[
  {
    "filename": "evil_help.chm",
    "category": "CHM帮助",
    "description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "ChmWithScript"
    ],
    "actual_rules": [
      "ChmWithScript",
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 2
  },
  {
    "filename": "evil.iso",
    "category": "ISO镜像",
    "description": "ISO 镜像内嵌 ELF 可执行文件",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "IsoWithExecutable"
    ],
    "actual_rules": [
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "shortcut.lnk",
    "category": "LNK",
    "description": "LNK Shell Link 指向 cmd.exe /c 下载执行",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "LnkWithAutoExec"
    ],
    "actual_rules": [
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "lolbin.cmd",
    "category": "LOLBin",
    "description": "certutil -decode LOLBin 下载执行",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C1_PE_LOLBin_Usage"
    ],
    "actual_rules": [
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "linux_malicious",
    "category": "Linux可执行",
    "description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "LinuxExecutable"
    ],
    "actual_rules": [
      "C7_Linux_ReverseShell_Bash",
      "LinuxExecutable"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 2
  },
  {
    "filename": "malicious.desktop",
    "category": "Linux后门",
    "description": ".desktop 文件恶意 Exec 字段",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "DesktopFileAutoExec"
    ],
    "actual_rules": [
      "C7_Linux_ReverseShell_Bash",
      "C7_Linux_ReverseShell_Misc",
      "DangerousExecutableExtension",
      "DesktopFileAutoExec"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 5
  },
  {
    "filename": "shell_bash_devtcp.sh",
    "category": "Linux后门",
    "description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "C7_Linux_ReverseShell_Bash",
      "ShellScriptDangerous"
    ],
    "actual_rules": [
      "C7_Linux_ReverseShell_Bash",
      "DangerousExecutableExtension",
      "ShellScriptDangerous"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 3
  },
  {
    "filename": "shell_nc.sh",
    "category": "Linux后门",
    "description": "nc -e /bin/bash 反弹 Shell",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "C7_Linux_ReverseShell_NC",
      "ShellScriptDangerous"
    ],
    "actual_rules": [
      "C7_Linux_ReverseShell_NC",
      "DangerousExecutableExtension",
      "ShellScriptDangerous"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 3
  },
  {
    "filename": "shell_python.py",
    "category": "Linux后门",
    "description": "Python pty + socket 反弹 Shell",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C7_Linux_ReverseShell_Python",
      "ShellScriptDangerous"
    ],
    "actual_rules": [
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "ole_dropper.doc",
    "category": "OLE嵌入",
    "description": "DOC 文件内嵌 .exe OLE 对象（OLE2 CFB + .exe stream）",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "EmbeddedExecutable"
    ],
    "actual_rules": [
      "OleToolsUnavailable"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "macro_alert.docm",
    "category": "Office宏",
    "description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "VBAAutoExec",
      "VBAAutoExecShell"
    ],
    "actual_rules": [
      "ArchiveContainsExecutable",
      "ExtensionMismatch",
      "OleToolsUnavailable",
      "VBAAutoExecShell"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 4
  },
  {
    "filename": "template_backdoor.docx",
    "category": "Office宏",
    "description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "AttachedTemplate"
    ],
    "actual_rules": [
      "AttachedTemplate",
      "OleToolsUnavailable"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 2
  },
  {
    "filename": "vba_autoexec.bas",
    "category": "Office宏",
    "description": "VBA AutoOpen + Shell 执行",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "VBAAutoExec"
    ],
    "actual_rules": [
      "VBAAutoExecShell"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "malicious.pdf",
    "category": "PDF载荷",
    "description": "PDF /OpenAction /JS app.launchURL 自动执行",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "PdfJavaScript",
      "PdfOpenAction"
    ],
    "actual_rules": [
      "OleToolsUnavailable",
      "PdfJavaScript",
      "PdfOpenAction"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 3
  },
  {
    "filename": "pe_downloader.exe",
    "category": "PE恶意程序",
    "description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C1_PE_Downloader_Loader"
    ],
    "actual_rules": [
      "C1_PE_Downloader_Loader",
      "DangerousExecutableExtension",
      "PeParseFailed"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 3
  },
  {
    "filename": "pe_injection.exe",
    "category": "PE恶意程序",
    "description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C1_PE_ProcessInjection"
    ],
    "actual_rules": [
      "C1_PE_ProcessInjection",
      "DangerousExecutableExtension",
      "PeParseFailed"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 3
  },
  {
    "filename": "wps_macro.js",
    "category": "WPS宏",
    "description": "WPS Linux JS 宏 AutoOpen + /bin/sh",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "VBAAutoExecShell"
    ],
    "actual_rules": [
      "C7_Linux_ReverseShell_Bash",
      "C7_Linux_ReverseShell_Misc",
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 3
  },
  {
    "filename": "shell_aspx.aspx",
    "category": "Webshell",
    "description": "ASP.NET Process.Start 命令执行",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C3_Webshell_ASPNET"
