{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 0.6687533, "class": 0 }, { "m": "az/media", "prob": 1.0, "class": 2 }, { "m": "az/jpeg", "prob": 0.96087176, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-16T14:38:02Z" }, "path": "ec5f7b6a29db28c27d3d832554123bb9ea32194fc87d920d5485aa2dbe852df9.unknown", "raw": { "v": "4", "fs": [ { "f": "O(As)Md", "x": 39, "id": 0, "ms": { "file": { "size": 5816605.0 }, "jpeg": { "dht_count": 4.0, "dqt_count": 2.0, "soi_count": 1.0, "segment_count": 10.0, "appended_bytes": 4762983.0, "app_segment_count": 1.0 }, "image": { "width": 3840.0, "height": 2160.0, "channels": 3.0, "b_entropy": 7.71, "g_entropy": 7.13, "r_entropy": 5.44, "edge_density": 0.01, "pixel_entropy": 7.22, "histogram_flatness": 0.9 }, "binary": { "overall_entropy": 5.94 } }, "ss": [ [ 6, "JFIF" ], [ 107, "!22222222222222222222222222222222222222222222222222" ], [ 883, "d92u" ], [ 4821, "puol" ], [ 5517, "JGZ6" ], [ 8045, "L81C" ], [ 9343, "Tqht" ], [ 10092, "FRHV6" ], [ 15346, "/piS" ], [ 19019, "T rm" ], [ 23355, "yaav" ], [ 32491, "/ dU" ], [ 32580, "/Hc\tg" ], [ 32945, "Nlln" ], [ 33611, "TRK2" ], [ 40775, "719a" ], [ 40881, "c48h" ], [ 42319, "W8OL_" ], [ 43044, "Clpe" ], [ 44432, "a4j6" ], [ 50928, "IVRK" ], [ 54552, "TCLH" ], [ 55225, "N9URA" ], [ 60657, "YB2\u003e" ], [ 61375, "Vha v" ], [ 64994, ".VU/Lslw" ], [ 65462, "4ejn" ], [ 65637, "Affqt" ], [ 67407, "/ \u003cWlyx" ], [ 70156, "V_H=" ], [ 70220, "6RTH" ], [ 80677, "MMBAS" ], [ 82820, "YC2F" ], [ 86037, "Ijfriy" ], [ 86560, "g4ku" ], [ 87180, "/5xm" ], [ 97875, "nk78" ], [ 103061, "o7xv" ], [ 104864, "/O b" ], [ 105857, "6OJVI" ], [ 112295, "LHLJ" ], [ 113188, "k3on" ], [ 116190, "D19AJX" ], [ 119888, "/WVM" ], [ 121793, "l8n3" ], [ 125094, "EBXP" ], [ 146648, "TOLE" ], [ 148593, "Boabk" ], [ 151583, "t4qou" ], [ 153620, "IVNJ" ], [ 154178, "2D A" ], [ 158139, "7 ry" ], [ 162223, "X9_B" ], [ 165365, "GZWP" ], [ 168659, "D_9M" ], [ 170641, "23yc" ], [ 176434, "YPH7" ], [ 183131, "Beid" ], [ 189458, "Iryr" ], [ 190189, "XX96" ], [ 201622, "BFVM" ], [ 202047, "e97x" ], [ 202447, "8K6W" ], [ 207627, "M3UV" ], [ 209680, "HS_Z5" ], [ 210683, "n160" ], [ 211280, "6f61p" ], [ 215160, "/PqZE" ], [ 219974, "zeji" ], [ 222578, "VUPH" ], [ 229064, "9uzx" ], [ 232129, "Ieef" ], [ 236415, "4s0m" ], [ 237693, "8G3D" ], [ 239617, "VRX6" ], [ 241521, "c8de" ], [ 243099, "N923" ], [ 251962, "UK6F8" ], [ 252626, "D3G4B" ], [ 254563, "i4m2" ], [ 255713, "/vXV" ], [ 256143, "]L2\u003e" ], [ 261419, "XLB4" ], [ 265062, "y2ja" ], [ 266192, "9I4E" ], [ 267499, "/mCN" ], [ 276596, "88up" ], [ 282865, "p16k" ], [ 285394, "v9k7" ], [ 287746, "ei3424" ], [ 290678, "T105C" ], [ 294451, "AEG5" ], [ 294823, "Z63_" ], [ 297743, "DQ_U" ], [ 299524, "dEVRhpG" ], [ 302034, "yY2\u003e" ], [ 302980, "RUMD" ], [ 304710, "/no1" ], [ 306327, "CJZ6" ], [ 308711, "M_V9" ], [ 309723, "`8p`" ], [ 310163, "5n1w" ], [ 313544, "Xfdo" ], [ 313960, "bz90" ], [ 321965, "w3qu" ], [ 322810, "vc26" ], [ 326523, "Djhm" ], [ 327823, "e9ld" ], [ 328565, "h39a" ], [ 329469, "/o5w" ], [ 332334, "34lg" ], [ 351304, "PRDR" ], [ 354096, "B8IP" ], [ 356467, "4r4n" ], [ 358731, "3GTO" ], [ 363992, "ezmlzfo1-Xq" ], [ 367617, "WG.RoJnv" ], [ 368517, "4B5R" ], [ 369246, "lc364" ], [ 370111, "5lza" ], [ 375628, "Ejny" ], [ 377211, "ru40" ], [ 378035, "Rkyj" ], [ 378102, "/Bsq" ], [ 379857, "9PJG" ], [ 380036, "/myj" ], [ 384109, "Rl s" ], [ 390124, "FB_R" ], [ 