{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000016142925,
        "rte": "az",
        "prob": 0.000016142925
      },
      {
        "cls": 0,
        "raw": 0.41161442,
        "rte": "az/documents",
        "prob": 0.41161442
      },
      {
        "cls": 0,
        "raw": 0.019719422,
        "rte": "az/docx",
        "prob": 0.019719422
      }
    ],
    "prob": 0.000016142925,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000016142925232998095,
        "type": "docx"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T09:52:54Z"
  },
  "path": "de9551cb55ec7515ea71b124dfea3ca609fe0442265d247fb3d744546770ed96.doc",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "p!H([6Awsq2MK\u00268aPM[NZi\u003e\u003eu006zg000Vj2M!i$zV",
            "l": 0,
            "n": [
              {
                "c": 3,
                "d": "OOXML document contains VBA macros (0 modules: )",
                "i": "metadata/format/macro::ooxml-has-vba",
                "o": 0,
                "z": 1
              }
            ],
            "x": true
          }
        ],
        "idn": {
          "trust": "unsigned",
          "authors": [
            {
              "name": "Admin",
              "role": "author",
              "source": "office.creator"
            }
          ],
          "producer": {
            "value": "Microsoft Office Word",
            "source": "office.application",
            "verified": false
          }
        },
        "mol": "Md(Ag)",
        "sha": "de9551cb55ec7515ea71b124dfea3ca609fe0442265d247fb3d744546770ed96",
        "fact": {
          "id": "docx",
          "met": {
            "file": {
              "size": 17933.0,
              "entropy": 7.45,
              "size_bytes": 17933.0
            },
            "binary": {
              "overall_entropy": 7.45
            },
            "office": {
              "macro_count": 1.0,
              "ooxml.entry_count": 14.0,
              "ooxml.max_entry_size": 28755.0,
              "is_macro_enabled_extension": 0.0,
              "ooxml.declares_vba_project": 1.0,
              "ooxml.is_word_vba_document": 1.0
            },
            "archive": {
              "file_count": 14.0,
              "member_count": 14.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 10.06,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 14487.0,
              "compression.ratio": 0.23,
              "hidden_file_count": 1.0,
              "total_uncompressed": 62103.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 30.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 14.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 1.0,
              "timing.mtime_unique_ratio": 0.07,
              "misplaced_executable_count": 1.0,
              "timing.mtime_dominant_count": 14.0,
              "timing.mtime_spread_seconds": 0.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 1.0,
              "compression.method_counts.deflate": 14.0
            },
            "consistency": {
              "extension_content_mismatch": 1.0,
              "extension_content_mismatch.document_as_document": 1.0
            }
          },
          "val": {
            "file.stem": "de9551cb55ec7515ea71b124dfea3ca609fe0442265d247fb3d744546770ed96",
            "office.kind": "docx",
            "file.basename": "de9551cb55ec7515ea71b124dfea3ca609fe0442265d247fb3d744546770ed96.doc",
            "office.created": "2023-06-30T10:25:00Z",
            "office.creator": "Admin",
            "office.modified": "2023-06-30T12:27:00Z",
            "office.revision": "8",
            "office.macros[0]": "word/vbaProject.bin",
            "office.application": "Microsoft Office Word",
            "office.features[0]": "macros",
            "archive.format.kind": "zip",
            "archive.members[0].path": "[Content_Types].xml",
            "archive.members[1].path": "_rels/.rels",
            "archive.members[2].path": "word/_rels/document.xml.rels",
            "archive.members[3].path": "word/document.xml",
            "archive.members[4].path": "word/vbaProject.bin",
            "archive.members[5].path": "word/_rels/vbaProject.bin.rels",
            "archive.members[6].path": "word/theme/theme1.xml",
            "archive.members[7].path": "word/vbaData.xml",
            "archive.members[8].path": "word/settings.xml",
            "archive.members[9].path": "docProps/app.xml",
            "office.last_modified_by": "Admin",
            "archive.members[0].crc32": 2092864380,
            "archive.members[10].path": "word/styles.xml",
            "archive.members[11].path": "docProps/core.xml",
            "archive.members[12].path": "word/fontTable.xml",
            "archive.members[13].path": "word/webSettings.xml",
            "archive.members[1].crc32": 3071971614,
            "archive.members[2].crc32": 2347834765,
            "archive.members[3].crc32": 1246838794,
            "archive.members[4].crc32": 1685732271,
            "archive.members[5].crc32": 4016051208,
            "archive.members[6].crc32": 2856367879,
            "archive.members[7].crc32": 1209614916,
            "archive.members[8].crc32": 637673859,
            "archive.members[9].crc32": 297020020,
            "archive.timing.mtime_max": 315532800,
            "archive.timing.mtime_min": 315532800,
            "archive.members[10].crc32": 311748255,
            "archive.members[11].crc32": 93221185,
            "archive.members[12].crc32": 834706943,
            "archive.members[13].crc32": 1238791827,
            "archive.format.entry_types[0]": "regular",
            "archive.members[0].entry_type": "regular",
            "archive.members[0].mtime_unix": 315532800,
            "archive.members[0].size_bytes": 1461,
            "archive.members[1].entry_type": "regular",
            "archive.members[1].mtime_unix": 315532800,
            "archive.members[1].size_bytes": 590,
            "archive.members[2].entry_type": "regular",
            "archive.members[2].mtime_unix": 315532800,
            "archive.members[2].size_bytes": 939,
            "archive.members[3].entry_type": "regular",
            "archive.members[3].mtime_unix": 315532800,
