{
  "total": 34,
  "generated_at": "2026-10-27T18:42:30.316542",
  "samples": [
    {
      "category": "畸形文件",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "CRC 损坏的 ZIP → 畸形文件启发式",
      "filename": "broken.zip",
      "size": 125
    },
    {
      "category": "ISO镜像",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "ISO 镜像内嵌 ELF 可执行文件（当前引擎未启用 IsoWithExecutable，仅命中可执行扩展名规则）",
      "filename": "evil.iso",
      "size": 32775
    },
    {
      "category": "CHM帮助",
      "expected_verdict": "reject",
      "expected_rules": [
        "ChmWithScript"
      ],
      "description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
      "filename": "evil_help.chm",
      "size": 1691
    },
    {
      "category": "Linux可执行",
      "expected_verdict": "reject",
      "expected_rules": [
        "LinuxExecutable"
      ],
      "description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
      "filename": "linux_malicious",
      "size": 71
    },
    {
      "category": "LOLBin",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "certutil -decode LOLBin 下载执行（当前引擎未启用 C1_PE_LOLBin_Usage，仅命中可执行扩展名规则）",
      "filename": "lolbin.cmd",
      "size": 114
    },
    {
      "category": "Office宏",
      "expected_verdict": "reject",
      "expected_rules": [
        "VBAAutoExecShell",
        "VBAAutoExec"
      ],
      "description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
      "filename": "macro_alert.docm",
      "size": 2586
    },
    {
      "category": "Linux后门",
      "expected_verdict": "reject",
      "expected_rules": [
        "DesktopFileAutoExec"
      ],
      "description": ".desktop 文件恶意 Exec 字段",
      "filename": "malicious.desktop",
      "size": 114
    },
    {
      "category": "PDF载荷",
      "expected_verdict": "reject",
      "expected_rules": [
        "PdfJavaScript",
        "PdfOpenAction"
      ],
      "description": "PDF /OpenAction /JS app.launchURL 自动执行",
      "filename": "malicious.pdf",
      "size": 534
    },
    {
      "category": "挖矿",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "C7_Linux_Miner_Generic"
      ],
      "description": "XMRig stratum+tcp 矿池配置（规则命中但权重不够未达 reject 阈值）",
      "filename": "miner_config.json",
      "size": 123
    },
    {
      "category": "阴性对照",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常 PDF（只有简单文本，无 JS/自动执行）",
      "filename": "normal.pdf",
      "size": 439
    },
    {
      "category": "阴性对照",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "正常部署 Shell（引擎 .sh 扩展名触发 DangerousExecutableExtension，属零容忍范围）",
      "filename": "normal_deploy.sh",
      "size": 155
    },
    {
      "category": "阴性对照",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常纯文本文件",
      "filename": "normal_readme.txt",
      "size": 162
    },
    {
      "category": "阴性对照",
      "expected_verdict": "pass",
      "expected_rules": [],
      "description": "正常 Word 文档（无宏、无外链）",
      "filename": "normal_report.docx",
      "size": 1212
    },
    {
      "category": "OLE嵌入",
      "expected_verdict": "pass",
      "expected_rules": [
        "OleToolsUnavailable"
      ],
      "description": "DOC 文件内嵌 .exe OLE 对象（OleTools 模块未加载 → clean，规则返回 OleToolsUnavailable 零权重）",
      "filename": "ole_dropper.doc",
      "size": 1641
    },
    {
      "category": "PE恶意程序",
      "expected_verdict": "reject",
      "expected_rules": [
        "C1_PE_Downloader_Loader"
      ],
      "description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
      "filename": "pe_downloader.exe",
      "size": 1148
    },
    {
      "category": "PE恶意程序",
      "expected_verdict": "reject",
      "expected_rules": [
        "C1_PE_ProcessInjection"
      ],
      "description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
      "filename": "pe_injection.exe",
      "size": 1129
    },
    {
      "category": "持久化",
      "expected_verdict": "reject",
      "expected_rules": [
        "C7_Linux_Persistence_Crontab"
      ],
      "description": "crontab 注入 wget/curl 下载执行",
      "filename": "persist_cron.sh",
      "size": 95
    },
    {
      "category": "钓鱼邮件",
      "expected_verdict": "reject",
      "expected_rules": [
        "EmailAttachmentDangerous",
        "EmailAttachmentDisguised",
        "EmailAttachmentWebshell",
        "EmailPhishingKeyword"
      ],
      "description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
      "filename": "phishing.eml",
      "size": 1869
