{ "llm": { "conf": 0.99300003, "grade": "hostile", "model": "Qwen/Qwen3.6-27B", "outcome": "hostile", "interpretation": "ISO contains .NET reflection loader" }, "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.96157146, "rte": "az", "prob": 0.96157146 } ], "prob": 0.99, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9900000095367432, "type": "iso" } ], "version": "v18.18", "analyzed_at": "2026-08-02T19:51:09Z" }, "path": "f5fdfd64ee35404d0971d347d2e8172de0ceadb989171a2c1215ba89c0b8252f.iso", "raw": { "v": "8", "files": [ { "id": 0, "ctx": [ { "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^ZfFUsohzW3]fFCpqarR^HarR^HarR^HarR^HarR^b000000001=00000005t=000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c!X?03r%00SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao", "n": [ { "c": 5, "d": "ISO .NET reflection resource loader", "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "o": 32769, "z": 5, "cf": 0.9900000095367432 } ], "ln": 32641 }, { "b": "%40a?%5x3#%2q81%nJoMyxatmb((:Hniu0O6=SlPwOG:+aZ0q-aw!otv1Fx(S{OT[w6%M2FF6J+l)kVx3!0eA(7%sqT=aFLlm#igAQzd]7*3I\u003eZ*uxF-Eazs%b-=ezjb^pd5nXLUdSJBRF5x#R89qjMfbDJ^\u003c)0Ilq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnfC1i:byPQ)OdCV201n\u0026cbu5Y8x(mN800000Oe.IeHYNLRbumUxbP^0^5c8Xgbs+:9l\u0026Wh!g-(X$-0chwbsli+vGlxd000000SSi3r#4Co2[3.k09Vf002tLm0rr91qVD^$5Dz!heDt+JpYHE}z#Y\u003erLk\u003eN.5Dz!hbME/A0rr910SSi20SSi20SSi20rr911onA40rr912lj-70SSi2004#Z0rr91000i6jQHrQ1]@]K\u003eMId\u003c@r.V\u003e1]#\u003cN!D=GZ^*a.j3im{z?uje=.3n:01]$4)", "n": [ { "c": 5, "d": "ISO stages a .NET resource payload", "i": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "o": 124243, "z": 4, "cf": 0.9900000095367432 } ], "ln": 124115 }, { "b": "lVNr\u003cxAg+nBz7U!wPRoXx\u003ehs009St%okFixx(Oxix-H[tCw*@906$WKzEV4xy\u00260M?v}#6OvqG:?vpK6Ml$G\u003eAvrb{Mz!0i(07pygx(mGQvpA!:08l)xyFneCwO.upwPQ:.CX7W\u003elT:!E07ggjwo*K.B-RjGwnD5Zm}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2!iWBydvyB7Fo(A+eV@07g^LAcc1%BAg@3z2^pwzeTDuq/)4\u003evqM0SwPRoJBy/p?q*ACawO?ACD2mzfBAh89l2pgLA+PSez2^anB7^\u003cQxk.*8BzbH\u003ezexnAlVND\u003eBz\u003ec0vqZc#z/PW{qE%oElt{^UwNPDRo\u003e!FBl2Z^hz/5]%zuarXBydyTA=L-eBvp4:vqfPVnP5SYA:-E1x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zua-?Byd\u003c.B7]-gz/bLDzGYD8x\u003eg1UwPzj3x(v(TCW\u003er7BzkVh08)#Wx(mMJz/6D4A+PPkzu9yxBzbP6nP5cU07gWxB98CBv@#TfnP5cU077ywzddw-q/32Rz#-msvr8utzGY@lwLD-MvR6MWltpsCA^pL]vpS}\u002608(AOf*/#bAcc1%wPz%dv}wFSz*2\u00269wPv=Gq:A=\u003eD2N\u003ezq!o#)x\u003e7ZJA=lbnwmY=Yl}73wA^qRCz=pj/C4\u003eC$p\u0026ZF$x\u003eg^}08m3DxM4AFB.LV5wPv=Bz!a0bwKpJNy?d9$091k.wKpJNy?d9$08drvvqFnMx(4r\u003eASw{AA:-/@By/FVB.LV5wPv=pB8$]fvR*rRB.LV5wPv=qx(mD)ASwBGw[CQ{08^xHz/{8gwLDPJvp%d(08N9AvqPN$wPyH-wnbT\u0026wPv=swObT]wL=/QvqPN$wPv=Mz/L?Bz!