{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.8383554, "class": 0 }, { "m": "az/media", "prob": 0.4347826, "class": 1 }, { "m": "az/jpeg", "prob": 1.0, "class": 2 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T03:37:19Z" }, "path": "d90708837155475d984044a598ff2aa9064b13542de8568d7838737a04f4aa45.unknown", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 40, "ff": { "m": { "file": { "size": 1112051.0, "entropy": 6.52, "size_bytes": 1112051.0 }, "jpeg": { "com_count": 0.0, "dht_count": 4.0, "dqt_count": 2.0, "exif_size": 0.0, "soi_count": 1.0, "comment_bytes": 0.0, "segment_count": 10.0, "appended_bytes": 1111040.0, "maker_note_bytes": 0.0, "app_segment_count": 1.0 }, "image": { "width": 158.0, "height": 101.0, "channels": 3.0, "b_entropy": 1.11, "g_entropy": 1.11, "r_entropy": 1.11, "edge_density": 0.0, "pixel_entropy": 1.11, "histogram_flatness": 0.14 }, "binary": { "overall_entropy": 6.52 } }, "s": [ [ 6, "u8", "JFIF" ], [ 275, "u8", "%\u0026'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz" ], [ 494, "u8", "\u0026'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz" ], [ 758, "u8", "QKIE" ], [ 1088, "u8", "!This program cannot be run in DOS mode." ], [ 1259, "u8", "Rich" ], [ 1555, "u8", ".text" ], [ 1634, "u8", "@.data" ], [ 1675, "u8", ".pdata" ], [ 1714, "u8", "@.rsrc" ], [ 1754, "u8", "@.reloc" ], [ 3199, "u8", "L$ SVWH" ], [ 4452, "u8", "|$ AVAW" ], [ 6440, "u8", "UVWATAUAVAWH" ], [ 10087, "u8", "tPff" ], [ 18234, "u8", "l$ VWAVH" ], [ 21567, "hex", "3333333333" ], [ 27074, "u8", "__ _____!\"#___$_%\u0026_____'_(____)*+____,_-______________.__/01________2____3456__7_________89________:;______\u003c___=\u003e____________?__" ], [ 27380, "u8", "|$ ATAVAWH" ], [ 28366, "u8", "9x0t" ], [ 28728, "u8", "UVWH" ], [ 34326, "u8", "VWAUH" ], [ 34510, "u8", "9p0t" ], [ 37524, "u8", "t$ AWH" ], [ 41667, "u8", "@USVATAUAVAWH" ], [ 43770, "u8", "t$ WAVAWH" ], [ 44351, "u8", "t$ WATAUAVAWH" ], [ 45917, "u8", "VWAVH" ], [ 48950, "u8", "tJ@8.tE" ], [ 54526, "u8", "Gt8Ctu" ], [ 54587, "u8", "H9OX" ], [ 54596, "u8", "H9CX" ], [ 56035, "u8", "VUUUUUUUH" ], [ 62008, "u8", "SUVWAUH" ], [ 62701, "u8", "VWAWH" ], [ 63398, "u8", "F0tFH" ], [ 66984, "u8", "UVAVH" ], [ 68894, "u8", "O0E3" ], [ 72659, "u8", "@USVAUAVAWH" ], [ 73759, "u8", "t$ AVH" ], [ 75301, "u8", "L$ SUVWAUAWH" ], [ 76054, "u8", "A E3" ], [ 76203, "u8", "tQD83tLL" ], [ 81361, "u8", "KHE3" ], [ 81962, "u8", "l$ AVH" ], [ 83973, "u8", "\\$ UVWATAUAVAWH" ], [ 92894, "u8", "L$ VWH" ], [ 97045, "u8", "\\$ UAVAWH" ], [ 97850, "u8", "l$ VWATAVAWH" ], [ 100213, "u8", "\\$ VWAVH" ], [ 101535, "u8", "L$ SWH" ], [ 107177, "u8", "PXE3" ], [ 109594, "u8", "l$ WAVAWH" ], [ 115193, "u8", "D8ceu" ], [ 115630, "u8", "D8cit" ], [ 115698, "u8", "D8cft" ], [ 120067, "u8", "@USVWATAVAWH" ], [ 127828, "u8", "K SWH" ], [ 130963, "u8", "@SUVWATAUAVAWH" ], [ 133466, "u8", "L$ SUVWH" ], [ 134188, "u8", "HcK H" ], [ 134620, "u8", "HcO H" ], [ 135901, "u8", "HcI H" ], [ 136296, "u8", "HcV I" ], [ 136355, "u8", "@SUVWATAVAWH" ], [ 136764, "u8", "HcQ H" ], [ 139811, "u8", "@USVWATAUAVAWH" ], [ 146771, "u8", "@SUWATAUAWH" ], [ 