{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9998269,
        "class": 1
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/rtf",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-18T04:02:26Z"
  },
  "path": "a9a2b7e3e662c2237bf2c866c113a51c45548a8d6080f99897ffbb29be976310.doc",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "MdTh",
        "k": {
          "header.version": 1,
          "shape.max_nesting_depth": 5
        },
        "x": 149,
        "id": 0,
        "ms": {
          "file": {
            "size": 10861.0
          }
        },
        "sz": 10861,
        "ts": [
          {
            "c": 0.8500000238418579,
            "d": "RTF info.author is missing",
            "e": [
              "field 'info.author' does not exist"
            ],
            "i": "metadata/document/rtf/properties::rtf-info-author-missing",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Large alphanumeric padding block",
            "e": [
              "11497124020000000b0000004551556174496f4e2e330000000000000000009c080000037e86eb4742010561accdecde00000000000000000000000000000000"
            ],
            "i": "objectives/anti-static/obfuscation/document/macro::long-alphanumeric-padding",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 1.0,
            "d": "File extension claims OleDoc but content is Rtf",
            "e": [
              "expected=OleDoc, actual=Rtf"
            ],
            "i": "metadata/file-extension-mismatch",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.",
            "e": [
              "\\objupdate",
              "\\objautlink",
              "\\objdata"
            ],
            "i": "third_party/Ditekshen/INDICATOR/RTF/Malver/Objects",
            "l": 5
          }
        ],
        "sha": "a9a2b7e3e662c2237bf2c866c113a51c45548a8d6080f99897ffbb29be976310",
        "path": "a9a2b7e3e662c2237bf2c866c113a51c45548a8d6080f99897ffbb29be976310.doc",
        "type": "rtf"
      }
    ],
    "tv": "60127"
  }
}