%uj07QQxnLzS=zE)\u0026%Bz(g1e[o0wASv.4v@#Tf07QQxlVl\u003c-BAhIlBz(g1lVM:DBy^\u003cKv@=\u003clBz(g1oK@i^ASx3-B97#ge\u003c%zZxkRTeBzkla08[e:By/qwqGV(0x(dAlnP5SYA=k[}wPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs!z/6Dcy?mS=wPz%dv}xYYq*ACawO\u003c4$wPI^jA:@W408EM3z!9B207pycB.tu3zF8WZwmY/Zo\u003ewAWz!8dQBAh88B-.ho091k.wKgAW", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 130123, "z": 17, "cf": 0.9399999976158142 }, { "c": 3, "d": ".NET resource loader marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-resource-loader", "o": 129931, "z": 25, "cf": 0.949999988079071 } ], "ln": 129803 }, { "b": "Cw?Iqellt5B7]Mgj:5UmfAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdKnhpdnb8mSI{OwP@6kyALCp0rr91005$e0000000000006:A0000w0000000000000000000000000006mm0000000000uQF:Ll#lWlvqfPVzf6i9A+e/mwnD5Z00000%0mT/01Ybg0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Embedded .NET runtime string marker", "i": "metadata/file/format/structured::embedded-dotnet-runtime-string", "o": 134025, "z": 11, "cf": 0.9599999785423279 } ], "ln": 133897 } ], "mol": "O₂(AsC)Md", "sha": "f5fdfd64ee35404d0971d347d2e8172de0ceadb989171a2c1215ba89c0b8252f", "path": "f5fdfd64ee35404d0971d347d2e8172de0ceadb989171a2c1215ba89c0b8252f.iso", "risk": 239, "size": 309248, "type": "iso", "facts": { "metrics": { "file": { "size": 309248.0, "entropy": 6.48, "size_bytes": 309248.0 }, "binary": { "overall_entropy": 6.48, "peak_region_bytes": 149504.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "metadata/file/format/iso::iso-dotnet-metadata-marker", "conf": 0.9900000095367432, "crit": 3, "desc": ".NET metadata signature marker", "spans": [ [ 124243, 4 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-resource-loader", "conf": 0.949999988079071, "crit": 3, "desc": ".NET resource loader marker in opaque content", "spans": [ [ 129931, 25 ], [ 130444, 15 ] ] }, { "id": "metadata/file/format/structured::primary-volume-descriptor", "conf": 1.0, "crit": 2, "desc": "ISO-9660 primary volume descriptor marker", "spans": [ [ 32769, 5 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "conf": 0.9399999976158142, "crit": 3, "desc": ".NET reflection marker in opaque content", "spans": [ [ 130123, 17 ], [ 130242, 12 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-runtime-string", "conf": 0.9599999785423279, "crit": 3, "desc": "Embedded .NET runtime string marker", "spans": [ [ 134025, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO .NET reflection resource loader", "spans": [ [ 32769, 5 ], [ 124243, 4 ], [ 129931, 25 ], [ 130123, 17 ], [ 130242, 12 ], [ 130444, 15 ] ] }, { "id": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO stages a .NET resource payload", "spans": [ [ 32769, 5 ], [ 124243, 4 ], [ 129931, 25 ], [ 130123, 17 ], [ 130242, 12 ], [ 130444, 15 ], [ 134025, 11 ] ] } ] } ] } }