{
  "llm": {
    "conf": 0.8,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "suspicious",
    "interpretation": "Obfuscated .NET binary with tracking"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 3000,
    "conf": 54,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9363533,
        "rte": "az",
        "prob": 0.9363533
      }
    ],
    "prob": 0.8,
    "files": [
      {
        "id": 0,
        "lvl": 3000,
        "conf": 54,
        "prob": 0.800000011920929,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-01T21:20:09Z"
  },
  "path": "fb7e02337610786ae877993240a0a0f9dd5dd8f0c4916c97d45149687d5422d0.iso",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "m/W92Bo1YewDlJDwDluyve$xHwDkg1zVB!TmGvMhzuaeDBo31PzVBUPpYLzlx-J2JBo2\u003eLASu7Kw=MJByYF2DiSH/kf90T901?)8zVBnEve$xHx-J5Kzu6U)DJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvKafAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvNbfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvNbfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvQcfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr*cEe\u003cm6DJk=2f-S{df-S{deDvKag5%6fg5%6feDvTdfAr^bfAr*ceDvE8fAr^bfAr\u003cdEe\u003clE007VHK7%c$pEzkX6mK053Pw4=000000000000000000080rrx",
            "n": [
              {
                "c": 4,
                "d": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.",
                "i": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor",
                "o": 100520,
                "z": 3,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 100424
          },
          {
            "b": "un8\u0026[163uL0rJi61oOYgFg}Sv163u/1pM%\u003e1{=Z-0r\u0026Si0%ple1qRgMd*u1S0QAsh8IG8-8Qn\u0026]1Cc:RuTDJ6t0(p*r8lj}uPIX9ze-]$xkP1Kl)TPCgb%e\u0026Br@XeB7GCtgbQ*Eb@dw*z/fVdzGEfXl)TPCgb%e\u0026Br@XeB7GCtgbQ*Eb@dw?y\u0026:JqA:@VbgEM7#Dt^?pb@dw?y\u0026\u003cPhwO@!Il$Onlw))XPvL6GIgbHNth!uCIvpzfbeJvu2fK!MJwIE^KwHf8\u0026wQ5f9A+Px4zGEfXl)TPCgb%e\u0026Br@XeB7C",
            "n": [
              {
                "c": 3,
                "d": "Percent-encoded content decoded",
                "i": "metadata/encoded-payload/url",
                "o": 924197,
                "z": 46,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 924133
          }
        ],
        "mol": "MdTh",
        "sha": "fb7e02337610786ae877993240a0a0f9dd5dd8f0c4916c97d45149687d5422d0",
        "path": "fb7e02337610786ae877993240a0a0f9dd5dd8f0c4916c97d45149687d5422d0.iso",
        "risk": 37,
        "size": 933888,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 933888.0,
              "entropy": 7.72,
              "size_bytes": 933888.0
            },
            "binary": {
              "overall_entropy": 7.72,
              "peak_region_bytes": 805888.0,
              "peak_region_entropy": 7.86
            }
          }
        },
        "traits": [
          {
            "id": "metadata/encoded-payload/url",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Percent-encoded content decoded",
            "spans": [
              [
                924197,
                46
              ]
            ]
          },
          {
            "id": "third_party/bartblaze/generic/DotNet_Reactor/dotnet_reactor",
            "conf": 0.8999999761581421,
            "crit": 4,
            "desc": "Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.",
            "spans": [
              [
                100520,
                3
              ],
              [
                100572,
                3
              ],
              [
                100728,
                3
              ],
              [
                100780,
                3
              ]
            ]
          }
        ]
      }
    ]
  }
}