{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 0
      },
      {
        "m": "az/xlsx",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T01:03:58Z"
  },
  "path": "bbe3b9175095f0942fbcc4d2ebfef68b972ccf9f22cf52012a3e31eb498b4091.xlsm",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md(Ag)",
        "x": 1,
        "ff": {
          "m": {
            "file": {
              "size": 30060.0,
              "entropy": 7.71,
              "size_bytes": 30060.0
            },
            "office": {
              "macro_count": 1.0,
              "ooxml.entry_count": 16.0,
              "ooxml.max_entry_size": 21504.0,
              "ooxml.image_part_count": 1.0,
              "is_macro_enabled_extension": 1.0,
              "ooxml.declares_vba_project": 1.0,
              "ooxml.declares_macro_enabled": 1.0
            },
            "archive": {
              "file_count": 16.0,
              "member_count": 16.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 4.47,
              "directory_count": 0.0,
              "executable_count": 2.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 26334.0,
              "compression.ratio": 0.45,
              "hidden_file_count": 1.0,
              "total_uncompressed": 58010.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 39.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 16.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 1.0,
              "timing.mtime_unique_ratio": 0.06,
              "misplaced_executable_count": 2.0,
              "timing.mtime_dominant_count": 16.0,
              "timing.mtime_spread_seconds": 0.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 1.0,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 15.0
            }
          },
          "v": {
            "file.stem": "bbe3b9175095f0942fbcc4d2ebfef68b972ccf9f22cf52012a3e31eb498b4091",
            "office.kind": "xlsx",
            "file.basename": "bbe3b9175095f0942fbcc4d2ebfef68b972ccf9f22cf52012a3e31eb498b4091.xlsm",
            "office.created": "2022-08-03T10:47:00Z",
            "office.creator": "....gov.it",
            "office.modified": "2022-08-03T10:47:32Z",
            "office.macros[0]": "xl/vbaProject.bin",
            "office.application": "Microsoft Excel",
            "office.description": "pagaonline_agenziariscossione",
            "office.features[0]": "macros",
            "archive.format.kind": "zip",
            "archive.members[0].path": "[Content_Types].xml",
            "archive.members[1].path": "_rels/.rels",
            "archive.members[2].path": "xl/workbook.xml",
            "archive.members[3].path": "xl/_rels/workbook.xml.rels",
            "archive.members[4].path": "xl/worksheets/sheet1.xml",
            "archive.members[5].path": "xl/theme/theme1.xml",
            "archive.members[6].path": "xl/styles.xml",
            "archive.members[7].path": "xl/sharedStrings.xml",
            "archive.members[8].path": "xl/drawings/drawing1.xml",
            "archive.members[9].path": "xl/media/image1.png",
            "archive.members[0].crc32": 1374202901,
            "archive.members[10].path": "xl/vbaProject.bin",
            "archive.members[11].path": "xl/worksheets/_rels/sheet1.xml.rels",
            "archive.members[12].path": "xl/drawings/_rels/drawing1.xml.rels",
            "archive.members[13].path": "xl/printerSettings/printerSettings1.bin",
            "archive.members[14].path": "docProps/core.xml",
            "archive.members[15].path": "docProps/app.xml",
            "archive.members[1].crc32": 590370229,
            "archive.members[2].crc32": 2034716865,
            "archive.members[3].crc32": 3492801622,
            "archive.members[4].crc32": 2446450609,
            "archive.members[5].crc32": 2802389262,
            "archive.members[6].crc32": 1008796352,
            "archive.members[7].crc32": 3495572776,
            "archive.members[8].crc32": 343915738,
            "archive.members[9].crc32": 1533236684,
            "archive.timing.mtime_max": 315532800,
            "archive.timing.mtime_min": 315532800,
            "archive.members[10].crc32": 4199572582,
            "archive.members[11].crc32": 2444570937,
            "archive.members[12].crc32": 3371379759,
            "archive.members[13].crc32": 224146154,
            "archive.members[14].crc32": 1390114478,
            "archive.members[15].crc32": 2623473321,
            "archive.format.entry_types[0]": "regular",
            "archive.members[0].entry_type": "regular",
            "archive.members[0].mtime_unix": 315532800,
            "archive.members[0].size_bytes": 1524,
            "archive.members[1].entry_type": "regular",
            "archive.members[1].mtime_unix": 315532800,
            "archive.members[1].size_bytes": 588,
            "archive.members[2].entry_type": "regular",
            "archive.members[2].mtime_unix": 315532800,
            "archive.members[2].size_bytes": 1806,
            "archive.members[3].entry_type": "regular",
            "archive.members[3].mtime_unix": 315532800,
            "archive.members[3].size_bytes": 820,
            "archive.members[4].entry_type": "regular",
            "archive.members[4].mtime_unix": 315532800,
            "archive.members[4].size_bytes": 5409,
            "archive.members[5].entry_type": "regular",
            "archive.members[5].mtime_unix": 315532800,
            "archive.members[5].size_bytes": 8392,
            "archive.members[6].entry_type": "regular",
            "archive.members[6].mtime_unix": 315532800,
            "archive.members[6].size_bytes": 1799,
            "archive.members[7].entry_type": "regular",
            "archive.members[7].mtime_unix": 315532800,
            "archive.members[7].size_bytes": 591,
            "archive.members[8].entry_type": "regular",
            "archive.members[8].mtime_unix": 315532800,
            "archive.members[8].size_bytes": 3345,
            "archive.members[9].entry_type": "regular",
            "archive.members[9].mtime_unix": 315532800,
            "archive.members[9].size_bytes": 9796,
            "archive.compression.methods[0]": "deflate",
            "archive.compression.methods[1]": "stored",
