{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9971691370010376,
        "class": 2,
        "threshold": 0.9922832250595093
      }
    ],
    "prob": 0.99716914,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.99716914,
        "class": 2
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/ole",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9922832,
    "analyzed_at": "2026-05-31T20:25:17Z"
  },
  "path": "b184297d2b8ac8ce3d5efe446fee4efea8a32d6cf5ca58f0028c265185511e80.unknown",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md(Ag₂)",
        "x": 41,
        "ff": {
          "m": {
            "file": {
              "size": 16384.0,
              "entropy": 1.43,
              "size_bytes": 16384.0
            },
            "office": {
              "macro_count": 3.0,
              "stream_count": 21.0,
              "ole.stream_count": 20.0,
              "ole.storage_count": 1.0,
              "dangerous_clsid_count": 2.0,
              "ole.dangerous_clsid_count": 2.0,
              "is_macro_enabled_extension": 0.0
            }
          },
          "v": {
            "file.stem": "b184297d2b8ac8ce3d5efe446fee4efea8a32d6cf5ca58f0028c265185511e80",
            "office.kind": "ole2",
            "file.basename": "b184297d2b8ac8ce3d5efe446fee4efea8a32d6cf5ca58f0028c265185511e80.unknown",
            "office.streams[0]": "/",
            "office.streams[1]": "/_1781388013",
            "office.streams[2]": "/_1781388014",
            "office.streams[3]": "/_1781388014/\u0001Ole",
            "office.streams[4]": "/_1781388014/\u0003ObjInfo",
            "office.streams[5]": "/_1781388014/\u0003LinkInfo",
            "office.streams[6]": "/_1781388018",
            "office.streams[7]": "/_1781388018/\u0001Ole",
            "office.streams[8]": "/_1781388018/\u0003ObjInfo",
            "office.streams[9]": "/\u000b_1781388019",
            "office.features[0]": "macros",
            "office.features[1]": "dangerous_clsid",
            "office.streams[10]": "/\u000b_1781388019/VBA",
            "office.streams[11]": "/\u000b_1781388019/VBA/ThisDocument",
            "office.streams[12]": "/\u000b_1781388019/VBA/_VBA_PROJECT",
            "office.streams[13]": "/\u000b_1781388020",
            "office.streams[14]": "/\u000b_1781388020/VBA",
            "office.streams[15]": "/\u000b_1781388020/VBA/ThisDocument",
            "office.streams[16]": "/\u000b_1781388020/VBA/_VBA_PROJECT",
            "office.streams[17]": "/\u000b_1781388063",
            "office.streams[18]": "/\u000b_1781388063/VBA",
            "office.streams[19]": "/\u000b_1781388063/VBA/ThisDocument",
            "office.streams[20]": "/\u000b_1781388063/VBA/_VBA_PROJECT",
            "office.dangerous_clsids[0].name": "StdOleLink",
            "office.dangerous_clsids[1].name": "StdOleLink",
            "office.dangerous_clsids[0].clsid": "00000300-0000-0000-c000-000000000046",
            "office.dangerous_clsids[1].clsid": "00000300-0000-0000-c000-000000000046",
            "office.dangerous_clsids[0].storage": "/_1781388014",
            "office.dangerous_clsids[1].storage": "/_1781388018"
          },
          "id": "ole"
        },
        "id": 0,
        "sz": 16384,
        "ts": [
          {
            "a": "T1059.005",
            "c": 1.0,
            "d": "OLE2 document contains VBA macros (0 modules: )",
            "i": "metadata/format/macro::ole2-has-vba",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "StdOleLink (external link) (CLSID: 00000300-0000-0000-c000-000000000046) on /_1781388014",
            "i": "metadata/format/clsid::dangerous-clsid",
            "l": 4
          }
        ],
        "sha": "b184297d2b8ac8ce3d5efe446fee4efea8a32d6cf5ca58f0028c265185511e80",
        "path": "b184297d2b8ac8ce3d5efe446fee4efea8a32d6cf5ca58f0028c265185511e80.unknown",
        "type": "ole"
      }
    ],
    "tv": "176d6"
  }
}