{
  "llm": {
    "conf": 0.98534924,
    "grade": "hostile",
    "model": "Qwen/Qwen3.8-27B",
    "before": {
      "lvl": -1,
      "prob": 0.9781332,
      "class": "benign"
    },
    "outcome": "suspicious",
    "interpretation": "Obfuscated PowerShell payload execution"
  },
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.1",
    "lvl": 279,
    "conf": 80,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9781332,
        "rte": "az",
        "prob": 0.9781332
      },
      {
        "cls": 0,
        "raw": 0.98838073,
        "rte": "az/zip",
        "prob": 0.98838073
      }
    ],
    "prob": 0.98534924,
    "files": [
      {
        "id": 0,
        "lvl": 279,
        "conf": 80,
        "prob": 0.9853492379188538,
        "type": "zip"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0009694595937617123,
        "type": "batch"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-10-02T00:12:48Z"
  },
  "path": "01102026_2358_01102026_ДОГОВОР ПОСТАВКИ- տիպային.bat.zip",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(As₃)H(Po₂)Md₃(BiPa)",
        "sha": "ed229337545076f203ba7305f6ffa5681bb861f359cdb43d52b67f7ccb92ca43",
        "path": "01102026_2358_01102026_ДОГОВОР ПОСТАВКИ- տիպային.bat.zip",
        "risk": 39,
        "size": 3258,
        "type": "zip",
        "facts": {
          "metrics": {
            "file": {
              "size": 3258,
              "entropy": 7.91
            },
            "binary": {
              "peak_region_bytes": 3072,
              "peak_region_entropy": 7.82
            },
            "archive": {
              "file_count": 1,
              "member_count": 1,
              "script_count": 1,
              "zip_bomb_ratio": 2.01,
              "compressed_size": 3022,
              "directory_count": 0,
              "executable_count": 0,
              "extra_field_size": 36,
              "noise_file_count": 0,
              "compression.ratio": 0.5,
              "hidden_file_count": 0,
              "uncompressed_size": 6078,
              "crc_collision_count": 0,
              "entry_comment_count": 0,
              "max_filename_length": 51,
              "rtlo_filename_count": 0,
              "format.regular_count": 1,
              "nested_archive_count": 0,
              "path_traversal_count": 0,
              "symlink_escape_count": 0,
              "security.setgid_count": 0,
              "security.setuid_count": 0,
              "security.sticky_count": 0,
              "double_extension_count": 0,
              "duplicate_member_count": 0,
              "security.symlink_count": 0,
              "unicode_filename_count": 1,
              "homoglyph_filename_count": 1,
              "security.encrypted_count": 0,
              "timing.mtime_unique_count": 1,
              "timing.mtime_unique_ratio": 1,
              "misplaced_executable_count": 0,
              "timing.mtime_dominant_count": 1,
              "timing.mtime_spread_seconds": 0,
              "timing.sentinel_mtime_count": 0,
              "security.world_writable_count": 0,
              "timing.mtime_dominant_fraction": 1,
              "compression.method_counts.deflate": 1
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/create/hidden::powershell-windowstyle-hidden-option",
            "atk": "T1564.003",
            "conf": 0.9,
            "crit": 3,
            "desc": "PowerShell WindowStyle Hidden option",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Exactly one line exceeds 1000 chars",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/string/file::tmp",
            "conf": 0.2,
            "crit": 1,
            "desc": "tmp keyword",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/powershell-loader::ps-charcode-array",
            "atk": "T1059.001",
            "mbc": "B0032",
            "conf": 0.8,
            "crit": 3,
