{
  "llm": {
    "conf": 0.997677,
    "grade": "hostile",
    "model": "Qwen/Qwen3.8-27B",
    "before": {
      "lvl": 1250,
      "prob": 0.9965329,
      "class": "suspicious"
    },
    "outcome": "suspicious",
    "interpretation": "CVE-2017-11882 Equation exploit"
  },
  "ml": {
    "v": "7",
    "eng": "2.11.0-beta.0",
    "lvl": 1250,
    "conf": 66,
    "mods": [
      {
        "cls": 0,
        "raw": 0.97157437,
        "rte": "az",
        "prob": 0.97157437
      },
      {
        "cls": 1,
        "raw": 0.9965329,
        "rte": "az/documents",
        "prob": 0.9965329
      }
    ],
    "prob": 0.9965329,
    "files": [
      {
        "id": 0,
        "lvl": 1250,
        "conf": 66,
        "prob": 0.9965329170227051,
        "type": "xls"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-16T05:37:03Z"
  },
  "path": "fb1b10459fc2bfbd5e87629c6fbaa2193f77b8e6e384f10be2fbb131c4b52289.xlsx",
  "raw": {
    "v": "8",
    "rev": "e86a6",
    "files": [
      {
        "id": 0,
        "mol": "Md(Ag₂)",
        "sha": "fb1b10459fc2bfbd5e87629c6fbaa2193f77b8e6e384f10be2fbb131c4b52289",
        "path": "fb1b10459fc2bfbd5e87629c6fbaa2193f77b8e6e384f10be2fbb131c4b52289.xlsx",
        "risk": 41,
        "size": 156160,
        "type": "xls",
        "facts": {
          "metrics": {
            "file": {
              "size": 156160,
              "entropy": 7.88
            },
            "binary": {
              "peak_region_bytes": 142336,
              "peak_region_entropy": 7.86
            },
            "office": {
              "stream_count": 11,
              "ole.stream_count": 10,
              "ole.storage_count": 1,
              "dangerous_clsid_count": 1,
              "ole.dangerous_clsid_count": 1,
              "is_macro_enabled_extension": 0
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.document_as_document": 1
            }
          }
        },
        "ident": {
          "trust": "unsigned",
          "producer": {
            "value": "Microsoft Excel",
            "source": "office.application",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/format/embedded::ole10-native-object",
            "conf": 1.0,
            "crit": 3,
            "desc": "OLE10Native embedded object: 28311320 bytes in /MBD0206CD8F/\u0001OlE10natIvE"
          },
          {
            "id": "metadata/format/clsid::dangerous-clsid",
            "conf": 1.0,
            "crit": 4,
            "desc": "Equation Editor 3.0 (CVE-2017-11882) (CLSID: 0002ce02-0000-0000-c000-000000000046) on /MBD0206CD8F"
          }
        ]
      }
    ]
  }
}