148892, "u8", "USWAUH" ], [ 152275, "u8", "@SUVWAUAVAWH" ], [ 152692, "u8", "{ ATAVAWH" ], [ 153635, "u8", "@UATAUAVAWH" ], [ 154213, "u8", "/t\tE" ], [ 161635, "u8", "@UVWATAUAVAWH" ], [ 163301, "u8", "\\$ UVWH" ], [ 181435, "u8", "gfffH" ], [ 181511, "u8", "gfffD" ], [ 186045, "u8", "SUVWATAUAVAWH" ], [ 189728, "u8", "x AVH" ], [ 190371, "u8", "@USVATAUAVH" ], [ 197514, "u8", "l$ VATAWH" ], [ 203247, "u8", "t$ WATAWH" ], [ 206790, "u8", "E840u" ], [ 206843, "u8", "tKD8w" ], [ 207395, "u8", "@SVWATAUAVH" ], [ 209319, "u8", "tGff" ], [ 211423, "u8", "t$ AUAVAWH" ], [ 212673, "u8", "E0E2" ], [ 213680, "u8", "M0H3" ], [ 227152, "u8", "K VAVH" ], [ 227957, "u8", "A8nTtPI9n0tJA9n8uDA" ], [ 228305, "u8", "9k8t" ], [ 233370, "u8", "t$ UWATAUAWH" ], [ 236723, "u8", "@UVATAUAVAWH" ], [ 244124, "u8", "/uMH" ], [ 246189, "u8", "UWAWH" ], [ 251592, "u8", "UVAWH" ], [ 251877, "u8", "\\$ UVAWH" ], [ 258692, "u8", "|$ ATAUAVAWD" ], [ 259459, "u8", "E3_4" ], [ 259521, "u8", "E3O8A" ], [ 259695, "u8", "A3_D" ], [ 259762, "u8", "E3WHA" ], [ 259813, "u8", "E3GL" ], [ 259932, "u8", "E3_T" ], [ 259994, "u8", "E3OXA" ], [ 262501, "u8", "L$ SVWAUAVH" ], [ 265825, "u8", "S0A3" ], [ 266088, "u8", "SXE3" ], [ 269902, "u8", "LE H3" ], [ 272010, "u8", "l$ VATAUAVAWH" ], [ 278373, "u8", "\\$ UVWAVAWH" ], [ 281354, "u8", "L9Phu" ], [ 281360, "u8", "D9Hpt" ], [ 281619, "u8", "@USVWATAUAWH" ], [ 282475, "u8", "M H3" ], [ 285062, "u8", "USVWAWI" ], [ 287466, "u8", "l$ VWAWH" ], [ 292137, "u8", "Ah9Alu" ], [ 294696, "u8", "Hh9Hlu" ], [ 297526, "u8", "tdvtH9Q" ], [ 300863, "u8", "t$ WATAVH" ], [ 313077, "u8", "tgIc" ], [ 317879, "u8", "sKff" ], [ 320997, "u8", "L4 M" ], [ 325375, "u8", "t$ ATAVAWH" ], [ 326533, "u8", "l$ ATAVAWH" ], [ 327343, "u8", "|$ UATAUAVAWH" ], [ 335220, "u8", "d$ UAVAWH" ], [ 336502, "u8", "UVWAVH" ], [ 341058, "u8", "H9ppt" ], [ 341683, "u8", "@SUATAUAVAWH" ], [ 345199, "u8", "t$ WAUAWH" ], [ 346099, "u8", "f98t" ], [ 346371, "u8", "f99t" ], [ 347242, "u8", "l$ VWATH" ], [ 348742, "u8", "f93tXH" ], [ 348979, "u8", "@SUVWATAUAVH" ], [ 353805, "u8", "tiI9Z" ], [ 358573, "u8", "SUWATAUAVAWH" ], [ 361590, "u8", "H9hpt" ], [ 367571, "u8", "@UVWATAVAWH" ], [ 374711, "u8", "t.Hc" ], [ 396390, "u8", "USWATI" ], [ 400481, "u8", "7wWHc" ], [ 408037, "u8", "\\$ UWATH" ], [ 408781, "u8", "95 q" ], [ 409818, "u8", "l$ VATAVH" ], [ 436053, "u8", "\\$ UVAUAVAWH" ], [ 451797, "u8", "wkHc" ], [ 460440, "u8", "wxHc" ], [ 461420, "u8", "bcdefghijklmnopqrstuvwxyz" ], [ 464019, "u8", "@USWATAUAVAWH" ], [ 464179, "u8", "I4E3" ], [ 466421, "u8", "90uxA" ], [ 468806, "u8", "SVWH" ], [ 469096, "u8", "90uwE" ], [ 469754, "u8", "t$ UWAVH" ], [ 474118, "u8", "90uuA" ], [ 478535, "u8", "D8L1" ], [ 481981, "u8", "UWAVH" ], [ 484794, "u8", "l$ WATAWH" ], [ 487368, "u8", "ucIcW" ], [ 491173, "u8", "\\$ VWATAUAWH" ], [ 495172, "u8", "L$ WATAUAVAWH" ], [ 498435, "u8", "@USWATAVAWH" ], [ 499388, "u8", "p WAVAWH" ], [ 503189, "u8", "9s u" ], [ 503274, "u8", "WAVH" ], [ 504563, "u8", "@UWATAUAVAWH" ], [ 506555, "u8", "QLA3" ], [ 508464, "u8", "ALA3" ], [ 508592, "u8", "AXvT2" ], [ 509009, "u8", "CXvT2" ], [ 