            "desc": "PowerShell numeric char-code array",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/interpreter::powershell-executable-token",
            "conf": 0.98,
            "crit": 3,
            "desc": "PowerShell executable name reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/binary/code/complexity::batch-has-long-token",
            "conf": 0.9,
            "crit": 3,
            "desc": "Batch contains a long token",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/concat::ps-numeric-chararray",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.85,
            "crit": 4,
            "desc": "Numeric character array payload",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/powershell-loader::ps-indexed-charcode-assignment",
            "atk": "T1059.001",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "PowerShell indexed char-code decode assignment",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/string/count::few-string-literals",
            "conf": 0.4,
            "crit": 3,
            "desc": "File has very few string literals",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/naming::archive-bat-member",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive member is a batch script"
          },
          {
            "id": "metadata/package/files/archive-member::archive-batch-member",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive member is a batch file"
          },
          {
            "id": "metadata/file/naming::archive-member-under-10kb",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive has a sub-10KB member"
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "4gkviv}Y^6z!rO\u003c3uG^2ar\u003cx{w]7)$z/PMkyH}MIw{503BzkVhayYIsuVo*\u0026yAN%DarR^Lx(mK3A=2l3x)KtkjS)%cD2[7sz7Xj+By!A=zdN0li-Qoiph+teo\u003e!AWx(^\u0026}z/f8EarR^HA+funA=90Bx(mK3A=2l3x)Kusj0XSJx\u003e7N/y\u003cwfec]K4of!\u003eQrf!+Qsf!\u003eBmf!+Nrf!+skf!+pgj0XxTD30.uvp-\u003c\u0026jS)%cD2[7sz7Xt3x\u003egHgi.\u003cmgm%eJRc[c=Fz=p:#x(mMidlw!+z/P(fv@#Q1B8$]ljVkbOg=N6Ai5JJLj0XGJCv+qFh-\u003ek!z!S-/tt]/*By/qwo\u003c@cSt@\u003e2oy\u0026sljc]-?tgatp?C5I89u0ylMB97#ge\u003e]+@xK9UWl1j)-eI]jij7-RMv@#B6zxKmCByfleaBtjNarR}JB-p]jB7F\u003c7A+f6jauZ\u0026Kq*ACawO\u003c4]vruf*iYZhVA=-Y:g=cTyarR^HA+funA=90BB9hCkA=U/4B-I5fD3@[uz!S-/tt]/*By/qwraQq@e\u003e6U/z!9N1xi^LVrA8BEe\u003eoF{lv0V:B0@zBy*?u\u003exl4{acN?b?B-7Yhx(v(io)HR!x\u003eIHeasFHHzGGDgCxdbhAa%i5diJ$wC5I89u0ylMB97#ge\u003e]+@xK9UWq!Za$gCgysdlw!^A=b]izFa3jvpA!:y?mTdjTteXvR/N)x(mMorb#X\u0026c[dk6AaJG/y?ksTi3pvbtt]/*By/qwnLZ%nvruf*iYY=xBw=K+wn=rOx(4uQvqPN7df",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "z/fA6zGGeBi-G*6yEr2.zGE%LB-7Yhx(v(iwOVu}zdNQavrb**ygH)@asFHCvp%K/vp\u003cT{y?mu)A=bCtbW$FhwOL^hh-AfdDN9AsvrlKij.enGD2^tgvR6QekQXuvg+pyph.lZrhy{Qrh7QHrfF1}si4M^Ah.lWxfF1$ng+pypgaUgofF1$kiv({th.lZrf!t4sgaUgoh.lZsfF1}oh.lZrhy{Qsf!t7mf!t4sgaUdqh.lWuh7QHqfF1$lgB$poiv({tf!t4rg+pypi4M^wi4M^xh.lWwgB$mqgasUlo)HR!x\u003eIHeasFHKwNPU4B18I.C42i6wN/\u003e0vpZMAax}=\u0026B97#ge\u003c:n]lVl\u003c=wPz)7A:pZ!m}D^eD30Rsc]9Fki4l{[q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@\u003cn3Bz(bxvru0)t@\u003e2BByxiipgXR$dlzc:zEW^5z/cXky\u0026sujw{FilasFHRx\u003eIK0A=bCqaBvrWz/f-fA=+OFi-H2+xKL{fbY^WjBy/GgwHS3MvR/E.yId=#A+3pQax[",
            "ln": 728,
            "col": 716,
            "line": 3
          },
          {
            "b": "BtCWTiYZ8CA=U!ucP9\u003ercN?bYC5I89u0ylMB97#ge\u003e]+@xK9UWp\u0026yLagaTL9dlz-!x(4uebY[6HwHO:GbW$XjByO)1B9hIix(Vf\u003eto){6A+PS7Bz(hBt}Fh+y*?3/vqG+9to){6A+PS7Bz(hBb{:*IwP}Y@t@%ruw[V6{x\u003eI0cj.[\u003eLA=kMny\u0026.0IvScpev}xL0B-H]8AYt%YbX.ptx()^9z/QaNd{TO=x\u003ew+BzF%RtbW$XjByO)1B9hIix(Vf\u003eto){6A+PS7Bz(hBt}7aCw]zZ3vSC)\u0026By=NT",
            "ln": 1320,
            "col": 1308,
            "line": 3
          },
          {
            "b": "dlz0VwNPw5txT}0wl\u0026zrD2[7sz7XyQe(k$#xK9UWm}D^wwO(x.vrufhdsAEUvruf]zddK2v}/v?ixecAax}=\u0026B97#ge\u003c%b\u0026wMiwXwNdtTph+tel$7vpw(\u0026LPyDA!Iw[V6{x\u003eH#",
