": 0.92,
            "crit": 3,
            "desc": "Data appended after container end"
          },
          {
            "id": "third_party/SigBase/SUSP/GIF/Anomalies",
            "conf": 0.9,
            "crit": 5,
            "desc": "Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type"
          }
        ]
      }
    ]
  }
}