{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9988067746162415, "class": 2, "threshold": 0.9988067746162415 } ], "prob": 0.9988068, "skip": [ { "m": "az/docx", "why": "uncalibrated" } ], "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/documents", "prob": 0.9988068, "class": 2 } ], "version": "v17.17", "threshold": 0.9988068, "analyzed_at": "2026-05-30T16:03:08Z" }, "path": "b36600faab3eebec983dfc41b7004816b1fe53c1d0235f261e70b4b929ea0b0e.docm", "raw": { "v": "5", "fs": [ { "f": "Md(Ag)", "x": 2, "ff": { "m": { "file": { "size": 44023.0, "entropy": 7.77, "size_bytes": 44023.0 }, "office": { "macro_count": 1.0, "ooxml.entry_count": 24.0, "ooxml.max_entry_size": 74609.0, "is_macro_enabled_extension": 1.0, "ooxml.declares_vba_project": 1.0, "ooxml.is_word_vba_document": 1.0, "ooxml.declares_macro_enabled": 1.0 }, "archive": { "file_count": 24.0, "member_count": 24.0, "script_count": 0.0, "zip_bomb_ratio": 9.39, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 39121.0, "compression.ratio": 0.22, "hidden_file_count": 1.0, "total_uncompressed": 178648.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 34.0, "rtlo_filename_count": 0.0, "format.regular_count": 24.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.04, "misplaced_executable_count": 2.0, "timing.mtime_dominant_count": 24.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 24.0 } }, "v": { "file.stem": "b36600faab3eebec983dfc41b7004816b1fe53c1d0235f261e70b4b929ea0b0e", "office.kind": "docx", "office.title": "Legal Document", "file.basename": "b36600faab3eebec983dfc41b7004816b1fe53c1d0235f261e70b4b929ea0b0e.docm", "office.company": "Merus, Inc.", "office.created": "2025-12-18T04:52:00Z", "office.creator": "MerusCase", "office.keywords": "WzEzNzE2MTcsNTYwNDk0NjcsIjY5NDQ0YWZmLTFiYzQtNDZhYi1hZTE2LTQ1ODIwYTAwMDA5OCIsMzM3NV0=", "office.modified": "2026-01-05T23:13:00Z", "office.revision": "42", "office.macros[0]": "word/vbaProject.bin", "office.application": "Microsoft Office Word", "office.description": "WzEzNzE2MTcsNTYwNDk0NjcsIjY5NDQ0YWZmLTFiYzQtNDZhYi1hZTE2LTQ1ODIwYTAwMDA5OCIsMzM3NV0=", "office.features[0]": "macros", "archive.format.kind": "zip", "archive.members[0].path": "[Content_Types].xml", "archive.members[1].path": "_rels/.rels", "archive.members[2].path": "word/document.xml", "archive.members[3].path": "word/_rels/document.xml.rels", "archive.members[4].path": "word/footnotes.xml", "archive.members[5].path": "word/endnotes.xml", "archive.members[6].path": "word/header1.xml", "archive.members[7].path": "word/footer1.xml", "archive.members[8].path": "word/vbaProject.bin", "archive.members[9].path": "word/theme/theme1.xml", "office.last_modified_by": "Angie Fayad", "archive.members[0].crc32": 1111635565, "archive.members[10].path": "word/_rels/vbaProject.bin.rels", "archive.members[11].path": "word/customizations.xml", "archive.members[12].path": "word/attachedToolbars.bin", "archive.members[13].path": "word/vbaData.xml", "archive.members[14].path": "word/settings.xml", "archive.members[15].path": "word/_rels/customizations.xml.rels", "archive.members[16].path": "word/numbering.xml", "archive.members[17].path": "word/styles.xml", "archive.members[18].path": "word/webSettings.xml", "archive.members[19].path": "word/fontTable.xml", "archive.members[1].crc32": 2223078617, "archive.members[20].path": "docProps/core.xml", "archive.members[21].path": "docProps/app.xml", "archive.members[22].path": "docProps/custom.xml", "archive.members[23].path": "userCustomization/customUI.xml", "archive.members[2].crc32": 778678077, "archive.members[3].crc32": 2036364850, "archive.members[4].crc32": 3427082075, "archive.members[5].crc32": 68045340, "archive.members[6].crc32": 145716173, "archive.members[7].crc32": 1875674260, "archive.members[8].crc32": 2206888741, "archive.members[9].crc32": 3803035030, "archive.timing.mtime_max": 315532800, "archive.timing.mtime_min": 315532800, "archive.members[10].crc32": 4016051208, "archive.members[11].crc32": 1465858226, "archive.members[12].crc32": 2386685437, "archive.members[13].crc32": 4102008182, "archive.members[14].crc32": 3219497442, "archive.members[15].crc32": 92549152, "archive.members[16].crc32": 2565333962, "archive.members[17].crc32": 430927358, "archive.members[18].crc32": 2533165627, "archive.members[19].crc32": 936026072, "archive.members[20].crc32": 4193396827, "archive.members[21].crc32": 2705741624, "archive.members[22].crc32": 1623767374, "archive.members[23].crc32": 4015786440, "archive.format.entry_types[0]": "regular", "archive.members[0].entry_type": "regular", "archive.members[0].mtime_unix": 