{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/documents", "prob": 1.0, "class": 0 }, { "m": "az/xlsx", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T06:04:08Z" }, "path": "f9fdec54e703a9bb6d95c49d2d20ead4f1096ddff57ff7b1672ecc6f8d765797.xlsm", "raw": { "v": "5", "fs": [ { "f": "Md(Ag)", "x": 1, "ff": { "m": { "file": { "size": 377877.0, "entropy": 7.91, "size_bytes": 377877.0 }, "office": { "macro_count": 1.0, "ooxml.entry_count": 77.0, "ooxml.max_entry_size": 437248.0, "custom_ui_onload_count": 1.0, "ooxml.image_part_count": 2.0, "is_macro_enabled_extension": 1.0, "ooxml.declares_vba_project": 1.0, "ooxml.declares_macro_enabled": 1.0 }, "archive": { "file_count": 77.0, "member_count": 77.0, "script_count": 0.0, "zip_bomb_ratio": 15.33, "directory_count": 0.0, "executable_count": 12.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 362758.0, "compression.ratio": 0.28, "hidden_file_count": 1.0, "total_uncompressed": 1281375.0, "crc_collision_count": 8.0, "entry_comment_count": 0.0, "max_filename_length": 40.0, "rtlo_filename_count": 0.0, "format.regular_count": 77.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.01, "misplaced_executable_count": 12.0, "timing.mtime_dominant_count": 77.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 4.0, "compression.method_counts.deflate": 73.0 } }, "v": { "file.stem": "f9fdec54e703a9bb6d95c49d2d20ead4f1096ddff57ff7b1672ecc6f8d765797", "office.kind": "xlsx", "file.basename": "f9fdec54e703a9bb6d95c49d2d20ead4f1096ddff57ff7b1672ecc6f8d765797.xlsm", "office.company": "HM Revenue and Customs", "office.created": "2018-05-09T09:00:30Z", "office.creator": "3839532", "office.modified": "2024-02-28T15:42:00Z", "office.macros[0]": "xl/vbaProject.bin", "office.application": "Microsoft Excel", "office.features[0]": "macros", "office.features[1]": "custom_ui_onload", "archive.format.kind": "zip", "archive.members[0].path": "[Content_Types].xml", "archive.members[1].path": "_rels/.rels", "archive.members[2].path": "xl/workbook.xml", "archive.members[3].path": "xl/_rels/workbook.xml.rels", "archive.members[4].path": "xl/worksheets/sheet1.xml", "archive.members[5].path": "xl/worksheets/sheet2.xml", "archive.members[6].path": "xl/worksheets/sheet3.xml", "archive.members[7].path": "xl/worksheets/sheet4.xml", "archive.members[8].path": "xl/worksheets/sheet5.xml", "archive.members[9].path": "xl/worksheets/sheet6.xml", "office.last_modified_by": "Hardy, Max (COD)", "archive.members[0].crc32": 1334281829, "archive.members[10].path": "xl/worksheets/sheet7.xml", "archive.members[11].path": "xl/worksheets/sheet8.xml", "archive.members[12].path": "xl/worksheets/sheet9.xml", "archive.members[13].path": "xl/worksheets/sheet10.xml", "archive.members[14].path": "xl/worksheets/sheet11.xml", "archive.members[15].path": "xl/theme/theme1.xml", "archive.members[16].path": "xl/styles.xml", "archive.members[17].path": "xl/sharedStrings.xml", "archive.members[18].path": "xl/drawings/_rels/drawing2.xml.rels", "archive.members[19].path": "xl/worksheets/_rels/sheet4.xml.rels", "archive.members[1].crc32": 3926345726, "archive.members[20].path": "xl/vbaProject.bin", "archive.members[21].path": "xl/drawings/drawing1.xml", "archive.members[22].path": "xl/media/image1.jpeg", "archive.members[23].path": "xl/worksheets/_rels/sheet1.xml.rels", "archive.members[24].path": "xl/worksheets/_rels/sheet2.xml.rels", "archive.members[25].path": "xl/worksheets/_rels/sheet3.xml.rels", "archive.members[26].path": "xl/worksheets/_rels/sheet5.xml.rels", "archive.members[27].path": "xl/worksheets/_rels/sheet6.xml.rels", "archive.members[28].path": "xl/worksheets/_rels/sheet7.xml.rels", "archive.members[29].path": "xl/worksheets/_rels/sheet8.xml.rels", "archive.members[2].crc32": 3696794243, "archive.members[30].path": "xl/drawings/drawing2.xml", "archive.members[31].path": "xl/media/image2.png", "archive.members[32].path": "xl/worksheets/_rels/sheet9.xml.rels", "archive.members[33].path": "xl/worksheets/_rels/sheet10.xml.rels", "archive.members[34].path": "xl/worksheets/_rels/sheet11.xml.rels", "archive.members[35].path": "xl/drawings/_rels/drawing1.xml.rels", "archive.members[36].path": "xl/printerSettings/printerSettings1.bin", "archive.members[37].path": "xl/printerSettings/printerSettings2.bin", "archive.members[38].path": "xl/printerSettings/printerSettings3.bin", "archive.members[39].path": "xl/printerSettings/printerSettings4.bin", "archive.members[3].crc32": 4218354943, "archive.members[40].path": "xl/printerSettings/printerSettings5.bin", "archive.members[41].path": "xl/printerSettings/printerSettings6.bin", "archive.members[42].path": "xl/printerSettings/printerSettings7.bin", "archive.members[43].path": "xl/printerSettings/printerSettings8.bin", "archive.members[44].path": "xl/printerSettings/printerSettings9.bin", "archive.members[45].path": "xl/printerSettings/printerSettings10.bin", "archive.members[46].path": "xl/printerSettings/printerSettings11.bin", "archive.members[47].path": "xl/calcChain.xml", "archive.members[48].path": "customXml/item1.xml", "archive.members[49].path": "customXml/itemProps1.xml", "archive.members[4].crc32": 