393567, "NZCP" ], [ 394925, "g3it" ], [ 397498, "Gavr" ], [ 403143, "dd /" ], [ 420024, "Q3FX" ], [ 421112, "JMDG5" ], [ 427841, "QAYV" ], [ 439087, "pje3j" ], [ 441682, "gyoqa" ], [ 443530, "W8IP" ], [ 450393, "TPYA" ], [ 453936, "51IE" ], [ 458500, "f3y1" ], [ 460514, "/ldm" ], [ 464757, "ZZ9T" ], [ 469654, "q7d7" ], [ 476448, "RX5J" ], [ 480096, "XP48" ], [ 480828, "4JQR" ], [ 486677, "r3223" ], [ 488650, "Mdql" ], [ 490711, "TI86" ], [ 491289, "696j" ], [ 498158, "b16p" ], [ 498377, "UG4O" ], [ 503958, "Rwnn" ], [ 510155, "km56" ], [ 512249, "k126" ], [ 517095, "zp2iw" ], [ 521476, "Phzx" ], [ 523775, "e6qx" ], [ 525948, "o67f" ], [ 526717, "4cap" ], [ 541495, "EFPI" ], [ 544354, "J1HYU" ], [ 547127, "w90w" ], [ 552212, "PUVS" ], [ 552382, "Gecf" ], [ 552785, "Tatc" ], [ 558132, "NW41" ], [ 561193, "Jtqm" ], [ 563935, "Z8Z0" ], [ 564969, "Sp yf" ], [ 565338, "t95w" ], [ 571664, "D_2P" ], [ 572853, "/luI" ], [ 580722, "YUZF" ], [ 589152, "9IWQ" ], [ 593779, "BYQA" ], [ 594305, "HRSAA" ], [ 596385, "5 OH" ], [ 596829, "9G9X" ], [ 600854, "KGVK" ], [ 602589, "gec v7" ], [ 603264, "zu9v" ], [ 609215, "/1nh" ], [ 612661, "98VB" ], [ 612781, "NL92A" ], [ 616757, "/aRo" ], [ 621709, "3a2d" ], [ 622485, "8eht" ], [ 633569, "/Ecb" ], [ 636611, "XIRH" ], [ 642758, "b33u" ], [ 657406, "Ffbo" ], [ 665260, "JUWT" ], [ 666149, "YWIG" ], [ 671978, "5azq" ], [ 674697, "Dent" ], [ 674766, "xd6e" ], [ 675940, "3yol" ], [ 680721, "7ohv" ], [ 682206, "/XWP" ], [ 683183, "4hur" ], [ 685270, "/PLb" ], [ 687789, "7c6y" ], [ 689874, "ay4lcx" ], [ 690258, "2HPP" ], [ 692094, "791x" ], [ 692252, "Lguz" ], [ 694531, "cp98" ], [ 698736, "YUYXI" ], [ 701442, "YZXM" ], [ 702464, "O9FRH" ], [ 708213, "/KRw" ], [ 716652, "9LFM" ], [ 717217, "ekae" ], [ 718382, "PCWA" ], [ 724606, "XIJA" ], [ 725338, "4r4l" ], [ 726963, "MJ2N" ], [ 730178, "Uaiv" ], [ 733926, "ecej" ], [ 734247, "fa90" ], [ 734939, "WPFC" ], [ 735877, "WRA6" ], [ 737815, "/pLET" ], [ 740607, "RQGF" ], [ 741677, "PC_6" ], [ 743805, "ZM3JJ" ], [ 749141, "FRUZ" ], [ 749422, "99X4M" ], [ 751565, "/nlX" ], [ 752772, "l14o" ], [ 756814, "3 PF" ], [ 757671, "Tbld" ], [ 761155, "t9d2" ], [ 762311, "O08RG" ], [ 767569, "F43F" ], [ 768532, "icTrHam" ], [ 768577, "JFTU" ], [ 769697, "CR0P" ], [ 771381, "XBB1" ], [ 771628, "M31S" ], [ 773376, "6IZIK" ], [ 774327, "XF0Q" ], [ 778146, "FB77" ], [ 780066, "LSBX" ], [ 784529, "/TYI" ], [ 784836, "muog" ], [ 791772, "SC5B" ], [ 794084, "HOZ5" ], [ 794877, "/PFh" ], [ 795141, "LZ1E" ], [ 795391, "R1BK" ], [ 795844, "XWQK" ], [ 800626, "/8Rg" ], [ 802455, "CXNP" ] ], "sz": 5816605, "ts": [ { "a": "T1027.003", "c": 0.9200000166893005, "d": "Payload marker after image EOF", "e": [ "INICIO" ], "i": "objectives/command-and-control/dropper/delivery/stego::image-tail-payload-marker", "l": 1, "m": "E1027.m02" }, { "a": "T1027.003", "c": 0.949999988079071, "d": "Data appended after JPEG EOI marker", "e": [ "jpeg.appended_bytes = 4762983.00" ], "i": "objectives/anti-static/obfuscation/steganography/image::jpeg-appended-data", "l": 4, "m": "B0032.001" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "dnlib.Utils.IListListener\u003cdnlib.DotNet.T \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 } ], "sha": "ec5f7b6a29db28c27d3d832554123bb9ea32194fc87d920d5485aa2dbe852df9", "path": "ec5f7b6a29db28c27d3d832554123bb9ea32194fc87d920d5485aa2dbe852df9.unknown", "type": "jpeg" } ], "tv": "529a0" } }