{
  "llm": {
    "conf": 0.9933,
    "grade": "hostile",
    "model": "Qwen/Qwen3.8-27B",
    "outcome": "hostile",
    "interpretation": "UDF LNK DLL ordinal loader"
  },
  "ml": {
    "v": "7",
    "eng": "2.7.2",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.98456526,
        "rte": "az",
        "prob": 0.98456526
      }
    ],
    "prob": 0.99,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9900000095367432,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-16T21:54:29Z"
  },
  "path": "ca51683ba95948fea25f05549ead2ca86539aeed69e09fd6cf70a0d03d2808a0.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000pe+4AgxvEQ0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 5,
                "d": "UDF image bundles LNK DLL ordinal loader",
                "i": "objectives/command-and-control/dropper/staging/embedded::udf-lnk-bundled-dll-ordinal-loader",
                "o": 34817,
                "z": 14,
                "cf": 0.99
              }
            ],
            "ln": 34689
          },
          {
            "b": "0cwiL0bRY(05sJO02LYp05sJOyY\u003c.Eq\u0026uFP0aP\u003eRe[Gos06*I\u003c00Aq\u003cZ7120Is1o!v\u003eE-Y08-:@000010000000000000000002?{RcYr0bRZD04[m.0c!GP0000m",
            "n": [
              {
                "c": 1,
                "d": "UDF ISO executable member name marker",
                "i": "metadata/file/format/iso::iso-udf-exe-name-marker",
                "o": 721212,
                "z": 4,
                "cf": 0.99
              }
            ],
            "ln": 721180
          },
          {
            "b": "002N\u003c000Ph000930017UM\u003ef/e0000^i:t:2zE^WfB6IT?B97#ggCSiBzdCngCX3\u003cPbMGB%e=YbRe=WH7tMuwRe=YbRe=WH7tMv?9x-J2Jwb{JFCk#W:tMvX5C(R)=Bo2\u003eLz2=u(g5$LVv/QuCwb[jZwDl@PwDi[Of92FZaolD.Bo2.HASygYaolAZBPupVwb{ACyYDl\u003eg5@{bwDl@PwDi?Mve$6ygxqv]zu8o?wb{ACyYD0^blfB#aPJ!*qVI7yA@ZpZwDlMEqugRnzVB\u003eVb(?fIqVI7yA@ZpZwDlMEgxofgtMvX5nb#6UoAm-^gxofge=YzZyYFnK5c8Xg1POK}b(^]B?2EAP8#]%s3JHg1Ctt%)\u003ek[{:W)R\u003cNU2gN}?2EAPu\u0026Qfb0@@s]so5s300000B-RbmePth10000000000lCbqGwbL4CKnM\u0026QWEo[U}BO!:p37ZNI\u003c]zlrcUhblCbqGwbL4CKnM\u0026QWEo[U}BO!:p37ZNI\u003c]zlrcUhb\u003eM7U-2(\u003c%#BPqywf\u0026H[E)j=lclJz%kR$!QLQ\u0026Qb(sPwB4wb(Pf03qgv03.Ez0cwiL0cncZ03znT0bhBJ0bzMS04m?m06g9+0962u0a=dJ0cncB0bITz0bRZA0ce6A07l/#0cncQ0cwiV0b}]!00000000000i(I705mzGq.W./X9(*95t!)#v2QYyTq}ov015Ya0018v000i6001.Ne=YtXve$xH000-l000Jf0000:00000\u003e/H=t*$8Mw0000c000006-Xjl6Awak00000irf3V1onA403qgv022tj09oem0b.^E0b?\u0026",
            "n": [
              {
                "c": 5,
                "d": "UDF LNK SHELL32 icon covers rundll32 ordinal launch",
                "i": "objectives/command-and-control/dropper/staging/embedded::udf-lnk-shell32-icon-ordinal-loader",
                "o": 721433,
                "z": 16,
                "cf": 0.99
              },
              {
                "c": 4,
                "d": "UTF-16 ISO LNK DLL ordinal argument",
                "i": "metadata/file/format/iso::iso-lnk-dll-ordinal-utf16",
                "o": 721487,
                "z": 12,
                "cf": 0.99
              },
              {
                "c": 4,
                "d": "UTF-16 ISO LNK SHELL32.dll icon path",
                "i": "metadata/file/format/iso::iso-lnk-shell32-icon-utf16",
                "o": 721503,
                "z": 197,
                "cf": 0.94
              },
              {
                "c": 4,
                "d": "UDF LNK rundll32 command",
                "i": "metadata/file/format/iso::udf-lnk-rundll32-utf16",
                "o": 721451,
                "z": 24,
                "cf": 0.99
              }
            ],
            "ln": 721305
          }
        ],
        "mol": "O(C)Md",
        "sha": "ca51683ba95948fea25f05549ead2ca86539aeed69e09fd6cf70a0d03d2808a0",
        "path": "ca51683ba95948fea25f05549ead2ca86539aeed69e09fd6cf70a0d03d2808a0.iso",
