{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.6687533,
        "class": 1
      },
      {
        "m": "az/documents",
        "prob": 0.93333334,
        "class": 0
      },
      {
        "m": "az/ole",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-13T09:37:38Z"
  },
  "path": "c9d97e3949bcdd497e357d04e360bf96af079f54a6dd3a0aeeec734c1d1977e1.unknown",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Md",
        "x": 37,
        "id": 0,
        "ms": {
          "file": {
            "size": 97746.0
          },
          "office": {
            "ole": {},
            "doc_type": "unknown"
          }
        },
        "sz": 97746,
        "ts": [
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "MSI embeds encoded command flag",
            "e": [
              "-e"
            ],
            "i": "objectives/command-and-control/dropper/execution/installer::msi-encoded-command-raw",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.8999999761581421,
            "d": "MSI references VBS stage",
            "e": [
              ".vbs"
            ],
            "i": "objectives/command-and-control/dropper/execution/installer::embedded-vbs-stage",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "\u003cbinary data\u003e \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          }
        ],
        "sha": "c9d97e3949bcdd497e357d04e360bf96af079f54a6dd3a0aeeec734c1d1977e1",
        "path": "c9d97e3949bcdd497e357d04e360bf96af079f54a6dd3a0aeeec734c1d1977e1.unknown",
        "type": "ole"
      }
    ],
    "tv": "92e78"
  }
}