{
  "llm": {
    "conf": 0.8,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "suspicious",
    "interpretation": "Obfuscated executable with reflection markers"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 3000,
    "conf": 54,
    "mods": [
      {
        "cls": 0,
        "raw": 0.8808645,
        "rte": "az",
        "prob": 0.8808645
      }
    ],
    "prob": 0.8,
    "files": [
      {
        "id": 0,
        "lvl": 3000,
        "conf": 54,
        "prob": 0.800000011920929,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T15:21:56Z"
  },
  "path": "e33fbfe5dee91d5983f9d937e84b9a5476c82f5faba8d4c273a9ff5ec3630ec7.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.m%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^{mn(\u0026UpF-eRarR^HarR^HarR^HarR^HarR^HarR^b00000000120SSi200lj400000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "Aa\u0026%6wKffYk%YcXk$\u003cZYl$HgNxLzu}pEF=gAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKepgnO7^^k$1dcr6-/EqC/+GwO=s0x(mGIwO=s0x(mGIwO=s0x(mGOoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phSvtk@rj%w\u00268[!y\u0026B64zE(a1xgcrEAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKH9CAa\u0026%6wKeQVl$HgNxLzu}l$HgNxLzu}l$HgNxLzu}xg$PSi4({MwO=s0x(mGF",
            "n": [
              {
                "c": 4,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 1201851,
                "z": 52,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 1201755
          },
          {
            "b": "wPRoDz/]@t06$da07gWEzGC\u003eRwPI^jA:@W408l)zxIrbHA::0le(lObAaK6ix\u003eqt=A+frgB-H#6o\u003c}]tqE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4$wPI^jA:@W40chT(z/{8gwKyPRBAIRn07g)BBAIRnnP5cU08[e:By/qwm@i9MvqGU7vruj4zuarXByd{SB8Mhwv}wwyzEEf?ASx--BydyTy\u0026\u003c/uwDl^.BydyTy\u0026\u003c/uwDlvOBydv5B8L)}q*ACawO\u003c4",
            "n": [
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 1212237,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 1212173
          },
          {
            "b": "x\u003c#jbwDkbfvS=r@vpB4:l3di?x\u003c#jbwDkbfvS=r@x(mMTz!9B206$WEwO\u003e))C#OH1y?k[OBAh88B-.f{q*ACawO\u003c4$wOb:\u0026v@#B6zu8$zB7Gh$y\u003cwAWB7ol8Acb/jzB5w^A+P09By+CrB8$]fvR*rSz/ff3xlwl6BzkVhl3di?x\u003c#jbwDk2qB7Gh$y\u003cwx^ze-{3C%MK]A+P09By+CrB8$]fvR*r^A=kGhv@$1UBAh88B-.f{l349UzdmsblVl{?A+Pf1Bn",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 1213027,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 1212963
          },
          {
            "b": "x(mL-o\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv\u003eHb!ze:i9wPyZXA=#ebwPE\u0026Bvru6JwPN]KD2Nr{m}D^wD2Nr{nP5Y\u0026yH{jKzdm6%077yqwnb{]mR(HCA@XKvzE^s007gWxBAhqo08^xHB.$X-vr(^lBo2cQx(n1)B7GD2oMaAHBzkVh0b2\u003e+uQF:HBAhqoA@XNCzGG]qy^SbSy?m9#x(v\u003e?B7GD2pgn0J07*aiAbY-oBv*v:Bzkf1x)Ks\u003cmq=TczFsg)",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 1214860,
                "z": 12,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 1214796
          }
        ],
        "mol": "MdTh",
        "sha": "e33fbfe5dee91d5983f9d937e84b9a5476c82f5faba8d4c273a9ff5ec3630ec7",
        "path": "e33fbfe5dee91d5983f9d937e84b9a5476c82f5faba8d4c273a9ff5ec3630ec7.iso",
        "risk": 37,
        "size": 1245184,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 1245184.0,
              "entropy": 3.85,
              "size_bytes": 1245184.0
            },
            "binary": {
              "overall_entropy": 3.85,
              "peak_region_bytes": 378880.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                1213027,
                17
              ],
              [
                1214860,
                12
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                1212237,
                15
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                1201851,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}