1930804326, "archive.members[50].path": "customXml/item2.xml", "archive.members[51].path": "docProps/custom.xml", "archive.members[52].path": "customXml/itemProps3.xml", "archive.members[53].path": "customXml/item3.xml", "archive.members[54].path": "[trash]/0000.dat", "archive.members[55].path": "customXml/itemProps5.xml", "archive.members[56].path": "customXml/item6.xml", "archive.members[57].path": "customXml/itemProps2.xml", "archive.members[58].path": "customXml/itemProps6.xml", "archive.members[59].path": "customXml/item7.xml", "archive.members[5].crc32": 996025484, "archive.members[60].path": "customXml/itemProps7.xml", "archive.members[61].path": "customXml/item8.xml", "archive.members[62].path": "customXml/itemProps8.xml", "archive.members[63].path": "customXml/itemProps4.xml", "archive.members[64].path": "docProps/core.xml", "archive.members[65].path": "docProps/app.xml", "archive.members[66].path": "customXml/item4.xml", "archive.members[67].path": "customXml/_rels/item1.xml.rels", "archive.members[68].path": "customXml/_rels/item2.xml.rels", "archive.members[69].path": "customXml/_rels/item3.xml.rels", "archive.members[6].crc32": 737397618, "archive.members[70].path": "customXml/_rels/item4.xml.rels", "archive.members[71].path": "customXml/_rels/item5.xml.rels", "archive.members[72].path": "customXml/_rels/item6.xml.rels", "archive.members[73].path": "customXml/_rels/item7.xml.rels", "archive.members[74].path": "customXml/_rels/item8.xml.rels", "archive.members[75].path": "customUI/customUI14.xml", "archive.members[76].path": "customXml/item5.xml", "archive.members[7].crc32": 3887090772, "archive.members[8].crc32": 1784601318, "archive.members[9].crc32": 1942625429, "archive.timing.mtime_max": 315532800, "archive.timing.mtime_min": 315532800, "archive.members[10].crc32": 224346698, "archive.members[11].crc32": 1441960673, "archive.members[12].crc32": 1151471713, "archive.members[13].crc32": 2988238229, "archive.members[14].crc32": 980116087, "archive.members[15].crc32": 1483637387, "archive.members[16].crc32": 1230819880, "archive.members[17].crc32": 2902340648, "archive.members[18].crc32": 2431485191, "archive.members[19].crc32": 2735838787, "archive.members[20].crc32": 2319953825, "archive.members[21].crc32": 833798423, "archive.members[22].crc32": 2983104929, "archive.members[23].crc32": 1261595963, "archive.members[24].crc32": 321700883, "archive.members[25].crc32": 1217330486, "archive.members[26].crc32": 573895524, "archive.members[27].crc32": 2049595980, "archive.members[28].crc32": 4212080491, "archive.members[29].crc32": 404370594, "archive.members[30].crc32": 1504599060, "archive.members[31].crc32": 4096866280, "archive.members[32].crc32": 2571063685, "archive.members[33].crc32": 3131700353, "archive.members[34].crc32": 2124656995, "archive.members[35].crc32": 2249714429, "archive.members[36].crc32": 2876682412, "archive.members[37].crc32": 2876682412, "archive.members[38].crc32": 708780196, "archive.members[39].crc32": 708780196, "archive.members[40].crc32": 3242822336, "archive.members[41].crc32": 2406197245, "archive.members[42].crc32": 2406197245, "archive.members[43].crc32": 708780196, "archive.members[44].crc32": 708780196, "archive.members[45].crc32": 2876682412, "archive.members[46].crc32": 2876682412, "archive.members[47].crc32": 1917594601, "archive.members[48].crc32": 2759677399, "archive.members[49].crc32": 3675113291, "archive.members[50].crc32": 3275983743, "archive.members[51].crc32": 3690279528, "archive.members[52].crc32": 830437920, "archive.members[53].crc32": 776941934, "archive.members[54].crc32": 4294967295, "archive.members[55].crc32": 1311963278, "archive.members[56].crc32": 2035189638, "archive.members[57].crc32": 1553876709, "archive.members[58].crc32": 623842241, "archive.members[59].crc32": 776941934, "archive.members[60].crc32": 267004014, "archive.members[61].crc32": 4004895977, "archive.members[62].crc32": 290788030, "archive.members[63].crc32": 2628131331, "archive.members[64].crc32": 4069225618, "archive.members[65].crc32": 1655545322, "archive.members[66].crc32": 593659069, "archive.members[67].crc32": 2050572148, "archive.members[68].crc32": 573019740, "archive.members[69].crc32": 2734879611, "archive.members[70].crc32": 2451227660, "archive.members[71].crc32": 322937131, "archive.members[72].crc32": 1260455939, "archive.members[73].crc32": 3389287716, "archive.members[74].crc32": 689006317, "archive.members[75].crc32": 823350505, "archive.members[76].crc32": 