{
  "llm": {
    "conf": 0.99300003,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "NSIS installer with PDF lure"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9440308,
        "rte": "az",
        "prob": 0.9440308
      }
    ],
    "prob": 0.99,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.9900000095367432,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T04:04:12Z"
  },
  "path": "f2d7dfcb2bd94c6c4fb1dea6d3b92835034c319ea6c47a10749bf10e557d0af5.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!4mopQcqBA@KeLY8sgbgKAfD-58h8N9Fi5JAAeo2b1000000001B0rr9100dxC000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c[UM2PLt$0SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao",
            "n": [
              {
                "c": 5,
                "d": "ISO NSIS order/PDF lure with high-entropy executable content",
                "i": "objectives/anti-static/pack/archive::iso-nsis-order-pdf-packed-loader",
                "o": 32769,
                "z": 5,
                "cf": 0.9900000095367432
              }
            ],
            "ln": 32641
          },
          {
            "b": "0000000000000000000000000000000000y02$$s000008#{lA000080c[UM2PLG20SSi30003203Ry.00000000#s2MK\u0026800\u0026NI0%]kMf9zsR009610rAi\u003c03hau000009)rBF000w-+xTf@2PtG4000010003CpdnkbpF%OHqy$Ttq8f\u003cYiwqNfgbQ{zi5\u0026=IfF33*mLmbimf0q/00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 4,
                "d": "Order-themed PDF executable lure member",
                "i": "metadata/file/format/structured::embedded-order-pdf-exe-lure",
                "o": 57445,
                "z": 37,
                "cf": 0.949999988079071
              }
            ],
            "ln": 57317
          },
          {
            "b": "jTb2?zAq\u0026GxK#3?B1Ilyv@=Hez!s8yv@DiBvrlorB$\u003ef-zddr@w[u49r+lq)x(v(La#7Y7b0Fa$B8$]fvR*rYwmYU2x([RyC4CYnx(v(La#7Y7e?![ia%p\u0026Bz!0v1B8M7+A:@=%By!%7B-I4Rb3l/.a%p=izdL\u003cOpiyw?B8LVje(2tpq.zTawOtT-wfJdrD2NsTb6N:sgCQdck0iv!B7ol8Acb/jzAZ*ry\u00261fhw]]d!zGx]dy?$j)D2[7sz6j0Se\u0026tvCfjXTnv@=p5BzkVhk0i}cB-RT@zF0/fCX}nmB3gZ\u0026A=9{Vv}YB\u003cvrj2qx\u003e8g4B8LVjeN@Zoi:)8De{o2{k0i)$v%8*aBA{5jA+flkwPI%8wkEqXC4\u003e=7xjVcFjAt1MB.bSowN[kOwN/\u003e8x(v(.wP?T3az+RjwO:HNvrk1TC5IecAV#SGx*DlswPI]Qb4+n1B7DKGk0gGswPq\u003c7B97#7p\u0026Zn[x(4u[wPH3$flpYmB-IhrC%jtzBAhIBBn",
            "n": [
              {
                "c": 3,
                "d": "Embedded Nullsoft NSIS installer marker",
                "i": "metadata/file/format/structured::embedded-nsis-marker",
                "o": 270818,
                "z": 21,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 270690
          },
          {
            "b": "AbY-oBy!#UqY[UxjTbk:gb7Bqg=mizf/p^CeI]m[h7-k]w[rLFfGrPOwO0VdgIes?a$(bxfjw*sy?Wx/BzkVhk0gGdz/6D4Bzkh#y?X0pk0gGbB8$]fvR*rN0000000000000000000000000000001onA4[4L{Xpiyw?B8LVjnP5P\u003eIY@c3+C$\u003cFmG@\u003cyt(T\u003eP002m:fA($z0%8DetFHgD\u003cfCz!H[?F=sIn!?5C\u003eVOvN!MMp\u0026QYb*HN)TkNg]m4U6!i\u0026SDKqFYV@{z-+NN\u0026qUJN%bh=5EMdA()n39Esztv0!QFO\u003e9]X\u00266EO4/P{!dTjAtYA8fW^NX=*nhV\u0026+km[FtPNVk6Qtt^9C*iONr3ET).siTn5\u003cGPOHIu.4Keh\u003e\u003c--IKOd3YvLGflejBU+:aI\u0026c{UKKgM!ieCZdK%30BgS$Xa)T@l#vY)ka[b\u0026H:fkTUJu96!Es*-co1XaIc]-!H$SNW)PA{-vxX@WP+$\u0026$jB%qA0m6$9",
            "n": [
              {
                "c": 3,
                "d": "Embedded Nullsoft NSIS installer marker",
                "i": "metadata/file/format/structured::embedded-nsis-marker",
                "o": 271368,
                "z": 12,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 271240
          }
        ],
        "mol": "O(As)Md",
        "sha": "f2d7dfcb2bd94c6c4fb1dea6d3b92835034c319ea6c47a10749bf10e557d0af5",
        "path": "/tmp/cyclotron-84182ac0/samples/f2d7dfcb2bd9/f2d7dfcb2bd94c6c4fb1dea6d3b92835034c319ea6c47a10749bf10e557d0af5.iso",
        "risk": 157,
        "size": 774144,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 774144.0,
              "entropy": 7.12,
              "size_bytes": 774144.0
            },
            "binary": {
              "overall_entropy": 7.12,
              "peak_region_bytes": 510976.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::primary-volume-descriptor",
            "conf": 1.0,
            "crit": 2,
            "desc": "ISO-9660 primary volume descriptor marker",
            "spans": [
              [
                32769,
                5
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-order-pdf-exe-lure",
            "conf": 0.949999988079071,
            "crit": 4,
            "desc": "Order-themed PDF executable lure member",
            "spans": [
              [
                57445,
                37
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-nsis-marker",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "Embedded Nullsoft NSIS installer marker",
            "spans": [
              [
                270818,
                21
              ],
              [
                271368,
                12
              ]
            ]
          },
          {
            "id": "objectives/anti-static/pack/archive::iso-nsis-order-pdf-packed-loader",
            "atk": "T1036.005,T1027,T1204.002",
            "conf": 0.9900000095367432,
            "crit": 5,
            "desc": "ISO NSIS order/PDF lure with high-entropy executable content",
            "spans": [
              [
                32769,
                5
              ],
              [
                57445,
                37
              ],
              [
                270818,
                21
              ],
              [
                271368,
                12
              ]
            ]
          }
        ]
      }
    ],
    "fetched": [
      {
        "kind": "url_fetch",
        "cached": false,
        "locator": "http://nsis.sf.net/NSIS_Error",
        "outcome": {
          "failed": "refused: non-https scheme: http"
        },
        "fetched_at": 1785643451,
        "resolved_url": "http://nsis.sf.net/NSIS_Error",
        "source_offset": 0,
        "source_sha256": "f2d7dfcb2bd94c6c4fb1dea6d3b92835034c319ea6c47a10749bf10e557d0af5"
      }
    ]
  }
}