            "ln": 1587,
            "col": 1575,
            "line": 3
          },
          {
            "b": "x(Vf\u003eef]pLA+PAcvp%Wti6w@DbYmKrx(m{kx(W{9xfwj6DS$Vix\u003egHNq*ACawO\u003c4]vruf*iYYSDB0@Z{h7pQjxK#75D2vXtB7/b}wPzW1j.enGD2^tgvR6QekQXuAiv()Ag+pyqfF1$mgaUgohy{QqgaUgng+pvvg+pypfF1}ph.lWxfF1}qi4M*th7QHqf!t4rh.lWygB$pnhy{Qsh.lZriv()xh7QEtgaUdqf!t7ogB$ppgB$poh.lZsi4M*sg+pvrfF1}jg+pyph7QHrfF1$mhy{Qsg+pyofF1$kf!t4ri4M*vgaUgohy{Qshy{Qqh7QHphy{Qrg+pvpg+pvuf!t4pfEXCjbYEWrz!QsSax}=\u0026B97#ge\u003eF?\u003ep*[DVt@\u003e2pwPQv=By/uhx(v(qcVA)uyC6ZCA3)7@bXImywPzWewPz\u0026PkQYuLzE^D]B95JMbXQ+bB9RUAy\u0026:o3wmY!0wHP5\u0026txT}0wl\u0026zrD2[7sz7Xg?vrbTmi.sx^z*b=kc)@\u003cVdly1qAWShBvqP.1xLzu%jUO@ubXImywPzWewPz\u0026@bXyF4x(^%4zF9k$ePbbxbY3[fv}YB{j0k!XvqP.1xLzu%d/",
            "ln": 1972,
            "col": 1960,
            "line": 3
          },
          {
            "b": "v{%g\u0026D0qLavqP.1xLzu%b{:*IwP}Y@u40#dz!%umA+PPpx\u003e8ibjS)%cD2[7sz7XK\u003eBza@vi.:4cc]0Fdauhwgj0XARA=u5cyJKoavqZgdj.enGD2^tgvR6QekQXuwgB$ppgB$ppfF1$lh.lZsi4M^ugB$mvf!t4qh.lZtf!t7lhy{Qshy{Nyiv()Bg+pvwgB$mmg+pyqfF1$mhy{QtfF1$kiv({uh7QHqfF1}rgaUgni4M*ugB$pphZ{gqtxT}0wl\u0026zrD2[7sz7X+eA+PA7t@\u003e2lz/6D4A+cTDCw?BFefDr-x)q0Oj0X(\u0026vSMT1zGGPowPzW1B3ilyzE^D]B95JMbXy$nAb]x5BzkJ0zGG}Gj85pHc)S\u003eHA+PAcvp%Wti4k$%as7Apwnu6%C4CM5B09Q*tt]/*By/qwl$7gGrb3hXt@\u003e2rB4*dNA9l:XAWSW%gb{ZAo)HR!x\u003eIHeas82JvSMT1zGGPowPzW1B30PHz!P",
            "ln": 2523,
            "col": 2511,
            "line": 3
          },
          {
            "b": "efD@4dsDRGq*ACawO\u003c4]vruf*iYZkXB-7X$By=\u003cTh7*^Cdlw!]wPzP}Bzk]fjYt{ex(4H6B.Lx2BA[#Rv]^XZryG=gl@O24l1:XtqD4Hhr-TDhqexoBt0\u003e\u003eInnJlystA-Gs1)JOqC{Uyr55R!s5\u003cuxvPDGGmO#cvlO-:Osxd?2r-SlPqBJn{lq?qWnOA3ystqKcrABcecP-O\u003evqf?1C%b8qze0*2ADL#ax([RycRM/{t0UFnw(yEalp=t\u0026nKL\u003c.ydgA.svb(alp?",
            "ln": 3024,
            "col": 3012,
            "line": 3
          },
          {
            "b": "4giKK4gme/Brz=pwOV9)wPH0Xq*ACawO\u003es-z/^pgB9R?Jz*a8@tVUSSwn=Wkp\u0026yL?A-lT.y\u00260v1f!Ld+AbP@iA=U]9y?$.nCX56w4gl/Yaz#ataz2!iB95JGc1pC3y?d9#b{BDW4gme/Brz=pwOV9)wPH0Xq*ACawO\u003es-z/^pgq*ACawO\u003cjUtVUSSwn=Wkp\u0026yL?A-lT.y\u00260v1f!Ld+AbP@iA=U]9y?$.nCX56d3mMz\u003e4glVRxM21tb$R#^y*?B7A+PPgwPGdzaBCpQc1pC3y?d9#b{BD-Cwg@9z*cnAD2d4mxLz0/wO@Rx4gi",
            "ln": 5828,
            "col": 5816,
            "line": 3
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "echo"
            ]
          ],
          "tgt": [
            "echo"
          ],
          "metrics": {
            "ast": {
              "max_depth": 5,
              "call_count": 2,
              "node_count": 54
            },
            "file": {
              "size": 6078,
              "entropy": 5.91
            },
            "text": {
              "lines": 11,
              "top_char": 101,
              "max_ws_run": 4,
              "digit_ratio": 0.12,
              "space_count": 198,
              "char_entropy": 5.91,
              "unique_chars": 87,
              "top_char_null": 0,
              "lines_over_200": 1,
              "lines_over_500": 1,
              "string_density": 0.18,
              "top_char_ratio": 0.05,
              "avg_line_length": 550.55,
              "lines_over_1000": 1,
              "max_line_length": 5815,
              "empty_line_ratio": 0.36,
              "last_line_length": 58,
              "long_token_count": 9,
              "whitespace_ratio": 0.04,
              "identifier_density": 0.64,
              "line_length_stddev": 1665.02,
              "normalized_string_count": 0.6,
              "trailing_whitespace_lines": 1,
              "normalized_unique_identifiers": 1.45
            },
            "binary": {
              "peak_region_bytes": 5054,
              "peak_region_entropy": 5.89
            },
            "strings": {