1337557320, "archive.format.entry_types[0]": "regular", "archive.members[0].entry_type": "regular", "archive.members[0].mtime_unix": 315532800, "archive.members[0].size_bytes": 4367, "archive.members[1].entry_type": "regular", "archive.members[1].mtime_unix": 315532800, "archive.members[1].size_bytes": 885, "archive.members[2].entry_type": "regular", "archive.members[2].mtime_unix": 315532800, "archive.members[2].size_bytes": 4631, "archive.members[3].entry_type": "regular", "archive.members[3].mtime_unix": 315532800, "archive.members[3].size_bytes": 3516, "archive.members[4].entry_type": "regular", "archive.members[4].mtime_unix": 315532800, "archive.members[4].size_bytes": 2213, "archive.members[5].entry_type": "regular", "archive.members[5].mtime_unix": 315532800, "archive.members[5].size_bytes": 38882, "archive.members[6].entry_type": "regular", "archive.members[6].mtime_unix": 315532800, "archive.members[6].size_bytes": 4815, "archive.members[7].entry_type": "regular", "archive.members[7].mtime_unix": 315532800, "archive.members[7].size_bytes": 324235, "archive.members[8].entry_type": "regular", "archive.members[8].mtime_unix": 315532800, "archive.members[8].size_bytes": 19591, "archive.members[9].entry_type": "regular", "archive.members[9].mtime_unix": 315532800, "archive.members[9].size_bytes": 18645, "archive.compression.methods[0]": "deflate", "archive.compression.methods[1]": "stored", "archive.members[0].data_offset": 569, "archive.members[10].entry_type": "regular", "archive.members[10].mtime_unix": 315532800, "archive.members[10].size_bytes": 20496, "archive.members[11].entry_type": "regular", "archive.members[11].mtime_unix": 315532800, "archive.members[11].size_bytes": 10514, "archive.members[12].entry_type": "regular", "archive.members[12].mtime_unix": 315532800, "archive.members[12].size_bytes": 17332, "archive.members[13].entry_type": "regular", "archive.members[13].mtime_unix": 315532800, "archive.members[13].size_bytes": 5344, "archive.members[14].entry_type": "regular", "archive.members[14].mtime_unix": 315532800, "archive.members[14].size_bytes": 28210, "archive.members[15].entry_type": "regular", "archive.members[15].mtime_unix": 315532800, "archive.members[15].size_bytes": 6798, "archive.members[16].entry_type": "regular", "archive.members[16].mtime_unix": 315532800, "archive.members[16].size_bytes": 78536, "archive.members[17].entry_type": "regular", "archive.members[17].mtime_unix": 315532800, "archive.members[17].size_bytes": 28701, "archive.members[18].entry_type": "regular", "archive.members[18].mtime_unix": 315532800, "archive.members[18].size_bytes": 292, "archive.members[19].entry_type": "regular", "archive.members[19].mtime_unix": 315532800, "archive.members[19].size_bytes": 322, "archive.members[1].data_offset": 1709, "archive.members[20].entry_type": "regular", "archive.members[20].mtime_unix": 315532800, "archive.members[20].size_bytes": 437248, "archive.members[21].entry_type": "regular", "archive.members[21].mtime_unix": 315532800, "archive.members[21].size_bytes": 1713, "archive.members[22].entry_type": "regular", "archive.members[22].mtime_unix": 315532800, "archive.members[22].size_bytes": 18877, "archive.members[23].entry_type": "regular", "archive.members[23].mtime_unix": 315532800, "archive.members[23].size_bytes": 322, "archive.members[24].entry_type": "regular", "archive.members[24].mtime_unix": 315532800, "archive.members[24].size_bytes": 322, "archive.members[25].entry_type": "regular", "archive.members[25].mtime_unix": 315532800, "archive.members[25].size_bytes": 464, "archive.members[26].entry_type": "regular", "archive.members[26].mtime_unix": 315532800, "archive.members[26].size_bytes": 322, "archive.members[27].entry_type": "regular", "archive.members[27].mtime_unix": 315532800, "archive.members[27].size_bytes": 322, "archive.members[28].entry_type": "regular", "archive.members[28].mtime_unix": 315532800, "archive.members[28].size_bytes": 322, "archive.members[29].entry_type": "regular", "archive.members[29].mtime_unix": 315532800, "archive.members[29].size_bytes": 322, "archive.members[2].data_offset": 2069, "archive.members[30].entry_type": "regular", "archive.members[30].mtime_unix": 315532800, "archive.members[30].size_bytes": 1213, "archive.members[31].entry_type": "regular", "archive.members[31].mtime_unix": 315532800, "archive.members[31].size_bytes": 49658, "archive.members[32].entry_type": "regular", "archive.members[32].mtime_unix": 315532800, "archive.members[32].size_bytes": 322, "archive.members[33].entry_type": "regular", "archive.members[33].mtime_unix": 315532800, "archive.members[33].size_bytes": 465, "archive.members[34].entry_type": "regular", "archive.members[34].mtime_unix": 315532800, "archive.members[34].size_bytes": 323, "archive.members[35].entry_type": "regular", "archive.members[35].mtime_unix": 