{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9988067746162415
      }
    ],
    "prob": 1.0,
    "skip": [
      {
        "m": "az/docx",
        "why": "uncalibrated"
      }
    ],
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9380215,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9988068,
    "analyzed_at": "2026-05-31T06:06:43Z"
  },
  "path": "9c37fe8fa22a2b027c1c503aa2f033124d62477cfc25ae04fec57318eb4e20bc.doc",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)Md",
        "x": 42,
        "ff": {
          "m": {
            "file": {
              "size": 257857.0,
              "entropy": 7.99,
              "size_bytes": 257857.0
            },
            "office": {
              "embedded_count": 1.0,
              "ooxml.entry_count": 15.0,
              "ooxml.max_entry_size": 244224.0,
              "ooxml.image_part_count": 2.0,
              "embedded_executable_count": 1.0,
              "ooxml.embedded_part_count": 1.0,
              "is_macro_enabled_extension": 0.0
            },
            "archive": {
              "file_count": 15.0,
              "member_count": 15.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 7.99,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 254269.0,
              "compression.ratio": 0.84,
              "hidden_file_count": 1.0,
              "total_uncompressed": 303245.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 30.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 15.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 1.0,
              "timing.mtime_unique_ratio": 0.07,
              "misplaced_executable_count": 1.0,
              "timing.mtime_dominant_count": 15.0,
              "timing.mtime_spread_seconds": 0.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 1.0,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 14.0
            }
          },
          "v": {
            "file.stem": "9c37fe8fa22a2b027c1c503aa2f033124d62477cfc25ae04fec57318eb4e20bc",
            "office.kind": "docx",
            "file.basename": "9c37fe8fa22a2b027c1c503aa2f033124d62477cfc25ae04fec57318eb4e20bc.doc",
            "office.company": "Tester",
            "office.created": "2020-12-17T14:32:00Z",
            "office.creator": "Tester",
            "office.modified": "2020-12-17T14:32:00Z",
            "office.revision": "1",
            "office.application": "Microsoft Office Word",
            "office.features[0]": "ole_objects",
            "archive.format.kind": "zip",
            "archive.members[0].path": "[Content_Types].xml",
            "archive.members[1].path": "_rels/.rels",
            "archive.members[2].path": "word/_rels/document.xml.rels",
            "archive.members[3].path": "word/document.xml",
            "archive.members[4].path": "word/theme/theme1.xml",
            "archive.members[5].path": "word/media/image1.png",
            "archive.members[6].path": "word/media/image2.emf",
            "archive.members[7].path": "word/embeddings/oleObject1.bin",
            "archive.members[8].path": "word/settings.xml",
            "archive.members[9].path": "word/webSettings.xml",
            "office.embedded[0].kind": "ole2",
            "office.last_modified_by": "Tester",
            "archive.members[0].crc32": 1150542029,
            "archive.members[10].path": "word/stylesWithEffects.xml",
            "archive.members[11].path": "word/styles.xml",
            "archive.members[12].path": "docProps/core.xml",
            "archive.members[13].path": "word/fontTable.xml",
            "archive.members[14].path": "docProps/app.xml",
            "archive.members[1].crc32": 3071971614,
            "archive.members[2].crc32": 2686353349,
            "archive.members[3].crc32": 395866090,
            "archive.members[4].crc32": 3786242837,
            "archive.members[5].crc32": 3370490318,
            "archive.members[6].crc32": 4118434022,
            "archive.members[7].crc32": 4129342875,
            "archive.members[8].crc32": 1160972883,
            "archive.members[9].crc32": 1310105623,
            "archive.timing.mtime_max": 315532800,
            "archive.timing.mtime_min": 315532800,
            "archive.members[10].crc32": 152300147,
            "archive.members[11].crc32": 2752452044,
            "archive.members[12].crc32": 1135235611,
            "archive.members[13].crc32": 1689659975,
