{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9983558058738708,
        "class": 1
      }
    ],
    "prob": 0.9983558,
    "class": 1,
    "oprob": 0.8985075,
    "models": [
      {
        "m": "az",
        "prob": 0.8985075,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 0.6458333,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-17T15:15:17Z"
  },
  "path": "ee25d6efaaf9cfcea1a6bc65e32cf8654642c3c5eedebb466dd149b0424261c0.lnk",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 68,
        "id": 0,
        "ms": {
          "lnk": {
            "icon_index": 85.0,
            "target_size": 32489.0,
            "has_arguments": false,
            "has_link_info": true,
            "has_working_dir": true,
            "has_tracker_data": true,
            "has_icon_location": true,
            "has_relative_path": true,
            "target_attributes": 32.0,
            "enable_target_metadata": true,
            "has_link_target_id_list": true,
            "has_property_store_data": true,
            "args_excessive_whitespace": false
          },
          "file": {
            "size": 716.0
          }
        },
        "ss": [
          [
            0,
            "D:\\FAQs\\Invoice #WM1073ZN.js"
          ],
          [
            0,
            ".\\FAQs\\Invoice #WM1073ZN.js"
          ],
          [
            0,
            "D:\\FAQs"
          ],
          [
            0,
            "%SystemRoot%\\System32\\imageres.dll"
          ],
          [
            0,
            "24-229-109-208"
          ],
          [
            0,
            "97:7d:a5:70:94:b3"
          ],
          [
            0,
            "00000000-0000-0000-0000-000000000000"
          ],
          [
            0,
            "be678689-61ba-11f0-9f72-977da57094b3"
          ],
          [
            215,
            "Invoice #WM1073ZN.js"
          ],
          [
            375,
            "D:\\FAQs\\Invoice #WM1073ZN.js"
          ]
        ],
        "sz": 716,
        "ts": [
          {
            "a": "T1059.007",
            "c": 0.800000011920929,
            "d": "LNK references JavaScript file extension",
            "e": [
              ".js"
            ],
            "i": "objectives/command-and-control/dropper/lnk/heuristic::lnk-js-extension",
            "l": 4
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "LNK working directory is System32",
            "e": [
              "25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52 00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/conhost-curl::working-directory-system32",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies scripting artefacts in shortcut (LNK) files.",
            "e": [
              ".js",
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/script_in_lnk",
            "l": 4
          }
        ],
        "sha": "ee25d6efaaf9cfcea1a6bc65e32cf8654642c3c5eedebb466dd149b0424261c0",
        "path": "ee25d6efaaf9cfcea1a6bc65e32cf8654642c3c5eedebb466dd149b0424261c0.lnk",
        "type": "lnk"
      }
    ],
    "tv": "85efb"
  }
}