315532800, "archive.members[35].size_bytes": 293, "archive.members[36].entry_type": "regular", "archive.members[36].mtime_unix": 315532800, "archive.members[36].size_bytes": 8648, "archive.members[37].entry_type": "regular", "archive.members[37].mtime_unix": 315532800, "archive.members[37].size_bytes": 8648, "archive.members[38].entry_type": "regular", "archive.members[38].mtime_unix": 315532800, "archive.members[38].size_bytes": 8648, "archive.members[39].entry_type": "regular", "archive.members[39].mtime_unix": 315532800, "archive.members[39].size_bytes": 8648, "archive.members[3].data_offset": 3928, "archive.members[40].entry_type": "regular", "archive.members[40].mtime_unix": 315532800, "archive.members[40].size_bytes": 3128, "archive.members[41].entry_type": "regular", "archive.members[41].mtime_unix": 315532800, "archive.members[41].size_bytes": 8648, "archive.members[42].entry_type": "regular", "archive.members[42].mtime_unix": 315532800, "archive.members[42].size_bytes": 8648, "archive.members[43].entry_type": "regular", "archive.members[43].mtime_unix": 315532800, "archive.members[43].size_bytes": 8648, "archive.members[44].entry_type": "regular", "archive.members[44].mtime_unix": 315532800, "archive.members[44].size_bytes": 8648, "archive.members[45].entry_type": "regular", "archive.members[45].mtime_unix": 315532800, "archive.members[45].size_bytes": 8648, "archive.members[46].entry_type": "regular", "archive.members[46].mtime_unix": 315532800, "archive.members[46].size_bytes": 8648, "archive.members[47].entry_type": "regular", "archive.members[47].mtime_unix": 315532800, "archive.members[47].size_bytes": 26286, "archive.members[48].entry_type": "regular", "archive.members[48].mtime_unix": 315532800, "archive.members[48].size_bytes": 1801, "archive.members[49].entry_type": "regular", "archive.members[49].mtime_unix": 315532800, "archive.members[49].size_bytes": 235, "archive.members[4].data_offset": 4441, "archive.members[50].entry_type": "regular", "archive.members[50].mtime_unix": 315532800, "archive.members[50].size_bytes": 290, "archive.members[51].entry_type": "regular", "archive.members[51].mtime_unix": 315532800, "archive.members[51].size_bytes": 1760, "archive.members[52].entry_type": "regular", "archive.members[52].mtime_unix": 315532800, "archive.members[52].size_bytes": 235, "archive.members[53].entry_type": "regular", "archive.members[53].mtime_unix": 315532800, "archive.members[53].size_bytes": 992, "archive.members[54].entry_type": "regular", "archive.members[54].mtime_unix": 315532800, "archive.members[54].size_bytes": 2031, "archive.members[55].entry_type": "regular", "archive.members[55].mtime_unix": 315532800, "archive.members[55].size_bytes": 201, "archive.members[56].entry_type": "regular", "archive.members[56].mtime_unix": 315532800, "archive.members[56].size_bytes": 982, "archive.members[57].entry_type": "regular", "archive.members[57].mtime_unix": 315532800, "archive.members[57].size_bytes": 954, "archive.members[58].entry_type": "regular", "archive.members[58].mtime_unix": 315532800, "archive.members[58].size_bytes": 235, "archive.members[59].entry_type": "regular", "archive.members[59].mtime_unix": 315532800, "archive.members[59].size_bytes": 992, "archive.members[5].data_offset": 5488, "archive.members[60].entry_type": "regular", "archive.members[60].mtime_unix": 315532800, "archive.members[60].size_bytes": 235, "archive.members[61].entry_type": "regular", "archive.members[61].mtime_unix": 315532800, "archive.members[61].size_bytes": 1005, "archive.members[62].entry_type": "regular", "archive.members[62].mtime_unix": 315532800, "archive.members[62].size_bytes": 235, "archive.members[63].entry_type": "regular", "archive.members[63].mtime_unix": 315532800, "archive.members[63].size_bytes": 335, "archive.members[64].entry_type": "regular", "archive.members[64].mtime_unix": 315532800, "archive.members[64].size_bytes": 813, "archive.members[65].entry_type": "regular", "archive.members[65].mtime_unix": 315532800, "archive.members[65].size_bytes": 2099, "archive.members[66].entry_type": "regular", "archive.members[66].mtime_unix": 315532800, "archive.members[66].size_bytes": 219, "archive.members[67].entry_type": "regular", "archive.members[67].mtime_unix": 315532800, "archive.members[67].size_bytes": 296, "archive.members[68].entry_type": "regular", "archive.members[68].mtime_unix": 315532800, "archive.members[68].size_bytes": 296, "archive.members[69].entry_type": "regular", "archive.members[69].mtime_unix": 315532800, "archive.members[69].size_bytes": 296, "archive.members[6].data_offset": 9334, "archive.members[70].entry_type": "regular", "archive.members[70].mtime_unix": 315532800, "archive.members[70].size_bytes": 296, "archive.members[71].entry_type": "regular", "archive.members[71].mtime_unix": 