            "archive.members[3].size_bytes": 1734,
            "archive.members[4].entry_type": "regular",
            "archive.members[4].mtime_unix": 315532800,
            "archive.members[4].size_bytes": 13824,
            "archive.members[5].entry_type": "regular",
            "archive.members[5].mtime_unix": 315532800,
            "archive.members[5].size_bytes": 277,
            "archive.members[6].entry_type": "regular",
            "archive.members[6].mtime_unix": 315532800,
            "archive.members[6].size_bytes": 6799,
            "archive.members[7].entry_type": "regular",
            "archive.members[7].mtime_unix": 315532800,
            "archive.members[7].size_bytes": 1694,
            "archive.members[8].entry_type": "regular",
            "archive.members[8].mtime_unix": 315532800,
            "archive.members[8].size_bytes": 2665,
            "archive.members[9].entry_type": "regular",
            "archive.members[9].mtime_unix": 315532800,
            "archive.members[9].size_bytes": 712,
            "archive.compression.methods[0]": "deflate",
            "archive.members[0].data_offset": 569,
            "archive.members[10].entry_type": "regular",
            "archive.members[10].mtime_unix": 315532800,
            "archive.members[10].size_bytes": 28755,
            "archive.members[11].entry_type": "regular",
            "archive.members[11].mtime_unix": 315532800,
            "archive.members[11].size_bytes": 737,
            "archive.members[12].entry_type": "regular",
            "archive.members[12].mtime_unix": 315532800,
            "archive.members[12].size_bytes": 1340,
            "archive.members[13].entry_type": "regular",
            "archive.members[13].mtime_unix": 315532800,
            "archive.members[13].size_bytes": 576,
            "archive.members[1].data_offset": 1526,
            "archive.members[2].data_offset": 2087,
            "archive.members[3].data_offset": 2412,
            "archive.members[4].data_offset": 3026,
            "archive.members[5].data_offset": 8532,
            "archive.members[6].data_offset": 8774,
            "archive.members[7].data_offset": 10392,
            "archive.members[8].data_offset": 10976,
            "archive.members[9].data_offset": 12238,
            "archive.members[10].data_offset": 12649,
            "archive.members[11].data_offset": 15818,
            "archive.members[12].data_offset": 16232,
            "archive.members[13].data_offset": 16723,
            "archive.members[1].header_offset": 965,
            "archive.members[2].header_offset": 1765,
            "archive.members[3].header_offset": 2365,
            "archive.members[4].header_offset": 2977,
            "archive.members[5].header_offset": 8472,
            "archive.members[6].header_offset": 8723,
            "archive.members[7].header_offset": 10346,
            "archive.members[8].header_offset": 10929,
            "archive.members[9].header_offset": 11928,
            "archive.members[10].header_offset": 12604,
            "archive.members[11].header_offset": 15507,
            "archive.members[12].header_offset": 16184,
            "archive.members[13].header_offset": 16673,
            "archive.members[0].compressed_size": 396,
            "archive.members[1].compressed_size": 239,
            "archive.members[2].compressed_size": 278,
            "archive.members[3].compressed_size": 565,
            "archive.members[4].compressed_size": 5446,
            "archive.members[5].compressed_size": 191,
            "archive.members[6].compressed_size": 1572,
            "archive.members[7].compressed_size": 537,
            "archive.members[8].compressed_size": 952,
            "archive.members[9].compressed_size": 366,
            "archive.members[10].compressed_size": 2858,
            "archive.members[11].compressed_size": 366,
            "archive.members[12].compressed_size": 441,
            "archive.members[13].compressed_size": 280,
            "archive.members[0].compression_method": "deflate",
            "archive.members[1].compression_method": "deflate",
            "archive.members[2].compression_method": "deflate",
            "archive.members[3].compression_method": "deflate",
            "archive.members[4].compression_method": "deflate",
            "archive.members[5].compression_method": "deflate",
            "archive.members[6].compression_method": "deflate",
            "archive.members[7].compression_method": "deflate",
            "archive.members[8].compression_method": "deflate",
            "archive.members[9].compression_method": "deflate",
            "archive.members[10].compression_method": "deflate",
            "archive.members[11].compression_method": "deflate",
            "archive.members[12].compression_method": "deflate",
            "archive.members[13].compression_method": "deflate",
            "archive.members[0].central_header_offset": 17003,
            "archive.members[1].central_header_offset": 17068,
            "archive.members[2].central_header_offset": 17125,
            "archive.members[3].central_header_offset": 17199,
            "archive.members[4].central_header_offset": 17262,
            "archive.members[5].central_header_offset": 17327,
            "archive.members[6].central_header_offset": 17403,
            "archive.members[7].central_header_offset": 17470,
            "archive.members[8].central_header_offset": 17532,
            "archive.members[9].central_header_offset": 17595,
            "archive.members[10].central_header_offset": 17657,
            "archive.members[11].central_header_offset": 17718,
            "archive.members[12].central_header_offset": 17781,
            "archive.members[13].central_header_offset": 17845
          }
        },
        "find": [
          {
            "id": "metadata/format/macro::ooxml-has-vba",
            "atk": "T1059.005",
            "conf": 1.0,
            "crit": 3,
            "desc": "OOXML document contains VBA macros (0 modules: )"
          }
        ],
        "path": "de9551cb55ec7515ea71b124dfea3ca609fe0442265d247fb3d744546770ed96.doc",
        "risk": 1,
        "size": 17933,
        "type": "docx"
      }
    ]
  }
}