{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 0.9988067746162415
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9917355,
        "class": 0
      },
      {
        "m": "az/documents",
        "prob": 1.0,
        "class": 2
      },
      {
        "m": "az/ole",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.9988068,
    "analyzed_at": "2026-05-31T17:20:29Z"
  },
  "path": "cb4563205cf3acd8ad7f8fcc0f0400b77e8c32583b854f7c8019faada4b20942.unknown",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(Ag₂)",
        "x": 42,
        "ff": {
          "m": {
            "file": {
              "size": 1004544.0,
              "entropy": 6.04,
              "size_bytes": 1004544.0
            },
            "office": {
              "stream_count": 3.0,
              "ole.stream_count": 2.0,
              "ole.storage_count": 1.0,
              "dangerous_clsid_count": 1.0,
              "ole.dangerous_clsid_count": 1.0,
              "is_macro_enabled_extension": 0.0
            }
          },
          "v": {
            "file.stem": "cb4563205cf3acd8ad7f8fcc0f0400b77e8c32583b854f7c8019faada4b20942",
            "office.kind": "ole2",
            "file.basename": "cb4563205cf3acd8ad7f8fcc0f0400b77e8c32583b854f7c8019faada4b20942.unknown",
            "office.streams[0]": "/",
            "office.streams[1]": "/\u0001oLE10natIvE",
            "office.streams[2]": "/VdNwIljuZnM2JG0CslCpef7",
            "office.features[0]": "dangerous_clsid",
            "office.dangerous_clsids[0].name": "Equation Editor",
            "office.dangerous_clsids[0].clsid": "0002ce02-0000-0000-c000-000000000046",
            "office.dangerous_clsids[0].storage": "/"
          },
          "id": "ole"
        },
        "id": 0,
        "sz": 1004544,
        "ts": [
          {
            "c": 1.0,
            "d": "OLE10Native embedded object: 107746774 bytes in /\u0001oLE10natIvE",
            "i": "metadata/format/embedded::ole10-native-object",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Equation Editor 3.0 (CVE-2017-11882) (CLSID: 0002ce02-0000-0000-c000-000000000046) on /",
            "i": "metadata/format/clsid::dangerous-clsid",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor",
            "e": [
              "a\u003e?Hda\u003e~O@mxQl\u003e~dXZJ\\Ml\u003eD|}d^Lc9xm`dj@:8 \u003cxor\u003e",
              "hxlMh\\?8qK}GpKspx~qmG;e8zlgm@8=zSDfoB{J= \u003cxor\u003e",
              "=xj}\\x:lD1d}jmmX|@DE=ExB:f_Y}C=c0=ZfY1:x \u003cxor\u003e",
              ";\u003ez;|HpE^9l|Nf\\xC@[\u003eYPK\\bBn{OL;b}QS=Ss\u003c? \u003cxor\u003e",
              "MxoP\\xYNe:sJJAsYJmKF{?kfa_|hPk}\u003exZGbp0Ll \u003cxor\u003e",
              "An_S`SkDDa1KpqGcnqK=oAaA9nZGzbQm}lKzgA^B \u003cxor\u003e",
              "AlxLEnDK@oJQ~~~{QjffAx|GLEok@0^]jm|80gXb \u003cxor\u003e",
              "fGsGsSXH__GE?S~nAdD\\xLoecfSX}?hpajZNE@ej \u003cxor\u003e",
              "d\u003egZG=:h_Zyj\\Gn[\u003cm;Gm@FYGj|`L8\u003cNPZzyB9zH \u003cxor\u003e",
              "~D[88K|\u003cc`l\u003e:c}g;qsG8\u003eFeC1}qpnsa{~nBslFq \u003cxor\u003e",
              "k`1\u003cC@jL[S8ml~0nGGLSjOHBg_J?\u003c;oocG1Hx\\n0 \u003cxor\u003e",
              "PoCmNKqKB\u003e;h_bpSGydKoy[haC\\1K`scOLlFl\u003c0= \u003cxor\u003e",
              "SE:KmcB@ygDo[8fNJ\\[^O=e`F`{X[O]@8?N=_S\\x \u003cxor\u003e",
              "YG||A^[mG`ogk8~lBJPhXZZ=hZO`phOeq_\u003clNzEq \u003cxor\u003e",
              "@D@;CF?=\u003c`ZAzDfk~@g_|\\?KE\u003eez^?PSSzaxe[z= \u003cxor\u003e",
              "\u003eZ1mFSJ^gY`;NNoz9\\x08O[{SbdjJYDQxQ;\\K1oS \u003cxor\u003e"
            ],
            "i": "metadata/encoded-payload/xor",
            "l": 3,
            "el": [
              "offset:303665",
              "offset:570481",
              "offset:489242",
              "offset:649060",
              "offset:732096",
              "offset:228577",
              "offset:774874",
              "offset:788895",
              "offset:715113",
              "offset:878982",
              "offset:977764",
              "offset:643179",
              "offset:681368",
              "offset:275202",
              "offset:785798",
              "offset:287533"
            ]
          }
        ],
        "sha": "cb4563205cf3acd8ad7f8fcc0f0400b77e8c32583b854f7c8019faada4b20942",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-06/cb4563205cf3acd8ad7f8fcc0f0400b77e8c32583b854f7c8019faada4b20942.unknown",
        "type": "ole"
      }
    ],
    "tv": "176d6"
  }
}