    },
    {
      "category": "伪装",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "双扩展名伪装 .jpg.php（当前引擎未启用 DoubleExtension，命中 DangerousExecutableExtension 拒绝）",
      "filename": "photo.jpg.php",
      "size": 29
    },
    {
      "category": "勒索",
      "expected_verdict": "reject",
      "expected_rules": [
        "C8_Ransomware_Encryption"
      ],
      "description": "加密 API + 卷影删除 + 勒索信文件名",
      "filename": "ransom_dropper.exe.txt",
      "size": 215
    },
    {
      "category": "加密Office",
      "expected_verdict": "reject",
      "expected_rules": [
        "OfficeEncrypted"
      ],
      "description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
      "filename": "sealed.docx",
      "size": 6656
    },
    {
      "category": "加密Office",
      "expected_verdict": "reject",
      "expected_rules": [
        "OfficeEncrypted"
      ],
      "description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
      "filename": "sealed.xlsx",
      "size": 6656
    },
    {
      "category": "Webshell",
      "expected_verdict": "reject",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "ASP.NET Process.Start 命令执行（当前引擎未启用 C3_Webshell_ASPNET，命中 DangerousExecutableExtension 拒绝）",
      "filename": "shell_aspx.aspx",
      "size": 169
    },
    {
      "category": "Linux后门",
      "expected_verdict": "reject",
      "expected_rules": [
        "ShellScriptDangerous",
        "C7_Linux_ReverseShell_Bash"
      ],
      "description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
      "filename": "shell_bash_devtcp.sh",
      "size": 51
    },
    {
      "category": "Webshell",
      "expected_verdict": "reject",
      "expected_rules": [
        "C3_JSP_Webshell_RuntimeExec"
      ],
      "description": "JSP Runtime.getRuntime().exec 命令执行",
      "filename": "shell_jsp_runtime.jsp",
      "size": 316
    },
    {
      "category": "Linux后门",
      "expected_verdict": "reject",
      "expected_rules": [
        "ShellScriptDangerous",
        "C7_Linux_ReverseShell_NC"
      ],
      "description": "nc -e /bin/bash 反弹 Shell",
      "filename": "shell_nc.sh",
      "size": 42
    },
    {
      "category": "Webshell",
      "expected_verdict": "reject",
      "expected_rules": [
        "C3_PHP_Webshell_Oneliner"
      ],
      "description": "PHP oneliner eval + echo 组合",
      "filename": "shell_php_eval.php",
      "size": 40
    },
    {
      "category": "Webshell",
      "expected_verdict": "reject",
      "expected_rules": [
        "C3_PHP_Webshell_Obfuscated"
      ],
      "description": "PHP base64 + assert 混淆",
      "filename": "shell_php_obf.php",
      "size": 61
    },
    {
      "category": "Linux后门",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "Python pty + socket 反弹 Shell（当前引擎未启用 ShellScriptDangerous / C7_Linux_ReverseShell_Python，命中 .py 可执行扩展名）",
      "filename": "shell_python.py",
      "size": 211
    },
    {
      "category": "LNK",
      "expected_verdict": "suspicious",
      "expected_rules": [
        "DangerousExecutableExtension"
      ],
      "description": "LNK Shell Link 指向 cmd.exe /c 下载执行（当前引擎未启用 LnkWithAutoExec，命中 .lnk 可执行扩展名）",
      "filename": "shortcut.lnk",
      "size": 143
    },
    {
      "category": "Office宏",
      "expected_verdict": "reject",
      "expected_rules": [
        "AttachedTemplate"
      ],
      "description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
      "filename": "template_backdoor.docx",
      "size": 2176
    },
    {
      "category": "Office宏",
      "expected_verdict": "malicious",
      "expected_rules": [
        "VBAAutoExecShell"
      ],
      "description": "VBA AutoOpen + Shell 执行（规则名带 Shell 后缀，比原预期 VBAAutoExec 更精确）",
      "filename": "vba_autoexec.bas",
      "size": 98
    },
    {
      "category": "WPS宏",
      "expected_verdict": "malicious",
      "expected_rules": [
        "C7_Linux_ReverseShell_Bash",
        "C7_Linux_ReverseShell_Misc",
        "DangerousExecutableExtension"
      ],
      "description": "WPS Linux JS 宏 AutoOpen + /bin/sh（YARA 反弹 Shell 规则命中 + .js 扩展名；未命中宏规则 VBAAutoExecShell）",
      "filename": "wps_macro.js",
      "size": 142
    },
    {
      "category": "攻击载体",
      "expected_verdict": "reject",
      "expected_rules": [
        "PathTraversal"
      ],
      "description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
      "filename": "zip_traversal.zip",
      "size": 164
    }
  ]
}