{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Embedded Windows threat payload"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.99790466,
        "rte": "az",
        "prob": 0.99790466
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T12:42:31Z"
  },
  "path": "b8bb69625663a99c2400b84dbea5de7649961ee0684b08057dcdd55221fd758d.iso",
  "raw": {
    "v": "8",
    "rev": "3e1ed",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "E+3mvndR]Gl5CwgIonww-q@Hg[-UA3%nLUJ(#Y^iI+s)UIWw.84\u003cagt0a)?]aa%Q]0000\u0026IW\u00262-W:mM$-2@n\u003cuTk%5(5bAs%7i\u003e]aa%Q]0000\u0026I=7V^54onAIsBb?-2@n\u003cuTk%5\u003e[:o#%7h=-l\u0026WiMr8)12q+hMcav}vjnq/?voP8B}o[*Yh7d:AT5d=j$nq1\u00266tv7Vxl0N1Y\u0026BXft54j.ml4F.C4$]Gl002rn{.X8Xnq1\u00266tv7Vxl0Rq#IqpZP-sNdToP9x(o[?US\u003c1ZMAW^@-x4\u003ccr40000\u0026IWz#=UG][4l\u003e6b!JyTNJ{T\u00261W:vRv106#Fhnq1}-\u003e./xt%4blGBGd(\u0026lKlkvp-8-Yli{boZ\u0026^N^IVMAWUG6g[oA=0[=$i!gl\u0026WiTI:eaIJy%*J54otCInz/o-2@n\u003cuTk%5\u003e%CyH%7muUrZx.Kr8)12q+hMcav}zNI?h6inr4s%nqUTTls#rII:E+vGlO^ABqms",
            "n": [
              {
                "c": 5,
                "i": "third_party/elastic/Windows_Generic_Threat/windows/generic_threat",
                "o": 4344761,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 4344633
          },
          {
            "b": "lv0V:rbU\u0026LwmXbwvr8tS23kIHwKyctA-u%KB.(ellv0V:06QDOwPQvUC4\u003e#nzF-%5Bw)p4x(mN8r@-l80y?9vwKQGWx(XcfzdNQbq/)4]zFa2(09ot5wPQ\u003c)wjQcDwnC/S0967\u003cwPQyQy?lN\u003eAaG4a0.l*zq/)4]zF8{]AaJ8J0jh\u00264lRR0dq/)4]zF92J0j@q5wPQ:?z!0v1B4x\u003eJz#Y(t14W0iA8QE%wDhZg14W0iA8Hmky\u00261310hPY=y\u0026%/jmRMWIluM)LwPz?(0pQ1VwPQpTzGx-jwKxn]00ii(wD",
            "n": [
              {
                "c": 3,
                "d": "Encoded payload detected: xor",
                "i": "metadata/encoded-payload/xor",
                "o": 4756045,
                "z": 45,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 4755981
          }
        ],
        "mol": "MdTh",
        "sha": "b8bb69625663a99c2400b84dbea5de7649961ee0684b08057dcdd55221fd758d",
        "path": "b8bb69625663a99c2400b84dbea5de7649961ee0684b08057dcdd55221fd758d.iso",
        "risk": 109,
        "size": 5177344,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 5177344.0,
              "entropy": 7.24,
              "size_bytes": 5177344.0
            },
            "binary": {
              "overall_entropy": 7.24,
              "peak_region_bytes": 3451904.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/xor",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Encoded payload detected: xor",
            "spans": [
              [
                4756045,
                45
              ]
            ]
          },
          {
            "id": "third_party/elastic/Windows_Generic_Threat/windows/generic_threat",
            "conf": 0.8999999761581421,
            "crit": 5,
            "spans": [
              [
                4344761,
                3
              ]
            ]
          }
        ]
      }
    ]
  }
}