              "bytes": 18,
              "count": 2,
              "avg_length": 9,
              "max_length": 9,
              "avg_entropy": 2.73
            },
            "identifiers": {
              "count": 7,
              "unique": 5,
              "avg_length": 10.6,
              "max_length": 17,
              "min_length": 4,
              "avg_entropy": 2.93,
              "reuse_ratio": 0.71,
              "length_stddev": 4.59,
              "high_entropy_count": 1,
              "high_entropy_ratio": 0.2,
              "all_lowercase_ratio": 0.4
            }
          }
        },
        "id": 1,
        "mol": "O(As₃)H(Po₂)Md₂(Bi)",
        "path": "01102026_2358_01102026_ДОГОВОР ПОСТАВКИ- տիպային.bat.zip!!ДОГОВОР ПОСТАВКИ, տիպային.bat",
        "risk": 38,
        "sha": "834e1a1e86773f9bc09e32b950d792b6eb4a89abdbd68853dd6606d1031e0ebd",
        "size": 6078,
        "traits": [
          {
            "id": "metadata/binary/code/complexity::batch-has-long-token",
            "conf": 0.9,
            "crit": 3,
            "desc": "Batch contains a long token"
          },
          {
            "id": "metadata/file/string/file::tmp",
            "conf": 0.2,
            "crit": 1,
            "desc": "tmp keyword",
            "spans": [
              [
                2298,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/hidden::powershell-windowstyle-hidden-option",
            "atk": "T1564.003",
            "conf": 0.9,
            "crit": 3,
            "desc": "PowerShell WindowStyle Hidden option",
            "spans": [
              [
                6054,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/interpreter::powershell-executable-token",
            "conf": 0.98,
            "crit": 3,
            "desc": "PowerShell executable name reference",
            "spans": [
              [
                5892,
                14
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/powershell-loader::ps-charcode-array",
            "atk": "T1059.001",
            "mbc": "B0032",
            "conf": 0.8,
            "crit": 3,
            "desc": "PowerShell numeric char-code array",
            "spans": [
              [
                824,
                137
              ],
              [
                2068,
                181
              ],
              [
                2619,
                101
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/powershell-loader::ps-indexed-charcode-assignment",
            "atk": "T1059.001",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "PowerShell indexed char-code decode assignment",
            "spans": [
              [
                1384,
                40
              ]
            ]
          },
          {
            "id": "metadata/file/string/count::few-string-literals",
            "conf": 0.4,
            "crit": 3,
            "desc": "File has very few string literals"
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Exactly one line exceeds 1000 chars"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/concat::ps-numeric-chararray",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.85,
            "crit": 4,
            "desc": "Numeric character array payload",
            "spans": [
              [
                824,
                138
              ],
              [
                2068,
                182
              ],
              [
                2619,
                102
              ]
            ]
          },
          {
            "id": "metadata/encoded-payload/base64",
            "conf": 0.9,
            "crit": 3,
            "desc": "Encoded content decoded: base64",
            "spans": [
              [
                3088,
                22
              ]
            ]
          }
        ],
        "type": "batch"
      }
    ],
    "rev": "c1ea9",
    "v": "8"
  }
}