315532800, "archive.members[0].size_bytes": 2445, "archive.members[1].entry_type": "regular", "archive.members[1].mtime_unix": 315532800, "archive.members[1].size_bytes": 885, "archive.members[2].entry_type": "regular", "archive.members[2].mtime_unix": 315532800, "archive.members[2].size_bytes": 74609, "archive.members[3].entry_type": "regular", "archive.members[3].mtime_unix": 315532800, "archive.members[3].size_bytes": 1731, "archive.members[4].entry_type": "regular", "archive.members[4].mtime_unix": 315532800, "archive.members[4].size_bytes": 3018, "archive.members[5].entry_type": "regular", "archive.members[5].mtime_unix": 315532800, "archive.members[5].size_bytes": 3012, "archive.members[6].entry_type": "regular", "archive.members[6].mtime_unix": 315532800, "archive.members[6].size_bytes": 2843, "archive.members[7].entry_type": "regular", "archive.members[7].mtime_unix": 315532800, "archive.members[7].size_bytes": 2928, "archive.members[8].entry_type": "regular", "archive.members[8].mtime_unix": 315532800, "archive.members[8].size_bytes": 19456, "archive.members[9].entry_type": "regular", "archive.members[9].mtime_unix": 315532800, "archive.members[9].size_bytes": 6992, "archive.compression.methods[0]": "deflate", "archive.members[0].data_offset": 569, "archive.members[10].entry_type": "regular", "archive.members[10].mtime_unix": 315532800, "archive.members[10].size_bytes": 277, "archive.members[11].entry_type": "regular", "archive.members[11].mtime_unix": 315532800, "archive.members[11].size_bytes": 278, "archive.members[12].entry_type": "regular", "archive.members[12].mtime_unix": 315532800, "archive.members[12].size_bytes": 208, "archive.members[13].entry_type": "regular", "archive.members[13].mtime_unix": 315532800, "archive.members[13].size_bytes": 2792, "archive.members[14].entry_type": "regular", "archive.members[14].mtime_unix": 315532800, "archive.members[14].size_bytes": 5957, "archive.members[15].entry_type": "regular", "archive.members[15].mtime_unix": 315532800, "archive.members[15].size_bytes": 291, "archive.members[16].entry_type": "regular", "archive.members[16].mtime_unix": 315532800, "archive.members[16].size_bytes": 10552, "archive.members[17].entry_type": "regular", "archive.members[17].mtime_unix": 315532800, "archive.members[17].size_bytes": 33605, "archive.members[18].entry_type": "regular", "archive.members[18].mtime_unix": 315532800, "archive.members[18].size_bytes": 1018, "archive.members[19].entry_type": "regular", "archive.members[19].mtime_unix": 315532800, "archive.members[19].size_bytes": 2359, "archive.members[1].data_offset": 1624, "archive.members[20].entry_type": "regular", "archive.members[20].mtime_unix": 315532800, "archive.members[20].size_bytes": 958, "archive.members[21].entry_type": "regular", "archive.members[21].mtime_unix": 315532800, "archive.members[21].size_bytes": 1080, "archive.members[22].entry_type": "regular", "archive.members[22].mtime_unix": 315532800, "archive.members[22].size_bytes": 939, "archive.members[23].entry_type": "regular", "archive.members[23].mtime_unix": 315532800, "archive.members[23].size_bytes": 415, "archive.members[2].data_offset": 1963, "archive.members[3].data_offset": 16902, "archive.members[4].data_offset": 17319, "archive.members[5].data_offset": 18060, "archive.members[6].data_offset": 18800, "archive.members[7].data_offset": 19534, "archive.members[8].data_offset": 20267, "archive.members[9].data_offset": 28626, "archive.members[10].data_offset": 30207, "archive.members[11].data_offset": 30451, "archive.members[12].data_offset": 30701, "archive.members[13].data_offset": 30874, "archive.members[14].data_offset": 31597, "archive.members[15].data_offset": 33365, "archive.members[16].data_offset": 33603, "archive.members[17].data_offset": 35187, "archive.members[18].data_offset": 38816, "archive.members[19].data_offset": 39199, "archive.members[20].data_offset": 40128, "archive.members[21].data_offset": 40916, "archive.members[22].data_offset": 41754, "archive.members[23].data_offset": 42192, "archive.members[1].header_offset": 1063, "archive.members[2].header_offset": 1916, "archive.members[3].header_offset": 16580, "archive.members[4].header_offset": 17271, "archive.members[5].header_offset": 18013, "archive.members[6].header_offset": 18754, "archive.members[7].header_offset": 19488, "archive.members[8].header_offset": 20218, "archive.members[9].header_offset": 28575, "archive.members[10].header_offset": 30147, "archive.members[11].header_offset": 30398, "archive.members[12].header_offset": 