{ "llm": { "conf": 0.99300003, "grade": "hostile", "model": "Qwen/Qwen3.6-27B", "outcome": "hostile", "interpretation": "ISO contains .NET reflection loader" }, "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.9650319, "rte": "az", "prob": 0.9650319 } ], "prob": 0.99, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9900000095367432, "type": "iso" } ], "version": "v18.18", "analyzed_at": "2026-08-02T17:54:55Z" }, "path": "eeba7a843ff95e803376996104be47346dfaf9e651723cc088e5caafed86ab77.iso", "raw": { "v": "8", "files": [ { "id": 0, "ctx": [ { "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!8wGTxioDUDRxLzB8x(mMaph+k*w[+:-BzkVharS@I000000000k0rr91009=l000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c[RQ7BQ6S0SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao", "n": [ { "c": 5, "d": "ISO .NET reflection resource loader", "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "o": 32769, "z": 5, "cf": 0.9900000095367432 } ], "ln": 32641 }, { "b": "0T6brd3T\u0026l1}}aB5D\u003cHE000ut2Ovs[5^0BL000cm0spfH0rrFV3m!%N2YD4g017m=5D)3s0rrDv@SsUK7avPh015Yiz\u003cHF83u53c0160IQYyD55D)3s0rrEBjokA?5D)3F0rrGa1qq7N2}Mh]3m=nW7yzU)1$xPMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn5o[fPbyPQ)E0tR\u003eg+X[fbu5Y8x(mN800000U=4K4p-PJobumUx0lb0s5c8Xgbs+:9l\u0026Wh!5xjXIH-3f)bsli+vGlxd000000SSi3s0a\u003cU2{fcE0qVZL02tLm0rr91\u0026q-\u0026TfAq7M]z!\u003c\u003eMi43^V\u0026Hdb0@@r3R#V\u003e#1][S6pZ3?0wDhYg0@@r33\u0026*nca]?Py+M4RyB].Ny0@@r36951j0rr912MK\u002683ig5a6-Xjl1POJ57YTKo0SSi2007W:0rr91000i62Op\u003e#1{1Pkzx/t=\u003emapj", "n": [ { "c": 5, "d": "ISO stages a .NET resource payload", "i": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "o": 119460, "z": 4, "cf": 0.9900000095367432 } ], "ln": 119332 }, { "b": "wO#PQv@#B6zu97kByw6=Cr].Xx(v\u003e?nP5SYA:-E1x(v\u003e?xjVf(rb#z+B75N2x(v\u003e?B7GD2rb#z+B75N2x(v\u003e?nKN2!A:-\u003cbvpKy[z/bLNACOP{vqZc{v@#B6zu91mxk8l.A:-\u003cbvpKy[z/bLZBAg/cB75N2x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zuarXBydyNzeAZ0wj7oKy?m9#x(v\u003e?nP5l:lVl*UvqYQyz!%l3v@#B6zua3Nz/6u1zE=aMy\u00260V)BzkVh07pmqvn{VAy?k$Ly\u00260V)BzkVh07pmqvn{VAy?lsHAbYJexg3PNy?m9#x(v\u003e?l$7gClVl^-zeJ6RAbYJexg3PNy?m9#x(v\u003e?lVl\u003c:A=k+Yz!%l3v@#B6zu97kByvKPy\u0026%PjlVl^SwN/*@z/bLyvrt{FA+P5+x\u003eqGQz!%MkzBntUy?m9#x(v\u003e?l$7gCqE%VMBzkVhlVl^SwN/*@z/bLNACODWA:-/@By/FWzV", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 157198, "z": 17, "cf": 0.9399999976158142 } ], "ln": 157070 }, { "b": "lVl*Xvrb{UzVAdyAcUA307g)BBAIRnnP5cU08)DHx\u003c\u003e*(Dsp]fz/ec:w]vV-zF0!!ltpKUvq(iny?m9#A=k\u0026fv{:p\u003cz/tX$wPRoUvpAeSz/tXzy?m3}0cqZ[uR\u003efLB9zLywj73sASxS\u003c0cqZ[uQOsAvngrIvR6MWnP5Y\u0026yH{jKzdm6%07gBhv@1[Oz/fbYB.$P0ASyf5A.{B/zE(N=zdm6%08)(Nl$7gCqE%oEwPv=tCX7xcBy!uYvpS}\u002608)#Wx(mMYwNPaXASxiUy/j?MwmY=Ysz.\u003eNwQ5q{wNPaXASyb\u003evpS}\u00260bV7eAbXPZygQ)%p\u0026ZF$x\u003eg^}0bV7yB7Gw/vRPE:BwN0@C4\u003eF#ASx@-lVl*XB-.hnpHX6Iv@$K/z*2\u00269wPv=/uRL/EwNXOHA=#ebwPHTRygQ)%p\u0026ZF$x\u003eg^}0bV7qC$8Z)zf5GZygQ)%p\u0026ZF$x\u003eg^}08v9HqG3+GA=k!YB.LV5wPv=svrt{Qz*aJ\u003cx(4r\u003eASxM\u003ex(4r\u003eASye(zE^s0077yqwmY=YxjVf(rD8FSBy!l*wmY=YB7GD2rD8FSBy!l*wmY=YuV*r#vru6RA+5:40bV7yB7Gx0z/Px1ASx--Bye3?wPzc@A+5:40cqZ[uSzeUA:J:9wmY=YxjVf(qE%]/B-H#6o\u003c}{FxjV8-raflLwKf\u003cnAcbVio\u003c}{FxjV8-vpS[WwjQcDwnC*$07gWvy?m9#x(v(RxKL^\u003ewKQ=NzGFATzE^M{ASxJUwm6z1z!0MXz*aMZvqYZ?mrSlWBvY?TwnC*$07pmqvmLuLwl9zQCsb}Ty^\u0026IUzGFATzE^M{ASxcGy?WA*BzkVhmrSlWBvY?TwnC*$08)MNByYrlzBF.WzGFATzE^M{ASw{Ax(n2YC4CMknmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!nKEAlByw)3wPv=HwO+%RwObH]wO#0?lVl*Xvrb}10b2\u003e+uSzeUASx3Ty/1K", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 