315532800, "archive.members[71].size_bytes": 296, "archive.members[72].entry_type": "regular", "archive.members[72].mtime_unix": 315532800, "archive.members[72].size_bytes": 296, "archive.members[73].entry_type": "regular", "archive.members[73].mtime_unix": 315532800, "archive.members[73].size_bytes": 296, "archive.members[74].entry_type": "regular", "archive.members[74].mtime_unix": 315532800, "archive.members[74].size_bytes": 296, "archive.members[75].entry_type": "regular", "archive.members[75].mtime_unix": 315532800, "archive.members[75].size_bytes": 4839, "archive.members[76].entry_type": "regular", "archive.members[76].mtime_unix": 315532800, "archive.members[76].size_bytes": 11792, "archive.members[7].data_offset": 10947, "archive.members[8].data_offset": 53158, "archive.members[9].data_offset": 58060, "archive.members[10].data_offset": 62644, "archive.members[11].data_offset": 67673, "archive.members[12].data_offset": 70499, "archive.members[13].data_offset": 74861, "archive.members[14].data_offset": 76205, "archive.members[15].data_offset": 80582, "archive.members[16].data_offset": 82308, "archive.members[17].data_offset": 88255, "archive.members[18].data_offset": 95226, "archive.members[19].data_offset": 95481, "archive.members[20].data_offset": 95722, "archive.members[21].data_offset": 263346, "archive.members[22].data_offset": 264192, "archive.members[23].data_offset": 283134, "archive.members[24].data_offset": 283392, "archive.members[25].data_offset": 283651, "archive.members[26].data_offset": 283935, "archive.members[27].data_offset": 284194, "archive.members[28].data_offset": 284453, "archive.members[29].data_offset": 284713, "archive.members[30].data_offset": 284961, "archive.members[31].data_offset": 285635, "archive.members[32].data_offset": 335358, "archive.members[33].data_offset": 335619, "archive.members[34].data_offset": 335904, "archive.members[35].data_offset": 336164, "archive.members[36].data_offset": 336424, "archive.members[37].data_offset": 337418, "archive.members[38].data_offset": 338412, "archive.members[39].data_offset": 339404, "archive.members[40].data_offset": 340396, "archive.members[41].data_offset": 340669, "archive.members[42].data_offset": 341661, "archive.members[43].data_offset": 342653, "archive.members[44].data_offset": 343645, "archive.members[45].data_offset": 344638, "archive.members[46].data_offset": 345633, "archive.members[47].data_offset": 346604, "archive.members[48].data_offset": 350694, "archive.members[49].data_offset": 351176, "archive.members[50].data_offset": 351464, "archive.members[51].data_offset": 351969, "archive.members[52].data_offset": 352581, "archive.members[53].data_offset": 352866, "archive.members[54].data_offset": 353262, "archive.members[55].data_offset": 355646, "archive.members[56].data_offset": 355915, "archive.members[57].data_offset": 356348, "archive.members[58].data_offset": 356860, "archive.members[59].data_offset": 357145, "archive.members[60].data_offset": 357589, "archive.members[61].data_offset": 357875, "archive.members[62].data_offset": 358324, "archive.members[63].data_offset": 358618, "archive.members[64].data_offset": 359171, "archive.members[65].data_offset": 359909, "archive.members[66].data_offset": 360691, "archive.members[67].data_offset": 361159, "archive.members[68].data_offset": 361677, "archive.members[69].data_offset": 362196, "archive.members[70].data_offset": 362715, "archive.members[71].data_offset": 363234, "archive.members[72].data_offset": 363753, "archive.members[73].data_offset": 364272, "archive.members[74].data_offset": 364792, "archive.members[75].data_offset": 365068, "archive.members[76].data_offset": 369996, "archive.members[1].header_offset": 1148, "archive.members[2].header_offset": 2024, "archive.members[3].header_offset": 3608, "archive.members[4].header_offset": 4387, "archive.members[5].header_offset": 5434, "archive.members[6].header_offset": 9280, "archive.members[7].header_offset": 10893, "archive.members[8].header_offset": 53104, "archive.members[9].header_offset": 58006, "archive.members[10].header_offset": 62590, "archive.members[11].header_offset": 67619, "archive.members[12].header_offset": 70445, "archive.members[13].header_offset": 74806, "archive.members[14].header_offset": 76150, "archive.members[15].header_offset": 80533, "archive.members[16].header_offset": 82265, "archive.members[17].header_offset": 88205, "archive.members[18].header_offset": 95161, "archive.members[19].header_offset": 95416, "archive.members[20].header_offset": 95675, "archive.members[21].header_offset": 263292, "archive.members[22].header_offset": 264142, "archive.members[23].header_offset": 283069, "archive.members[24].header_offset": 283327, "archive.members[25].header_offset": 283586, "archive.members[26].header_offset": 