fix: L0-004/L1-008 expected_verdict pass→suspicious

L0-004_pdf_normal.pdf (14字节):
  只有 %PDF-1.4 头和 %%EOF 尾, 缺 xref/trailer/catalog
  引擎报 MalformedStructure/PdfParseFailed 是对的
  expected_rules 本来就写了这两个, expected_verdict 写成 pass 矛盾
  → pass → suspicious

L1-008_L0-005_pe_clean.exe (926字节):
  e_lfanew=0x80 但 PE\\0\\0 实际在 0x7e (差2字节)
  pefile 报 Invalid NT Headers signature, PeParseFailed 是对的
  expected_verdict 写成 pass 不对
  → pass → suspicious

两个样本都是'测试畸形检测'用的负样本, 不是'干净文件对照'
引擎行为正确, 是 expected_verdict 本身写错了
This commit is contained in:
2026-10-29 17:31:53 +08:00
parent 9834930299
commit bc486df250

View File

@@ -43,7 +43,7 @@
"filename": "L0-004_pdf_normal.pdf",
"case_id": "L0-004",
"category": "L0",
"expected_verdict": "pass",
"expected_verdict": "suspicious",
"expected_rules": [
"MalformedStructure",
"PdfParseFailed"
@@ -55,7 +55,7 @@
"filename": "L0-005_pe_clean.exe",
"case_id": "L1-008",
"category": "L1",
"expected_verdict": "pass",
"expected_verdict": "suspicious",
"expected_rules": [
"DangerousExecutableExtension",
"PeParseFailed"