{
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000022232533,
        "rte": "az",
        "prob": 0.000022232533
      }
    ],
    "prob": 0.000022232533,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000022232532501220703,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T18:04:48Z"
  },
  "path": "9b7008c43814c7bf18375774bd2ed5f3bda9316dbef20b7e086fe921838f1186.iso",
  "raw": {
    "v": "8",
    "rev": "c795d",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.m%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^b000000001\u003e00000005R\u003e00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "gCHsceHStgd(5[ggbppgc]0zgf!$Eug+*BddiG6bDKQrcz/e9Cx?q=1ze99zauZ\u0026bg+]HEbX.Hrmosb5auZ?}c[3/7dL@$jg+{Hfc]9Ugf/HNqfEXI2gCypngC7ssdjNbieJbalgaC7gg=l^tfFaXdgbgWBf!1L24gjvKqCYU%l$yNOm{n})AuEy!c[3F?ltGE@B68{{n]Ybdf/HQweHS25f!k7neHR(*rzlhem]hPLBYRaQnH(ICbUg^8w\u003cH0ylVlV/djD?]qfk-gpiZq-d\u003e@$kf/HKgdgDRfsvCL]Du/",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: xor",
                "i": "metadata/encoded-payload/xor",
                "o": 73987,
                "z": 46,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 73923
          },
          {
            "b": "j0Y5?A+/liauZ?)wO#0gm}D^eD30Rsc)x{Hwm/[3wohf$a$kP0B98CpzF77Pas7Jov\u003eHn.Bw)p4x(mMitt]/*By/qwlVl\u003c=wPz(#iYY-Jz/4*HB7El^q/)4]zF7vyDmpp8bW#4vwM9X\u003ex(mMajS(1YzEUp?wPQm:By/IwbY!6Fx(mMjj0Y5?A+4NDByupPas5vEz/M%GbXXw:att(1bXXwMy\u0026*^BvTi6bq/)4]zF7OrwO#d5xGEs=aBvZsAV=+Qy9kUZfGQy5y9k9ABrz\u0026Nz/PS8C}J[",
            "n": [
              {
                "c": 3,
                "d": "Detects PowerShell code to decode Base64 data. This can yield many FP",
                "i": "third_party/SecuInfra/SUSP/Powershell/Base64/Decode",
                "o": 225797,
                "z": 35,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 225733
          },
          {
            "b": "0001mHx8F$f-S*afAq7M6Az}Hg5}sj1]#Ru\u0026B0=dAbP@iA=U]9y?$.nCX3\u003cPp5\u003eO21ov]8-zUV5:5FB/e=U\u003eKpDwHR0003100000Bn#pv000000036Acin5=zVB$YwDl-JA@Y\u003eNwDh",
            "n": [
              {
                "c": 1,
                "d": "PowerShell executable token",
                "i": "objectives/command-and-control/infrastructure/service::telegram-bot-powershell-control",
                "o": 227827,
                "z": 14,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 227795
          },
          {
            "b": "q*ACawO\u003cjUtVUSSwn=Wkp\u0026yL?A-lT.y\u00260v1f!Ld+AbP@iA=U]9y?$.nCX3\u003cPli5Rre=YbRe=WH7tMuwRe=YbRe=WH7tMv?9x-J2Jwb{JFCk#W:tMvX5C(R)=Bo2\u003eLz2=u(g5$LVr@-",
            "n": [
              {
                "c": 1,
                "d": "PowerShell executable token",
                "i": "objectives/command-and-control/infrastructure/service::telegram-bot-powershell-control",
                "o": 228013,
                "z": 14,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 227981
          }
        ],
        "mol": "MdTh",
        "sha": "9b7008c43814c7bf18375774bd2ed5f3bda9316dbef20b7e086fe921838f1186",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-06/9b7008c43814c7bf18375774bd2ed5f3bda9316dbef20b7e086fe921838f1186.iso",
        "risk": 2,
        "size": 325632,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 325632.0,
              "entropy": 6.51,
              "size_bytes": 325632.0
            },
            "binary": {
              "overall_entropy": 6.51,
              "peak_region_bytes": 88064.0,
              "peak_region_entropy": 7.82
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/xor",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: xor",
            "spans": [
              [
                73987,
                46
              ]
            ]
          },
          {
            "id": "third_party/SecuInfra/SUSP/Powershell/Base64/Decode",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Detects PowerShell code to decode Base64 data. This can yield many FP",
            "spans": [
              [
                225797,
                35
              ]
            ]
          }
        ]
      }
    ]
  }
}