283870, "archive.members[27].header_offset": 284129, "archive.members[28].header_offset": 284388, "archive.members[29].header_offset": 284648, "archive.members[30].header_offset": 284907, "archive.members[31].header_offset": 285586, "archive.members[32].header_offset": 335293, "archive.members[33].header_offset": 335553, "archive.members[34].header_offset": 335838, "archive.members[35].header_offset": 336099, "archive.members[36].header_offset": 336355, "archive.members[37].header_offset": 337349, "archive.members[38].header_offset": 338343, "archive.members[39].header_offset": 339335, "archive.members[40].header_offset": 340327, "archive.members[41].header_offset": 340600, "archive.members[42].header_offset": 341592, "archive.members[43].header_offset": 342584, "archive.members[44].header_offset": 343576, "archive.members[45].header_offset": 344568, "archive.members[46].header_offset": 345563, "archive.members[47].header_offset": 346558, "archive.members[48].header_offset": 350621, "archive.members[49].header_offset": 351082, "archive.members[50].header_offset": 351376, "archive.members[51].header_offset": 351657, "archive.members[52].header_offset": 352487, "archive.members[53].header_offset": 352781, "archive.members[54].header_offset": 353216, "archive.members[55].header_offset": 355293, "archive.members[56].header_offset": 355831, "archive.members[57].header_offset": 356254, "archive.members[58].header_offset": 356766, "archive.members[59].header_offset": 357060, "archive.members[60].header_offset": 357495, "archive.members[61].header_offset": 357789, "archive.members[62].header_offset": 358230, "archive.members[63].header_offset": 358524, "archive.members[64].header_offset": 358860, "archive.members[65].header_offset": 359599, "archive.members[66].header_offset": 360602, "archive.members[67].header_offset": 360835, "archive.members[68].header_offset": 361353, "archive.members[69].header_offset": 361872, "archive.members[70].header_offset": 362391, "archive.members[71].header_offset": 362910, "archive.members[72].header_offset": 363429, "archive.members[73].header_offset": 363948, "archive.members[74].header_offset": 364468, "archive.members[75].header_offset": 364987, "archive.members[76].header_offset": 369907, "office.custom_ui_onload[0].source": "customUI/customUI14.xml", "archive.members[0].compressed_size": 579, "archive.members[1].compressed_size": 315, "archive.members[2].compressed_size": 1539, "archive.members[3].compressed_size": 459, "archive.members[4].compressed_size": 993, "archive.members[5].compressed_size": 3792, "archive.members[6].compressed_size": 1559, "archive.members[7].compressed_size": 42157, "archive.members[8].compressed_size": 4848, "archive.members[9].compressed_size": 4530, "office.custom_ui_onload[0].on_load": "RibbonOnLoad", "archive.members[10].compressed_size": 4975, "archive.members[11].compressed_size": 2772, "archive.members[12].compressed_size": 4307, "archive.members[13].compressed_size": 1289, "archive.members[14].compressed_size": 4328, "archive.members[15].compressed_size": 1683, "archive.members[16].compressed_size": 5897, "archive.members[17].compressed_size": 6906, "archive.members[18].compressed_size": 190, "archive.members[19].compressed_size": 194, "archive.members[20].compressed_size": 167570, "archive.members[21].compressed_size": 796, "archive.members[22].compressed_size": 18877, "archive.members[23].compressed_size": 193, "archive.members[24].compressed_size": 194, "archive.members[25].compressed_size": 219, "archive.members[26].compressed_size": 194, "archive.members[27].compressed_size": 194, "archive.members[28].compressed_size": 195, "archive.members[29].compressed_size": 194, "archive.members[30].compressed_size": 625, "archive.members[31].compressed_size": 49658, "archive.members[32].compressed_size": 195, "archive.members[33].compressed_size": 219, "archive.members[34].compressed_size": 195, "archive.members[35].compressed_size": 191, "archive.members[36].compressed_size": 925, "archive.members[37].compressed_size": 925, "archive.members[38].compressed_size": 923, "archive.members[39].compressed_size": 923, "archive.members[40].compressed_size": 204, "archive.members[41].compressed_size": 923, "archive.members[42].compressed_size": 923, "archive.members[43].compressed_size": 923, "archive.members[44].compressed_size": 923, "archive.members[45].compressed_size": 925, "archive.members[46].compressed_size": 925, "archive.members[47].compressed_size": 4017, "archive.members[48].compressed_size": 388, "archive.members[49].compressed_size": 200, "archive.members[50].compressed_size": 193, "archive.members[51].compressed_size": 518, "archive.members[52].compressed_size": 200, "archive.members[53].compressed_size": 350, "archive.members[54].compressed_size": 2031, "archive.members[55].compressed_size": 