30646, "archive.members[13].header_offset": 30828, "archive.members[14].header_offset": 31550, "archive.members[15].header_offset": 33301, "archive.members[16].header_offset": 33555, "archive.members[17].header_offset": 35142, "archive.members[18].header_offset": 38766, "archive.members[19].header_offset": 39151, "archive.members[20].header_offset": 39817, "archive.members[21].header_offset": 40606, "archive.members[22].header_offset": 41441, "archive.members[23].header_offset": 42132, "archive.members[0].compressed_size": 494, "archive.members[1].compressed_size": 292, "archive.members[2].compressed_size": 14617, "archive.members[3].compressed_size": 369, "archive.members[4].compressed_size": 694, "archive.members[5].compressed_size": 694, "archive.members[6].compressed_size": 688, "archive.members[7].compressed_size": 684, "archive.members[8].compressed_size": 8308, "archive.members[9].compressed_size": 1521, "archive.members[10].compressed_size": 191, "archive.members[11].compressed_size": 195, "archive.members[12].compressed_size": 127, "archive.members[13].compressed_size": 676, "archive.members[14].compressed_size": 1704, "archive.members[15].compressed_size": 190, "archive.members[16].compressed_size": 1539, "archive.members[17].compressed_size": 3579, "archive.members[18].compressed_size": 335, "archive.members[19].compressed_size": 618, "archive.members[20].compressed_size": 478, "archive.members[21].compressed_size": 525, "archive.members[22].compressed_size": 378, "archive.members[23].compressed_size": 225, "archive.members[0].compression_method": "deflate", "archive.members[1].compression_method": "deflate", "archive.members[2].compression_method": "deflate", "archive.members[3].compression_method": "deflate", "archive.members[4].compression_method": "deflate", "archive.members[5].compression_method": "deflate", "archive.members[6].compression_method": "deflate", "archive.members[7].compression_method": "deflate", "archive.members[8].compression_method": "deflate", "archive.members[9].compression_method": "deflate", "archive.members[10].compression_method": "deflate", "archive.members[11].compression_method": "deflate", "archive.members[12].compression_method": "deflate", "archive.members[13].compression_method": "deflate", "archive.members[14].compression_method": "deflate", "archive.members[15].compression_method": "deflate", "archive.members[16].compression_method": "deflate", "archive.members[17].compression_method": "deflate", "archive.members[18].compression_method": "deflate", "archive.members[19].compression_method": "deflate", "archive.members[20].compression_method": "deflate", "archive.members[21].compression_method": "deflate", "archive.members[22].compression_method": "deflate", "archive.members[23].compression_method": "deflate", "archive.members[0].central_header_offset": 42417, "archive.members[1].central_header_offset": 42482, "archive.members[2].central_header_offset": 42539, "archive.members[3].central_header_offset": 42602, "archive.members[4].central_header_offset": 42676, "archive.members[5].central_header_offset": 42740, "archive.members[6].central_header_offset": 42803, "archive.members[7].central_header_offset": 42865, "archive.members[8].central_header_offset": 42927, "archive.members[9].central_header_offset": 42992, "archive.members[10].central_header_offset": 43059, "archive.members[11].central_header_offset": 43135, "archive.members[12].central_header_offset": 43204, "archive.members[13].central_header_offset": 43275, "archive.members[14].central_header_offset": 43337, "archive.members[15].central_header_offset": 43400, "archive.members[16].central_header_offset": 43480, "archive.members[17].central_header_offset": 43544, "archive.members[18].central_header_offset": 43605, "archive.members[19].central_header_offset": 43671, "archive.members[20].central_header_offset": 43735, "archive.members[21].central_header_offset": 43798, "archive.members[22].central_header_offset": 43860, "archive.members[23].central_header_offset": 43925 }, "id": "docx" }, "id": 0, "sz": 44023, "ts": [ { "a": "T1059.005", "c": 1.0, "d": "OOXML document contains VBA macros (0 modules: )", "i": "metadata/format/macro::ooxml-has-vba", "l": 3 }, { "c": 0.9900000095367432, "d": "OOXML Word VBA document", "i": "metadata/document/office/markup::ooxml-word-vba-document", "l": 2 } ], "sha": "b36600faab3eebec983dfc41b7004816b1fe53c1d0235f261e70b4b929ea0b0e", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2026-01/b36600faab3eebec983dfc41b7004816b1fe53c1d0235f261e70b4b929ea0b0e.docm", "type": "docx" } ], "tv": "ca5ef" } }