{
  "llm": {
    "conf": 0.99300003,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "ISO .NET reflective loader dropper"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.96949834,
        "rte": "az",
        "prob": 0.96949834
      }
    ],
    "prob": 0.99,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9900000095367432,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T12:46:04Z"
  },
  "path": "e032f9a2df3b1da692dfca8d6bc256c29a8294f5d6fd0ace335e595068b5f0c5.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!6pASa$i5--Mg=d9Ih-I{5arR^HarR^HarR^HarR^b000000000e0rr91009Mf000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c!?!4\u003c@m#0SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao",
            "n": [
              {
                "c": 5,
                "d": "ISO .NET hex-reflective stage loader",
                "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-hex-reflective-loader",
                "o": 32769,
                "z": 5,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 32641
          },
          {
            "b": "0b\u003cW$00T[Mui6%h009080rA990S-ia0@%.!000uQe=+\u003eS001zS000uQ9S*W40SSuMn\u0026M?K001FI1ap*:00CpM%nS909S*W50SSuMn\u0026M?K001FI1ap\u003c+00CpM%nS909S^-3000uQcvMWh00B2n0v!6H8H-z500B+Klq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn^1RJ2byPQ)jCJ[pN05Dfbu5Y8x(mN800000!CPvEaJT=!bumUx]U}7n5c8Xgbs+:9l\u0026Wh!1JHYD6BjWsbsli+vGlxd000000SSi3r$$=p2(\u003c@900000000000rr91a]?PyTn\u0026k26-[vni0xoZJr61Vc\u0026:kEU(\u003e4b4GDFe0rr910SSi2008@#0rr91000i65DBG+1]}H2rSAs7t(W[91]@flfAqpSEe\u003e@31]$1\u003cfAqpSWe.(X1{00I\u003cnYw:0%8B51]]2ifAqpSa]%v$1]{Z=\u003cnYw:",
            "n": [
              {
                "c": 5,
                "d": "ISO in-memory managed stage handoff",
                "i": "objectives/command-and-control/dropper/staging/memory::iso-dotnet-in-memory-managed-stage",
                "o": 86908,
                "z": 4,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 86780
          },
          {
            "b": "*6c{G3Kg?WJrQTki%Q\u0026L1B{EL0rr91000000000000031000c40000000000000l7li3#=000c40000000000000l7rSAa10000008d9zwNwe6q=um-pc?=X06$WEwO\u003e))C%=H/w[+[2A::67z/d\u003c.BAh88B-.f{q*ACawO\u003c4$wOb:\u0026v@#B6zuaJ{v@Dy7x\u003c}5{v@#Tf09j2Lwb]LNB97#g08)#Wx(mL-l349Uzdmsbp\u0026ZF+BZ]IVBAzLqvS=^706$WEwO\u003e))C%=H?D2^RixMMKZBAh88B-.f{l349Uzdmsbl$HBHA+PGmx(v(PBAzLqvS=^706$WEwO\u003e))C#O/)wmYQ^A+^%.BAh88B-.f{lVl*xx(^#$y?k[OBAh88B-.f{q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026rz/oD6vqV6hB8$]fvR*r?x([f5l3di?x\u003c#jbwDk2qB7Gh$y\u003cwx^ze-{3C%MK]A+P09By+CxB.LwLBAzLqvS=^706$WEwO\u003e))C$8H:wMAw.B7]Mgl3di?x\u003c#jbwDk8oze:i9vruj4zC\u003e4Zvr=j5x(v)gl3di?x\u003c#jbwDkUOB97#ge(D?fBzkP6e\u003c\u003cL]Aa%c1A-lK\u0026C4\u003eC$A@X^HBtCVLqGV(0x(dAGz/6D4Bzg",
            "n": [
              {
                "c": 3,
                "d": ".NET AssemblyCompanyAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-attr",
                "o": 121818,
                "z": 24,
                "cf": 0.9599999785423279
              },
              {
                "c": 3,
                "d": ".NET AssemblyTitleAttribute marker",
                "i": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
                "o": 121795,
                "z": 22,
                "cf": 0.9599999785423279
              },
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 121576,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 121448
          },
          {
            "b": "q/(C*Bo2@+Byd%Tv@Dl}A@Y\u0026:BydEMvq{p0wb]LDfGhKqA+NG?07gBdASwHCBZ/e#08m3wvR6NKzF0!!rc-B]0b(*-nP59VBZY92BA)\u003cLB8$]fvR*q\u0026m}D^wD2Ns:A=k!=vqYQ(wDkRJzGGPfwMi}]wK{lEwnC/SnP5Y\u0026yH{jKzdm6%077yqwnb{]mR(HCA@XKvzE^s007QQxrc-B]A@XZwBwls-vR6O306$apx)9{bz/L?BA+eW3wL3=XByx5%wDk8ozGYPiBo2oUl#NiSy?iP:fHmS#oh[t}f-Uf\u003eoMbb^ASxlew)dVsq*AC7iD3ShACfOJf-TKgiz\u003e6pq/1^qmm.V2v]+vdAr6-@pipRsq-w#0heU\u0026=C57c1lJy5cvSMTix(mL-x*D-dnk@IYqH6%jze@r*o/M2JrbU9GBy+C)w\u0026K*kC2IgIwPgy2l}ZW7nj9wPwPhD]v}tTar7oC]hb!Tbhay.ZgKiU1l]j)QgDdYVv]DF+s8JgQhCV!oD1Na@wh=qRfJigqlr3AOn]EmgAa5-AwNPayx(mFZvMwv0C1\u003e[NfMY=rl%ahDz8=XsxjVf(pgn0J0aFq\u003cA6ViSm0qypyI49owk#I@090#Mz2^p8s9ONUq-en#mqUTOAAv6[v/P2oBvyg*q=ML4y\u0026J]KpJ/GFrrbY-gJL(xq.}oYBy[00gI.k4qufASmk).py?V*b098^th+ETwo\u003e)l1ol9*4A9c4Xm%F#PxkzJCA-U0@z!/",
            "n": [
              {
                "c": 3,
                "d": ".NET converts text to a byte value",
                "i": "metadata/file/format/iso::iso-dotnet-hex-byte-conversion",
                "o": 151515,
                "z": 6,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": ".NET slices text before byte conversion",