            "archive.members[14].crc32": 3009836205,
            "office.embedded[0].source": "word/document.xml",
            "office.embedded[0].filename": "word/embeddings/oleObject1.bin",
            "archive.format.entry_types[0]": "regular",
            "archive.members[0].entry_type": "regular",
            "archive.members[0].mtime_unix": 315532800,
            "archive.members[0].size_bytes": 1620,
            "archive.members[1].entry_type": "regular",
            "archive.members[1].mtime_unix": 315532800,
            "archive.members[1].size_bytes": 590,
            "archive.members[2].entry_type": "regular",
            "archive.members[2].mtime_unix": 315532800,
            "archive.members[2].size_bytes": 1362,
            "archive.members[3].entry_type": "regular",
            "archive.members[3].mtime_unix": 315532800,
            "archive.members[3].size_bytes": 3496,
            "archive.members[4].entry_type": "regular",
            "archive.members[4].mtime_unix": 315532800,
            "archive.members[4].size_bytes": 7070,
            "archive.members[5].entry_type": "regular",
            "archive.members[5].mtime_unix": 315532800,
            "archive.members[5].size_bytes": 3755,
            "archive.members[6].entry_type": "regular",
            "archive.members[6].mtime_unix": 315532800,
            "archive.members[6].size_bytes": 5148,
            "archive.members[7].entry_type": "regular",
            "archive.members[7].mtime_unix": 315532800,
            "archive.members[7].size_bytes": 244224,
            "archive.members[8].entry_type": "regular",
            "archive.members[8].mtime_unix": 315532800,
            "archive.members[8].size_bytes": 2231,
            "archive.members[9].entry_type": "regular",
            "archive.members[9].mtime_unix": 315532800,
            "archive.members[9].size_bytes": 428,
            "office.embedded[0].size_bytes": 244224,
            "archive.compression.methods[0]": "deflate",
            "archive.compression.methods[1]": "stored",
            "archive.members[0].data_offset": 569,
            "archive.members[10].entry_type": "regular",
            "archive.members[10].mtime_unix": 315532800,
            "archive.members[10].size_bytes": 15716,
            "archive.members[11].entry_type": "regular",
            "archive.members[11].mtime_unix": 315532800,
            "archive.members[11].size_bytes": 14963,
            "archive.members[12].entry_type": "regular",
            "archive.members[12].mtime_unix": 315532800,
            "archive.members[12].size_bytes": 739,
            "archive.members[13].entry_type": "regular",
            "archive.members[13].mtime_unix": 315532800,
            "archive.members[13].size_bytes": 1186,
            "archive.members[14].entry_type": "regular",
            "archive.members[14].mtime_unix": 315532800,
            "archive.members[14].size_bytes": 717,
            "archive.members[1].data_offset": 1559,
            "archive.members[2].data_offset": 2124,
            "archive.members[3].data_offset": 2522,
            "archive.members[4].data_offset": 3969,
            "archive.members[5].data_offset": 5726,
            "archive.members[6].data_offset": 9532,
            "archive.members[7].data_offset": 11894,
            "archive.members[8].data_offset": 249792,
            "archive.members[9].data_offset": 250747,
            "archive.members[10].data_offset": 251061,
            "archive.members[11].data_offset": 253109,
            "archive.members[12].data_offset": 255293,
            "archive.members[13].data_offset": 255709,
            "archive.members[14].data_offset": 256472,
            "archive.members[1].header_offset": 998,
            "archive.members[2].header_offset": 1802,
            "archive.members[3].header_offset": 2475,
            "archive.members[4].header_offset": 3918,
            "archive.members[5].header_offset": 5675,
            "archive.members[6].header_offset": 9481,
            "archive.members[7].header_offset": 11834,
            "archive.members[8].header_offset": 249745,
            "archive.members[9].header_offset": 250697,
            "archive.members[10].header_offset": 251005,
            "archive.members[11].header_offset": 253064,
            "archive.members[12].header_offset": 254982,