185, "archive.members[56].compressed_size": 339, "archive.members[57].compressed_size": 418, "archive.members[58].compressed_size": 200, "archive.members[59].compressed_size": 350, "archive.members[60].compressed_size": 200, "archive.members[61].compressed_size": 355, "archive.members[62].compressed_size": 200, "archive.members[63].compressed_size": 242, "archive.members[64].compressed_size": 428, "archive.members[65].compressed_size": 693, "archive.members[66].compressed_size": 144, "archive.members[67].compressed_size": 194, "archive.members[68].compressed_size": 195, "archive.members[69].compressed_size": 195, "archive.members[70].compressed_size": 195, "archive.members[71].compressed_size": 195, "archive.members[72].compressed_size": 195, "archive.members[73].compressed_size": 196, "archive.members[74].compressed_size": 195, "archive.members[75].compressed_size": 4839, "archive.members[76].compressed_size": 2245, "archive.members[0].compression_method": "deflate", "archive.members[1].compression_method": "deflate", "archive.members[2].compression_method": "deflate", "archive.members[3].compression_method": "deflate", "archive.members[4].compression_method": "deflate", "archive.members[5].compression_method": "deflate", "archive.members[6].compression_method": "deflate", "archive.members[7].compression_method": "deflate", "archive.members[8].compression_method": "deflate", "archive.members[9].compression_method": "deflate", "archive.members[10].compression_method": "deflate", "archive.members[11].compression_method": "deflate", "archive.members[12].compression_method": "deflate", "archive.members[13].compression_method": "deflate", "archive.members[14].compression_method": "deflate", "archive.members[15].compression_method": "deflate", "archive.members[16].compression_method": "deflate", "archive.members[17].compression_method": "deflate", "archive.members[18].compression_method": "deflate", "archive.members[19].compression_method": "deflate", "archive.members[20].compression_method": "deflate", "archive.members[21].compression_method": "deflate", "archive.members[22].compression_method": "stored", "archive.members[23].compression_method": "deflate", "archive.members[24].compression_method": "deflate", "archive.members[25].compression_method": "deflate", "archive.members[26].compression_method": "deflate", "archive.members[27].compression_method": "deflate", "archive.members[28].compression_method": "deflate", "archive.members[29].compression_method": "deflate", "archive.members[30].compression_method": "deflate", "archive.members[31].compression_method": "stored", "archive.members[32].compression_method": "deflate", "archive.members[33].compression_method": "deflate", "archive.members[34].compression_method": "deflate", "archive.members[35].compression_method": "deflate", "archive.members[36].compression_method": "deflate", "archive.members[37].compression_method": "deflate", "archive.members[38].compression_method": "deflate", "archive.members[39].compression_method": "deflate", "archive.members[40].compression_method": "deflate", "archive.members[41].compression_method": "deflate", "archive.members[42].compression_method": "deflate", "archive.members[43].compression_method": "deflate", "archive.members[44].compression_method": "deflate", "archive.members[45].compression_method": "deflate", "archive.members[46].compression_method": "deflate", "archive.members[47].compression_method": "deflate", "archive.members[48].compression_method": "deflate", "archive.members[49].compression_method": "deflate", "archive.members[50].compression_method": "deflate", "archive.members[51].compression_method": "deflate", "archive.members[52].compression_method": "deflate", "archive.members[53].compression_method": "deflate", "archive.members[54].compression_method": "stored", "archive.members[55].compression_method": "deflate", "archive.members[56].compression_method": "deflate", "archive.members[57].compression_method": "deflate", "archive.members[58].compression_method": "deflate", "archive.members[59].compression_method": "deflate", "archive.members[60].compression_method": "deflate", "archive.members[61].compression_method": "deflate", "archive.members[62].compression_method": "deflate", "archive.members[63].compression_method": "deflate", "archive.members[64].compression_method": "deflate", "archive.members[65].compression_method": "deflate", "archive.members[66].compression_method": "deflate", "archive.members[67].compression_method": "deflate", "archive.members[68].compression_method": "deflate", "archive.members[69].compression_method": "deflate", "archive.members[70].compression_method": "deflate", "archive.members[71].compression_method": "deflate", "archive.members[72].compression_method": "deflate", "archive.members[73].compression_method": "deflate", "archive.members[74].compression_method": "deflate", "archive.members[75].compression_method": "stored", "archive.members[76].compression_method": "deflate", "archive.members[0].central_header_offset": 