                "i": "metadata/file/format/iso::iso-dotnet-hex-slice",
                "o": 151485,
                "z": 9,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": ".NET Activator reflection marker",
                "i": "metadata/file/format/structured::embedded-dotnet-activator-reference",
                "o": 151364,
                "z": 9,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 151311,
                "z": 12,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 151183
          }
        ],
        "mol": "O₂(AsC)Md",
        "sha": "e032f9a2df3b1da692dfca8d6bc256c29a8294f5d6fd0ace335e595068b5f0c5",
        "path": "/tmp/cyclotron-3f577082/samples/e032f9a2df3b/e032f9a2df3b1da692dfca8d6bc256c29a8294f5d6fd0ace335e595068b5f0c5.iso",
        "risk": 239,
        "size": 552960,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 552960.0,
              "entropy": 3.85,
              "size_bytes": 552960.0
            },
            "binary": {
              "overall_entropy": 3.85,
              "peak_region_bytes": 31744.0,
              "peak_region_entropy": 6.05
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                121576,
                17
              ],
              [
                151311,
                12
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::primary-volume-descriptor",
            "conf": 1.0,
            "crit": 2,
            "desc": "ISO-9660 primary volume descriptor marker",
            "spans": [
              [
                32769,
                5
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-metadata-sig",
            "conf": 0.9700000286102295,
            "crit": 3,
            "desc": ".NET metadata signature string in ISO content",
            "spans": [
              [
                86908,
                4
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-hex-byte-conversion",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET converts text to a byte value",
            "spans": [
              [
                151515,
                6
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-activator-reference",
            "atk": "T1620",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET Activator reflection marker",
            "spans": [
              [
                151364,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-hex-slice",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": ".NET slices text before byte conversion",
            "spans": [
              [
                151485,
                9
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-title-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyTitleAttribute marker",
            "spans": [
              [
                121795,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-dotnet-assembly-attr",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": ".NET AssemblyCompanyAttribute marker",
            "spans": [
              [
                121818,
                24
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-hex-reflective-loader",
            "atk": "T1027,T1140,T1620",
            "mbc": "B0032,E1059",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO .NET hex-reflective stage loader",
            "spans": [
              [
                32769,
                5
              ],
              [
                86908,
                4
              ],
              [
                121576,
                17
              ],
              [
                151311,
                12
              ],
              [
                151485,
                9
              ],
              [
                151515,
                6
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/staging/memory::iso-dotnet-in-memory-managed-stage",
            "atk": "T1027,T1140,T1620",
            "mbc": "B0032,E1059",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO in-memory managed stage handoff",
            "spans": [
              [
                32769,
                5
              ],
              [
                86908,
                4
              ],
              [
                121576,
                17
              ],
              [
                151311,
                12
              ],
              [
                151364,
                9
              ],
              [
                151485,
                9
              ],
              [
                151515,
                6
              ]
            ]
          }
        ]
      }
    ]
  }
}