            "archive.members[13].header_offset": 255661,
            "archive.members[14].header_offset": 256162,
            "archive.members[0].compressed_size": 429,
            "archive.members[1].compressed_size": 243,
            "archive.members[2].compressed_size": 351,
            "archive.members[3].compressed_size": 1396,
            "archive.members[4].compressed_size": 1706,
            "archive.members[5].compressed_size": 3755,
            "archive.members[6].compressed_size": 2302,
            "archive.members[7].compressed_size": 237851,
            "archive.members[8].compressed_size": 905,
            "archive.members[9].compressed_size": 258,
            "archive.members[10].compressed_size": 2003,
            "archive.members[11].compressed_size": 1873,
            "archive.members[12].compressed_size": 368,
            "archive.members[13].compressed_size": 453,
            "archive.members[14].compressed_size": 376,
            "office.embedded[0].relationship_type": "oleObject",
            "archive.members[0].compression_method": "deflate",
            "archive.members[1].compression_method": "deflate",
            "archive.members[2].compression_method": "deflate",
            "archive.members[3].compression_method": "deflate",
            "archive.members[4].compression_method": "deflate",
            "archive.members[5].compression_method": "stored",
            "archive.members[6].compression_method": "deflate",
            "archive.members[7].compression_method": "deflate",
            "archive.members[8].compression_method": "deflate",
            "archive.members[9].compression_method": "deflate",
            "archive.members[10].compression_method": "deflate",
            "archive.members[11].compression_method": "deflate",
            "archive.members[12].compression_method": "deflate",
            "archive.members[13].compression_method": "deflate",
            "archive.members[14].compression_method": "deflate",
            "archive.members[0].central_header_offset": 256848,
            "archive.members[1].central_header_offset": 256913,
            "archive.members[2].central_header_offset": 256970,
            "archive.members[3].central_header_offset": 257044,
            "archive.members[4].central_header_offset": 257107,
            "archive.members[5].central_header_offset": 257174,
            "archive.members[6].central_header_offset": 257241,
            "archive.members[7].central_header_offset": 257308,
            "archive.members[8].central_header_offset": 257384,
            "archive.members[9].central_header_offset": 257447,
            "archive.members[10].central_header_offset": 257513,
            "archive.members[11].central_header_offset": 257585,
            "archive.members[12].central_header_offset": 257646,
            "archive.members[13].central_header_offset": 257709,
            "archive.members[14].central_header_offset": 257773
          },
          "id": "docx"
        },
        "id": 0,
        "sz": 257857,
        "ts": [
          {
            "a": "T1027.006",
            "c": 0.949999988079071,
            "d": "Embedded executable in OOXML entry: word/embeddings/oleObject1.bin",
            "i": "objectives/command-and-control/dropper/payload::embedded-executable",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "First revision document",
            "e": [
              "1"
            ],
            "i": "metadata/document/office/properties::office-revision-one",
            "l": 2,
            "el": [
              "value:office.revision"
            ]
          },
          {
            "c": 0.9700000286102295,
            "d": "Embedded OLE object part",
            "e": [
              "word/embeddings/oleObject1.bin"
            ],
            "i": "metadata/document/office/markup::ooxml-embedded-ole-part",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 1.0,
            "d": "File extension claims OleDoc but content is Ooxml",
            "e": [
              "expected=OleDoc, actual=Ooxml"
            ],
            "i": "metadata/file-extension-mismatch",
            "l": 4
          }
        ],
        "sha": "9c37fe8fa22a2b027c1c503aa2f033124d62477cfc25ae04fec57318eb4e20bc",
        "path": "9c37fe8fa22a2b027c1c503aa2f033124d62477cfc25ae04fec57318eb4e20bc.doc",
        "type": "docx"
      }
    ],
    "tv": "52045"
  }
}