372241, "archive.members[1].central_header_offset": 372306, "archive.members[2].central_header_offset": 372363, "archive.members[3].central_header_offset": 372424, "archive.members[4].central_header_offset": 372496, "archive.members[5].central_header_offset": 372566, "archive.members[6].central_header_offset": 372636, "archive.members[7].central_header_offset": 372706, "archive.members[8].central_header_offset": 372776, "archive.members[9].central_header_offset": 372846, "archive.members[10].central_header_offset": 372916, "archive.members[11].central_header_offset": 372986, "archive.members[12].central_header_offset": 373056, "archive.members[13].central_header_offset": 373126, "archive.members[14].central_header_offset": 373197, "archive.members[15].central_header_offset": 373268, "archive.members[16].central_header_offset": 373333, "archive.members[17].central_header_offset": 373392, "archive.members[18].central_header_offset": 373458, "archive.members[19].central_header_offset": 373539, "archive.members[20].central_header_offset": 373620, "archive.members[21].central_header_offset": 373683, "archive.members[22].central_header_offset": 373753, "archive.members[23].central_header_offset": 373819, "archive.members[24].central_header_offset": 373900, "archive.members[25].central_header_offset": 373981, "archive.members[26].central_header_offset": 374062, "archive.members[27].central_header_offset": 374143, "archive.members[28].central_header_offset": 374224, "archive.members[29].central_header_offset": 374305, "archive.members[30].central_header_offset": 374386, "archive.members[31].central_header_offset": 374456, "archive.members[32].central_header_offset": 374521, "archive.members[33].central_header_offset": 374602, "archive.members[34].central_header_offset": 374684, "archive.members[35].central_header_offset": 374766, "archive.members[36].central_header_offset": 374847, "archive.members[37].central_header_offset": 374932, "archive.members[38].central_header_offset": 375017, "archive.members[39].central_header_offset": 375102, "archive.members[40].central_header_offset": 375187, "archive.members[41].central_header_offset": 375272, "archive.members[42].central_header_offset": 375357, "archive.members[43].central_header_offset": 375442, "archive.members[44].central_header_offset": 375527, "archive.members[45].central_header_offset": 375612, "archive.members[46].central_header_offset": 375698, "archive.members[47].central_header_offset": 375784, "archive.members[48].central_header_offset": 375846, "archive.members[49].central_header_offset": 375911, "archive.members[50].central_header_offset": 375981, "archive.members[51].central_header_offset": 376046, "archive.members[52].central_header_offset": 376111, "archive.members[53].central_header_offset": 376181, "archive.members[54].central_header_offset": 376246, "archive.members[55].central_header_offset": 376308, "archive.members[56].central_header_offset": 376378, "archive.members[57].central_header_offset": 376443, "archive.members[58].central_header_offset": 376513, "archive.members[59].central_header_offset": 376583, "archive.members[60].central_header_offset": 376648, "archive.members[61].central_header_offset": 376718, "archive.members[62].central_header_offset": 376783, "archive.members[63].central_header_offset": 376853, "archive.members[64].central_header_offset": 376923, "archive.members[65].central_header_offset": 376986, "archive.members[66].central_header_offset": 377048, "archive.members[67].central_header_offset": 377113, "archive.members[68].central_header_offset": 377189, "archive.members[69].central_header_offset": 377265, "archive.members[70].central_header_offset": 377341, "archive.members[71].central_header_offset": 377417, "archive.members[72].central_header_offset": 377493, "archive.members[73].central_header_offset": 377569, "archive.members[74].central_header_offset": 377645, "archive.members[75].central_header_offset": 377721, "archive.members[76].central_header_offset": 377790 }, "id": "xlsx" }, "id": 0, "sz": 377877, "ts": [ { "a": "T1059.005", "c": 1.0, "d": "OOXML document contains VBA macros (0 modules: )", "i": "metadata/format/macro::ooxml-has-vba", "l": 3 }, { "c": 0.7200000286102295, "d": "HTML comment marker", "e": [ "\u003c!--" ], "i": "micro-behaviors/data/format/html::comment", "l": 1 } ], "sha": "f9fdec54e703a9bb6d95c49d2d20ead4f1096ddff57ff7b1672ecc6f8d765797", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-04/f9fdec54e703a9bb6d95c49d2d20ead4f1096ddff57ff7b1672ecc6f8d765797.xlsm", "type": "xlsx" } ], "tv": "52045" } }