{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9815003871917725,
        "class": 1
      }
    ],
    "prob": 0.9815004,
    "class": 1,
    "oprob": 0.84433275,
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-05-01T19:23:50Z"
  },
  "path": "f2b37d74215ba03828d877a7e2f59a6c1911db979e42caca16aa276ff94ed9ac.xls",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Ag₂)",
        "x": 82,
        "id": 0,
        "sz": 515072,
        "ts": [
          {
            "a": "T1059.005",
            "c": 1.0,
            "d": "OLE2 document contains VBA macros (0 modules: )",
            "i": "metadata/format/macro::ole2-has-vba",
            "l": 4
          },
          {
            "c": 1.0,
            "d": "StdOleLink (external link) (CLSID: 00000300-0000-0000-c000-000000000046) on /MBD00413DC8",
            "i": "metadata/format/clsid::dangerous-clsid",
            "l": 4
          },
          {
            "c": 0.9399999976158142,
            "d": "VBA project metadata block",
            "e": [
              "CMG=\"ADAF7527B5C3B9C3B9C3B9C3B9\"\r\nDPB=\"4D4F9587952696269626\"\r\nGC=\"EDEF35677506760676F9\""
            ],
            "i": "metadata/document/ole::vba-project-metadata",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor → base64",
            "e": [
              "\u003cbinary data\u003e \u003cxor+base64\u003e"
            ],
            "i": "metadata/encoded-payload/xor-base64",
            "l": 3
          }
        ],
        "sha": "f2b37d74215ba03828d877a7e2f59a6c1911db979e42caca16aa276ff94ed9ac",
        "path": "HEUR-Trojan.OLE2.UrcBadur.genw-f2b37d74215ba03828d877a7e2f59a6c1911db979e42caca16aa276ff94ed9ac",
        "type": "xls"
      }
    ],
    "tv": "feb13"
  }
}