            "archive.members[0].data_offset": 569,
            "archive.members[10].entry_type": "regular",
            "archive.members[10].mtime_unix": 315532800,
            "archive.members[10].size_bytes": 21504,
            "archive.members[11].entry_type": "regular",
            "archive.members[11].mtime_unix": 315532800,
            "archive.members[11].size_bytes": 464,
            "archive.members[12].entry_type": "regular",
            "archive.members[12].mtime_unix": 315532800,
            "archive.members[12].size_bytes": 292,
            "archive.members[13].entry_type": "regular",
            "archive.members[13].mtime_unix": 315532800,
            "archive.members[13].size_bytes": 220,
            "archive.members[14].entry_type": "regular",
            "archive.members[14].mtime_unix": 315532800,
            "archive.members[14].size_bytes": 665,
            "archive.members[15].entry_type": "regular",
            "archive.members[15].mtime_unix": 315532800,
            "archive.members[15].size_bytes": 795,
            "archive.members[1].data_offset": 1563,
            "archive.members[2].data_offset": 1852,
            "archive.members[3].data_offset": 2964,
            "archive.members[4].data_offset": 3296,
            "archive.members[5].data_offset": 4557,
            "archive.members[6].data_offset": 6478,
            "archive.members[7].data_offset": 7243,
            "archive.members[8].data_offset": 7526,
            "archive.members[9].data_offset": 8792,
            "archive.members[10].data_offset": 18635,
            "archive.members[11].data_offset": 27001,
            "archive.members[12].data_offset": 27285,
            "archive.members[13].data_offset": 27544,
            "archive.members[14].data_offset": 27889,
            "archive.members[15].data_offset": 28552,
            "archive.members[1].header_offset": 1002,
            "archive.members[2].header_offset": 1807,
            "archive.members[3].header_offset": 2644,
            "archive.members[4].header_offset": 3242,
            "archive.members[5].header_offset": 4508,
            "archive.members[6].header_offset": 6435,
            "archive.members[7].header_offset": 7193,
            "archive.members[8].header_offset": 7472,
            "archive.members[9].header_offset": 8743,
            "archive.members[10].header_offset": 18588,
            "archive.members[11].header_offset": 26936,
            "archive.members[12].header_offset": 27220,
            "archive.members[13].header_offset": 27475,
            "archive.members[14].header_offset": 27620,
            "archive.members[15].header_offset": 28242,
            "archive.members[0].compressed_size": 433,
            "archive.members[1].compressed_size": 244,
            "archive.members[2].compressed_size": 792,
            "archive.members[3].compressed_size": 278,
            "archive.members[4].compressed_size": 1212,
            "archive.members[5].compressed_size": 1878,
            "archive.members[6].compressed_size": 715,
            "archive.members[7].compressed_size": 229,
            "archive.members[8].compressed_size": 1217,
            "archive.members[9].compressed_size": 9796,
            "archive.members[10].compressed_size": 8301,
            "archive.members[11].compressed_size": 219,
            "archive.members[12].compressed_size": 190,
            "archive.members[13].compressed_size": 76,
            "archive.members[14].compressed_size": 353,
            "archive.members[15].compressed_size": 401,
            "archive.members[0].compression_method": "deflate",
            "archive.members[1].compression_method": "deflate",
            "archive.members[2].compression_method": "deflate",
            "archive.members[3].compression_method": "deflate",
            "archive.members[4].compression_method": "deflate",
            "archive.members[5].compression_method": "deflate",
            "archive.members[6].compression_method": "deflate",
            "archive.members[7].compression_method": "deflate",
            "archive.members[8].compression_method": "deflate",
            "archive.members[9].compression_method": "stored",
            "archive.members[10].compression_method": "deflate",
            "archive.members[11].compression_method": "deflate",
            "archive.members[12].compression_method": "deflate",
            "archive.members[13].compression_method": "deflate",
            "archive.members[14].compression_method": "deflate",
            "archive.members[15].compression_method": "deflate",
            "archive.members[0].central_header_offset": 28953,
            "archive.members[1].central_header_offset": 29018,
            "archive.members[2].central_header_offset": 29075,
            "archive.members[3].central_header_offset": 29136,
            "archive.members[4].central_header_offset": 29208,
            "archive.members[5].central_header_offset": 29278,
            "archive.members[6].central_header_offset": 29343,
            "archive.members[7].central_header_offset": 29402,
            "archive.members[8].central_header_offset": 29468,
            "archive.members[9].central_header_offset": 29538,
            "archive.members[10].central_header_offset": 29603,
            "archive.members[11].central_header_offset": 29666,
            "archive.members[12].central_header_offset": 29747,
            "archive.members[13].central_header_offset": 29828,
            "archive.members[14].central_header_offset": 29913,
            "archive.members[15].central_header_offset": 29976
          },
          "id": "xlsx"
        },
        "id": 0,
        "sz": 30060,
        "ts": [
          {
            "a": "T1059.005",
            "c": 1.0,
            "d": "OOXML document contains VBA macros (0 modules: )",
            "i": "metadata/format/macro::ooxml-has-vba",
            "l": 3
          }
        ],
        "sha": "bbe3b9175095f0942fbcc4d2ebfef68b972ccf9f22cf52012a3e31eb498b4091",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-08/bbe3b9175095f0942fbcc4d2ebfef68b972ccf9f22cf52012a3e31eb498b4091.xlsm",
        "type": "xlsx"
      }
    ],
    "tv": "52045"
  }
}