{
  "llm": {
    "conf": 0.99300003,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "ISO hides obfuscated PowerShell loader"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9801697,
        "rte": "az",
        "prob": 0.9801697
      }
    ],
    "prob": 0.99,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9900000095367432,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-04T07:59:10Z"
  },
  "path": "e9fc754844df1a7196a001ac3dfbcf28b80397a718a3ceb8d397378a6375ff62.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!bp!-I}fFCmufGgNreIY1ng+zZ7eI/szg9vXZarR^b000000000x00000001ex000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080dka+2m\u00260Y0SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao",
            "n": [
              {
                "c": 5,
                "d": "ISO hides a dynamic PowerShell loader behind stride decoding",
                "i": "objectives/anti-static/obfuscation/encoding/arithmetic::iso-stride-decoded-powershell-loader",
                "o": 32769,
                "z": 5,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 32641
          },
          {
            "b": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000crl\u003cA=-ASze0(gAbP@iA=U]9y?$.nCX50HCwg@9z*cnAD2d4mxLz0/wO@RmauQ(ECv+ucB7/GhavZo\u0026Ab](fA:-*4wPzu8ls\u003esOwoh\u003ceB7DEsk072Rx(4P%BzC/jBz(hhBuI0+z*2Y5zF9=%B0\u003c4ibwqvnA=l2ez/xA2vqG+9avp0!xjVa1x\u003eI70axio1AaKcjaxrq?y*?yax\u003ez6\u003cwfsiPz!\u003cJmxkRo#B08X\u003ej0WTzD23#jjTt8\u003ey?v9$wH/3tz/Z1Mry]n:B-7Yhx(v(ilt{BMwmY*gbU-i0z/PMkwPzuhDR4/(c)RSgD23#jdiJ%.rC(+\u0026v@#Tfx\u003c\u003e*(B7F(jd)5e8l1a!PyIvy5wPQ6XxjU%{zE^J\u003ey?dT0d\u003cN\u0026cBz(hlB7Gx6e*\u003ct7zFa68cOlPzzG6r1Bz(hlvqGU0wN)\u003eBw]zYras6G?A=L-7vpsg!wO#6lgCI3Hj0WvdA=L-7vpsg!wO#6lgCH17y\u0026*^Bl1a!PyIvy5wPQ0Vnm=*ZwOkBWA+5:0wIC$}d)k:sDN8BkA:-*0wnbE5d)21Cz/PA1wP\u00260lwH/[?o(Cb(A+PPaA+eD2nm=*ZwOkBWA+5:0wIC$}t@%rfx(!64B.\u003e@bB8%F(pJgt=yi9%ccP=-4mSirUwmY}5By^KZw{503BzkVhavg3^zddHcz!s5sbU@O{A=U@cBAp]9y\u00260V[wPz\u0026Dh.#[fasniNarR^PbT#iWwmov*z!i@rasFHhC4CYnx\u003eIKevRGT{wN]v)B1]Qfdlz@6ok!S+zFrJ}C42A5B3h\u003cdwO#3\u0026B08\u00267vp%jEnnqZLzY?B\u003cy\u003cEjmA+e@+zGxJdo\u003c@b^y/B*=w)(/Kaz0h}z/PqfcP-ODz!%ufx\u003c\u003e?3vrb}2d)ljqwO#3\u0026B08\u0026eazV3QlulHLe*9#hatub[wmV(.z/xzsmR\u003chRs4+eZwna+DwmYT/wNPQ\u0026eoLxpzY\u00261$zfFY.A=Mk4x(+ytn[A3Up9rLEvn[v+z*0lCz/Y$Ol1+jDfJofjzz2yfB89Esx(taQmRcQOatd8wxJE@EvQ:4HB.$@javY{+hC!9$yCXs{B9oSuz/Pwhnm=VYCTua+yC)q3w=",
            "n": [
              {
                "c": 5,
                "d": "ISO stages hidden PowerShell through a dynamic string decoder",
                "i": "objectives/command-and-control/dropper/staging/encoded::iso-hidden-powershell-dynamic-stager",
                "o": 61451,
                "z": 34,
                "cf": 0.9900000095367432
              },
              {
                "c": 4,
                "d": "Dynamic PowerShell call over long strings",
                "i": "metadata/file/format/iso::iso-powershell-dynamic-call",
                "o": 62000,
                "z": 44,
                "cf": 0.9700000286102295
              },
              {
                "c": 4,
                "d": "Every-fifth-character string decoder",
                "i": "metadata/file/format/iso::iso-powershell-stride-decoder",
                "o": 61779,
                "z": 128,
                "cf": 0.9700000286102295
              }
            ],
            "ln": 61323
          }
        ],
        "mol": "O₂(AsC)Md",
        "sha": "e9fc754844df1a7196a001ac3dfbcf28b80397a718a3ceb8d397378a6375ff62",
        "path": "/tmp/cyclotron-3f577082/samples/e9fc754844df/e9fc754844df1a7196a001ac3dfbcf28b80397a718a3ceb8d397378a6375ff62.iso",
        "risk": 277,
        "size": 67584,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 67584.0,
              "entropy": 1.08,
              "size_bytes": 67584.0
            },
            "binary": {
              "overall_entropy": 1.08,
              "peak_region_bytes": 6144.0,
              "peak_region_entropy": 5.33
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::primary-volume-descriptor",
            "conf": 1.0,
            "crit": 2,
            "desc": "ISO-9660 primary volume descriptor marker",
            "spans": [
              [
                32769,
                5
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-powershell-command-line",
            "atk": "T1059.001",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "PowerShell command has execution option",
            "spans": [
              [
                61451,
                34
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-powershell-stride-decoder",
            "atk": "T1027",
            "conf": 0.9700000286102295,
            "crit": 4,
            "desc": "Every-fifth-character string decoder",
            "spans": [
              [
                61779,
                128
              ]
            ]
          },
          {
            "id": "metadata/file/format/iso::iso-powershell-dynamic-call",
            "atk": "T1059.001,T1027",
            "conf": 0.9700000286102295,
            "crit": 4,
            "desc": "Dynamic PowerShell call over long strings",
            "spans": [
              [
                62000,
                44
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/arithmetic::iso-stride-decoded-powershell-loader",
            "atk": "T1027,T1059.001,T1620",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO hides a dynamic PowerShell loader behind stride decoding",
            "spans": [
              [
                32769,
                5
              ],
              [
                61451,
                34
              ],
              [
                61779,
                128
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/staging/encoded::iso-hidden-powershell-dynamic-stager",
            "atk": "T1027,T1059.001,T1105,T1564.003",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO stages hidden PowerShell through a dynamic string decoder",
            "spans": [
              [
                32769,
                5
              ],
              [
                61451,
                34
              ],
              [
                61779,
                128
              ],
              [
                62000,
                44
              ]
            ]
          }
        ]
      }
    ]
  }
}