{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9545454382896423,
        "class": 2,
        "threshold": 0.9545454382896423
      }
    ],
    "prob": 0.95454544,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 1
      },
      {
        "m": "az/config",
        "prob": 0.95454544,
        "class": 2
      },
      {
        "m": "az/xml",
        "prob": 0.8053395,
        "class": 1
      }
    ],
    "version": "v17.17",
    "threshold": 0.95454544,
    "analyzed_at": "2026-05-31T15:45:28Z"
  },
  "path": "a184a1bbbeb40a795316bd6f414b0d0adb93cc17aec49074e452fd8e74082cac",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(As)Md",
        "x": 37,
        "ff": {
          "m": {
            "file": {
              "size": 12446712.0,
              "entropy": 5.39,
              "size_bytes": 12446712.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "\u003csvg width=\"100%\" height=\"100%\" viewBox=\"0 0 1000 600\" xmlns=\"http://www.w3.org/2000/svg\"\u003e"
            ],
            [
              91,
              "u8",
              "\u003crect width=\"100%\" height=\"100%\" fill=\"#f5f5f7\"/\u003e"
            ],
            [
              145,
              "u8",
              "\u003ccircle cx=\"500\" cy=\"250\" r=\"150\" fill=\"#eaeaea\"/\u003e"
            ],
            [
              260,
              "u8",
              "stroke=\"#2c5282\""
            ],
            [
              288,
              "u8",
              "stroke-width=\"12\""
            ],
            [
              317,
              "u8",
              "stroke-linecap=\"round\""
            ],
            [
              351,
              "u8",
              "fill=\"none\"\u003e"
            ],
            [
              374,
              "u8",
              "\u003canimate attributeName=\"d\""
            ],
            [
              434,
              "u8",
              "repeatCount=\"indefinite\""
            ],
            [
              475,
              "u8",
              "values=\"M500 150 L500 300 M440 250 L500 310 L560 250;"
            ],
            [
              545,
              "u8",
              "M500 140 L500 290 M440 240 L500 300 L560 240;"
            ],
            [
              615,
              "u8",
              "M500 150 L500 300 M440 250 L500 310 L560 250\""
            ],
            [
              685,
              "u8",
              "calcMode=\"spline\""
            ],
            [
              719,
              "u8",
              "keySplines=\"0.4 0 0.2 1; 0.4 0 0.2 1\"/\u003e"
            ],
            [
              775,
              "u8",
              "\u003c/path\u003e"
            ],
            [
              787,
              "base64",
              "let encodedHtml = \"PHN2ZyB3aWR0aD0iMTAwJSIgaGVpZ2h0PSIxMDAlIiB2aWV3Qm94PSIwIDAgMTAwMCA2MDAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yM"
            ],
            [
              12446049,
              "u8",
              "width=\"300\" height=\"60\""
            ],
            [
              12446111,
              "u8",
              "fill=\"#3182ce\"\u003e"
            ],
            [
              12446141,
              "u8",
              "\u003canimate attributeName=\"fill\""
            ],
            [
              12446210,
              "u8",
              "begin=\"mouseover\""
            ],
            [
              12446244,
              "u8",
              "fill=\"freeze\""
            ],
            [
              12446274,
              "u8",
              "to=\"#2c5282\"/\u003e"
            ],
            [
              12446374,
              "u8",
              "begin=\"mouseout\""
            ],
            [
              12446437,
              "u8",
              "to=\"#3182ce\"/\u003e"
            ],
            [
              12446468,
              "u8",
              "\u003c/rect\u003e"
            ],
            [
              12446515,
              "u8",
              "text-anchor=\"middle\""
            ],
            [
              12446551,
              "u8",
              "fill=\"white\""
            ],
            [
              12446579,
              "u8",
              "font-family=\"Arial, sans-serif\""
            ],
            [
              12446626,
              "u8",
              "font-size=\"24\"\u003e"
            ],
            [
              12446656,
              "u8",
              "Download Now"
            ],
            [
              12446681,
              "u8",
              "\u003c/text\u003e"
            ],
            [
              12446697,
              "u8",
              "\u003c/g\u003e"
            ],
            [
              12446706,
              "u8",
              "\u003c/svg\u003e"
            ]
          ],
          "v": {
            "file.stem": "a184a1bbbeb40a795316bd6f414b0d0adb93cc17aec49074e452fd8e74082cac",
            "file.basename": "a184a1bbbeb40a795316bd6f414b0d0adb93cc17aec49074e452fd8e74082cac"
          },
          "id": "xml"
        },
        "id": 0,
        "sz": 12446712,
        "ts": [
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Excessively long lines (\u003e1MB)",
            "e": [
              "Detected line(s) exceeding 1MB (potential anti-analysis technique)"
            ],
            "i": "objectives/anti-static/excessive-line-length",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "let encodedHtml = \"PHN2ZyB3aWR0aD0iMTAwJ \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3,
            "el": [
              "offset:787"
            ]
          }
        ],
        "sha": "a184a1bbbeb40a795316bd6f414b0d0adb93cc17aec49074e452fd8e74082cac",
        "path": "/data/samples/bad/foraged/_unknown/malshare.com/malshare/a184a1bbbeb40a795316bd6f414b0d0adb93cc17aec49074e452fd8e74082cac/a184a1bbbeb40a795316bd6f414b0d0adb93cc17aec49074e452fd8e74082cac",
        "type": "xml"
      }
    ],
    "tv": "176d6"
  }
}