    ],
    "actual_rules": [
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "shell_jsp_runtime.jsp",
    "category": "Webshell",
    "description": "JSP Runtime.getRuntime().exec 命令执行",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C3_JSP_Webshell_RuntimeExec"
    ],
    "actual_rules": [
      "C3_JSP_Webshell_RuntimeExec",
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 2
  },
  {
    "filename": "shell_php_eval.php",
    "category": "Webshell",
    "description": "PHP oneliner eval + echo 组合",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C3_PHP_Webshell_Oneliner"
    ],
    "actual_rules": [
      "C3_PHP_Webshell_Oneliner",
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 2
  },
  {
    "filename": "shell_php_obf.php",
    "category": "Webshell",
    "description": "PHP base64 + assert 混淆",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C3_PHP_Webshell_Obfuscated"
    ],
    "actual_rules": [
      "C3_PHP_Webshell_Obfuscated",
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 2
  },
  {
    "filename": "photo.jpg.php",
    "category": "伪装",
    "description": "双扩展名伪装 .jpg.php",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "DoubleExtension"
    ],
    "actual_rules": [
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "sealed.docx",
    "category": "加密Office",
    "description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "OfficeEncrypted"
    ],
    "actual_rules": [
      "ArchiveBroken",
      "MalformedStructure",
      "OfficeEncrypted",
      "OleToolsUnavailable",
      "OoxmlParseFailed"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 5
  },
  {
    "filename": "sealed.xlsx",
    "category": "加密Office",
    "description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "OfficeEncrypted"
    ],
    "actual_rules": [
      "ArchiveBroken",
      "ExtensionMismatch",
      "MalformedStructure",
      "OfficeEncrypted",
      "OleToolsUnavailable",
      "OoxmlParseFailed"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 6
  },
  {
    "filename": "ransom_dropper.exe.txt",
    "category": "勒索",
    "description": "加密 API + 卷影删除 + 勒索信文件名",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C8_Ransomware_Encryption"
    ],
    "actual_rules": [
      "C8_Ransomware_Encryption",
      "C8_Ransomware_Note_Filename",
      "C8_Ransomware_VolumeShadow",
      "DoubleExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 4
  },
  {
    "filename": "persist_cron.sh",
    "category": "持久化",
    "description": "crontab 注入 wget/curl 下载执行",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "C7_Linux_Persistence_Crontab"
    ],
    "actual_rules": [
      "C7_Linux_Persistence_Crontab",
      "DangerousExecutableExtension",
      "ShellScriptDangerous"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 4
  },
  {
    "filename": "miner_config.json",
    "category": "挖矿",
    "description": "XMRig stratum+tcp 矿池配置",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "C7_Linux_Miner_Generic"
    ],
    "actual_rules": [
      "C7_Linux_Miner_Generic"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "zip_traversal.zip",
    "category": "攻击载体",
    "description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
    "expected_verdict": "reject",
    "actual_verdict": "malicious",
    "expected_rules": [
      "PathTraversal"
    ],
    "actual_rules": [
      "PathTraversal",
      "PathTraversalBlocked"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 2
  },
  {
    "filename": "broken.zip",
    "category": "畸形文件",
    "description": "CRC 损坏的 ZIP → 畸形文件启发式",
    "expected_verdict": "pass",
    "actual_verdict": "error",
    "expected_rules": [],
    "actual_rules": [],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 0
  },
  {
    "filename": "phishing.eml",
    "category": "钓鱼邮件",
    "description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
    "expected_verdict": "reject",
    "actual_verdict": "error",
    "expected_rules": [
      "EmailAttachmentDangerous",
      "EmailAttachmentDisguised",
      "EmailAttachmentWebshell",
      "EmailPhishingKeyword"
    ],
    "actual_rules": [
      "EmailAttachmentDangerous",
      "EmailAttachmentDisguised",
      "EmailAttachmentWebshell",
      "EmailPhishingKeyword"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 10
  },
  {
    "filename": "normal.pdf",
    "category": "阴性对照",
    "description": "正常 PDF（只有简单文本，无 JS/自动执行）",
    "expected_verdict": "pass",
    "actual_verdict": "error",
    "expected_rules": [],
    "actual_rules": [
      "OleToolsUnavailable"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "normal_deploy.sh",
    "category": "阴性对照",
    "description": "正常部署 Shell（没有 curl|bash 管道执行或反弹 Shell）",
    "expected_verdict": "pass",
    "actual_verdict": "error",
    "expected_rules": [],
    "actual_rules": [
      "DangerousExecutableExtension"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  },
  {
    "filename": "normal_readme.txt",
    "category": "阴性对照",
    "description": "正常纯文本文件",
    "expected_verdict": "pass",
    "actual_verdict": "error",
    "expected_rules": [],
    "actual_rules": [],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 0
  },
  {
    "filename": "normal_report.docx",
    "category": "阴性对照",
    "description": "正常 Word 文档（无宏、无外链）",
    "expected_verdict": "pass",
    "actual_verdict": "error",
    "expected_rules": [],
    "actual_rules": [
      "OleToolsUnavailable"
    ],
    "verdict_ok": true,
    "rule_ok": true,
    "overall": true,
    "score": 100.0,
    "findings_count": 1
  }
]