{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9862487316131592,
        "class": 0
      }
    ],
    "prob": 0.98624873,
    "skip": [
      {
        "m": "az/xls",
        "why": "uncalibrated"
      }
    ],
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.037966326,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 0.98624873,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T03:47:31Z"
  },
  "path": "native_001%2F3.62867.NLRX4L4OLBU45HSIDMCD0VYCAQ1QLBQPA.1.xls",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)H(Po)",
        "x": 3,
        "ff": {
          "m": {
            "file": {
              "size": 73216.0,
              "entropy": 4.5,
              "size_bytes": 73216.0
            },
            "office": {
              "stream_count": 4.0,
              "ole.stream_count": 3.0,
              "ole.storage_count": 1.0,
              "is_macro_enabled_extension": 0.0
            }
          },
          "v": {
            "office.kind": "xls",
            "office.created": "2000-10-12T13:08:24Z",
            "office.creator": "tbelden",
            "office.modified": "2000-11-08T22:27:28Z",
            "office.streams[0]": "/",
            "office.streams[1]": "/Workbook",
            "office.streams[2]": "/\u0005SummaryInformation",
            "office.streams[3]": "/\u0005DocumentSummaryInformation",
            "office.application": "Microsoft Excel",
            "office.last_printed": "2000-11-07T22:23:13Z",
            "office.last_modified_by": "mmilner"
          },
          "id": "xls"
        },
        "id": 0,
        "sz": 73216,
        "ts": [
          {
            "c": 1.0,
            "d": "Document metadata: author: tbelden, last_author: mmilner",
            "i": "metadata/format/properties::doc-properties",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has .xls extension",
            "e": [
              "native_001%2F3.62867.NLRX4L4OLBU45HSIDMCD0VYCAQ1QLBQPA.1.xls"
            ],
            "i": "objectives/evasion/masquerade/document::basename-xls-extension",
            "l": 3
          },
          {
            "c": 0.9399999976158142,
            "d": "Multiple hardcoded payload URLs",
            "e": [
              "http://www.cc.state.az.us/sitemap"
            ],
            "i": "micro-behaviors/process/create/shell/lang::multi-url-download-list",
            "l": 3
          }
        ],
        "sha": "c2d76bb9049af03820efacdfea3e98f2d79c4a7e4e962c0e1134099ea5c58e02",
        "path": "/data/samples/good/datasets/xls/enron_xls/edrm/native_001%2F3.62867.NLRX4L4OLBU45HSIDMCD0VYCAQ1QLBQPA.1.xls",
        "type": "xls"
      }
    ],
    "tv": "9ea7c"
  }
}