509356, "u8", "MGH3" ], [ 510872, "u8", "3D$ A3" ], [ 513870, "u8", "D3T$ A" ], [ 514727, "u8", "FXvT2" ], [ 522839, "u8", "MPH3" ], [ 525509, "u8", "H1D$ L" ], [ 526419, "u8", "H3T$0H3T$8L3L$ L" ], [ 526470, "u8", "L3 L3" ], [ 529188, "u8", "wwHc" ], [ 539569, "u8", "wrrBH" ], [ 541785, "u8", "UUUUH" ], [ 542826, "u8", "t$ WAVD" ], [ 546195, "u8", "@USATAUAVAWH" ], [ 547813, "u8", "u5f9" ], [ 550105, "u8", "xeHc" ], [ 553718, "u8", "xrHc" ], [ 558487, "u8", "xwIc" ], [ 559179, "u8", "LcD$ E" ], [ 559669, "u8", "xgHc" ], [ 560012, "u8", "x.Ic" ], [ 561962, "u8", "fD93t" ], [ 564207, "u8", "wQrGH" ], [ 566712, "u8", "wkriE" ], [ 566782, "u8", "wTrJH" ], [ 566839, "u8", "wxrvE" ], [ 567078, "u8", "wirgE3" ], [ 569914, "u8", "t$ ATAUAVAWA" ], [ 578579, "u8", "w1rXH" ], [ 580760, "u8", "wfHc" ], [ 582168, "u8", "SVWATAUAVAWH" ], [ 582696, "u8", "H SVWATAVAWH" ], [ 584229, "u8", "l$ AVA" ], [ 584294, "u8", "vEfff" ], [ 596689, "u8", "WXE3" ], [ 599430, "u8", "USWI" ], [ 601674, "u8", "SVWAUH" ], [ 604405, "u8", "L$ SUVATAUAVAWH" ], [ 605722, "u8", "SUVAWH" ], [ 608843, "u8", "H98ugL" ], [ 623811, "u8", "@USVWAUAVAWH" ], [ 631875, "u8", "@SUWATAUAVAWH" ], [ 643769, "u8", "D3D$ D" ], [ 644032, "u8", "oJ f" ], [ 645027, "u8", "@SUVWATAUAWH" ], [ 647639, "u8", "UVWATAUAVAWM" ], [ 649336, "u8", "SUVWAWH" ], [ 657732, "u8", "|$ AUAVAWH" ], [ 662527, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 662803, "u8", "@SVWATAUAVAWH" ], [ 662848, "u8", "D8AXH" ], [ 668154, "u8", "uxHc" ], [ 669403, "u8", "ineIA" ], [ 669410, "u8", "ntelD" ], [ 669438, "u8", "Genu" ], [ 675079, "u8", "tRLcY" ], [ 677027, "u8", "HcG H" ], [ 677739, "u8", "t1Lcc" ], [ 681705, "u8", "N0E3" ], [ 682174, "u8", "L$ UVWATAUAVAWH" ], [ 682824, "u8", "p AWH" ], [ 686856, "u8", "x UAVAWH" ], [ 693170, "u8", "HcC H" ], [ 695847, "u8", "E0E3" ], [ 704565, "u8", "L$ fff" ], [ 705868, "u8", "xOHcC" ], [ 707089, "u8", "HcS H" ], [ 716416, "u8", "x ATAVAWH" ], [ 726217, "u8", "sv2E3" ], [ 728528, "u8", "Q0E3" ], [ 730655, "u8", "8jtTA" ], [ 734456, "u8", "s WAVAWH" ], [ 741380, "u8", "x UATAUAVAWH" ], [ 744442, "u8", "L$ VWAVH" ], [ 747000, "u8", "8HtyB" ], [ 747469, "u8", "fA90u" ], [ 748825, "u8", "VWAV" ], [ 769636, "u8", "tnHc" ], [ 776267, "u8", "gfffffffH" ], [ 776620, "u8", "{ AUAVAWH" ], [ 776937, "u8", "80tWD" ], [ 776998, "u8", "gfffA" ], [ 777664, "u8", "s AWH" ] ], "id": "jpeg" }, "id": 0, "sz": 1112051, "ts": [ { "a": "T1027.003", "c": 0.949999988079071, "d": "Data appended after JPEG EOI marker", "e": [ "jpeg.appended_bytes = 1111040.00" ], "i": "objectives/anti-static/obfuscation/steganography/image::jpeg-appended-data", "l": 4, "m": "B0032.001" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "\u003cbinary data\u003e \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "\u003cbinary data\u003e \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 } ], "sha": "d90708837155475d984044a598ff2aa9064b13542de8568d7838737a04f4aa45", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2026-01/d90708837155475d984044a598ff2aa9064b13542de8568d7838737a04f4aa45.unknown", "type": "jpeg" } ], "tv": "9ea7c" } }