        "risk": 159,
        "size": 1638400,
        "type": "iso",
        "facts": {
          "metrics": {
            "iso": {
              "anomaly_count": 1.0,
              "udf.partition_sectors": 224.0,
              "udf.logical_block_size": 2048.0,
              "udf.partition_start_lba": 288.0,
              "volume_descriptor_count": 3.0,
              "system_area.nonzero_bytes": 0.0
            },
            "file": {
              "size": 1638400.0,
              "entropy": 1.19,
              "size_bytes": 1638400.0
            },
            "binary": {
              "overall_entropy": 1.19,
              "peak_region_bytes": 20480.0,
              "peak_region_entropy": 6.09
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/iso::iso-lnk-dll-ordinal-utf16",
            "atk": "T1218.011",
            "conf": 0.99,
            "crit": 4,
            "desc": "UTF-16 ISO LNK DLL ordinal argument",
            "spans": [
              [
                721487,
                12
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-lnk-shell32-icon-utf16",
            "atk": "T1036.007",
            "conf": 0.94,
            "crit": 4,
            "desc": "UTF-16 ISO LNK SHELL32.dll icon path",
            "spans": [
              [
                721503,
                197
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::udf-nsr03-text-marker",
            "conf": 1.0,
            "crit": 2,
            "desc": "UDF NSR03 descriptor text marker",
            "spans": [
              [
                34817,
                0
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-rundll32-utf16-marker",
            "conf": 0.99,
            "crit": 1,
            "desc": "UTF-16 ISO rundll32 command token",
            "spans": [
              [
                721451,
                0
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-lnk-cmd-prefix-utf16",
            "atk": "T1059.003",
            "conf": 0.99,
            "crit": 4,
            "desc": "UTF-16 ISO LNK cmd start prefix",
            "spans": [
              [
                721433,
                16
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::udf-lnk-rundll32-utf16",
            "atk": "T1218.011",
            "conf": 0.99,
            "crit": 4,
            "desc": "UDF LNK rundll32 command",
            "spans": [
              [
                34817,
                14
              ],
              [
                721451,
                24
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/staging/embedded::udf-lnk-bundled-dll-ordinal-loader",
            "atk": "T1059.003,T1218.011,T1204.002",
            "conf": 0.99,
            "crit": 5,
            "desc": "UDF image bundles LNK DLL ordinal loader",
            "spans": [
              [
                34817,
                14
              ],
              [
                721433,
                16
              ],
              [
                721451,
                24
              ],
              [
                721487,
                12
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/staging/embedded::udf-lnk-shell32-icon-ordinal-loader",
            "atk": "T1059.003,T1218.011,T1036.007,T1204.002",
            "conf": 0.99,
            "crit": 5,
            "desc": "UDF LNK SHELL32 icon covers rundll32 ordinal launch",
            "spans": [
              [
                34817,
                14
              ],
              [
                721433,
                16
              ],
              [
                721451,
                24
              ],
              [
                721487,
                12
              ],
              [
                721503,
                197
              ]
            ]
          }
        ]
      }
    ]
  }
}