158117, "z": 12, "cf": 0.9399999976158142 }, { "c": 3, "d": ".NET resource loader marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-resource-loader", "o": 158501, "z": 15, "cf": 0.949999988079071 } ], "ln": 157989 }, { "b": "C%=H!AclnlASye(Bydvyv@2Z$z/]@dlVl^VASye(BydHQA+dQRy\u0026ss]B7GD2lsBwtlVl^VASye(Bye3?wMAI^BZY8+BA}XllsBwtlVl^VASx3HBwN0@ygQ)%mriA!ASwW1zGP/cA::6dASwQvBvy7\u0026zdN-@Bz(g1l1t1JC42GhASv.4Bz(g1e[nykz/L?Lz/fohz/L?Rv}YB\u003cvrhAED2[7sz7Xj\u003cvp%E@B98baA@Y\u0026:Bye9-wod-Bx\u003e8g4B8LVje((XcBZY8Mvrlc)e\u003c%n]x\u003e7Z}0b2\u003e+uSQ/Fq!o#)x\u003e7Z}08m-uwNXOHA=#ebwPE\u0026Cx\u003e8g4B8LVje((XcBZY8Mvrlc)e\u003cTC}y?Wx/BzkVhq!o#)x\u003e7Z}08[e:By/qwqGV(0x(dAlnP5SYA=k[}wPz%dv}xYYo\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv\u003eHb!ze:i9wPyZXA=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXAS", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 159135, "z": 9, "cf": 0.9399999976158142 } ], "ln": 159007 }, { "b": "fGq6qq*ACawO\u003c4$wPI^jA:@W4e(D?fBzkP6qE%]/B-H#6q!p4L00000000000000}k$1Knl@pk\u003c005m#2lj-700000006gp2lj-D0000000000000000000000000005Xb2lj-70000000000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000SS=i001bw0dU)^002*}0dU4H0000000000000000rrc2001$U0dU4H0000000000000000rr91004JH000000000000000000000rrc2003Wj0dU4H0000000000000000rr91000c8005a@2ln\u0026F00000000000049ygYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006X", "n": [ { "c": 3, "d": "Embedded .NET runtime string marker", "i": "metadata/file/format/structured::embedded-dotnet-runtime-string", "o": 561582, "z": 11, "cf": 0.9599999785423279 } ], "ln": 561454 } ], "mol": "O₂(AsC)Md", "sha": "eeba7a843ff95e803376996104be47346dfaf9e651723cc088e5caafed86ab77", "path": "eeba7a843ff95e803376996104be47346dfaf9e651723cc088e5caafed86ab77.iso", "risk": 239, "size": 565248, "type": "iso", "facts": { "metrics": { "file": { "size": 565248.0, "entropy": 7.22, "size_bytes": 565248.0 }, "binary": { "overall_entropy": 7.22, "peak_region_bytes": 377856.0, "peak_region_entropy": 7.85 } } }, "traits": [ { "id": "metadata/file/format/iso::iso-dotnet-metadata-marker", "conf": 0.9900000095367432, "crit": 3, "desc": ".NET metadata signature marker", "spans": [ [ 119460, 4 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-resource-loader", "conf": 0.949999988079071, "crit": 3, "desc": ".NET resource loader marker in opaque content", "spans": [ [ 158501, 15 ] ] }, { "id": "metadata/file/format/structured::primary-volume-descriptor", "conf": 1.0, "crit": 2, "desc": "ISO-9660 primary volume descriptor marker", "spans": [ [ 32769, 5 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "conf": 0.9399999976158142, "crit": 3, "desc": ".NET reflection marker in opaque content", "spans": [ [ 157198, 17 ], [ 158117, 12 ], [ 159135, 9 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-runtime-string", "conf": 0.9599999785423279, "crit": 3, "desc": "Embedded .NET runtime string marker", "spans": [ [ 561582, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO .NET reflection resource loader", "spans": [ [ 32769, 5 ], [ 119460, 4 ], [ 157198, 17 ], [ 158117, 12 ], [ 158501, 15 ], [ 159135, 9 ] ] }, { "id": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO stages a .NET resource payload", "spans": [ [ 32769, 5 ], [ 119460, 4 ], [ 157198, 17 ], [ 158117, 12 ], [ 158501, 15 ], [ 159135, 9 ], [ 561582, 11 ] ] } ] } ] } }