A file scanner that sends extracted features to Jev for a verdict, a 0–4 severity score, and Noul indicators, then applies local quarantine or review rules.
Choice clean / suspicious_pua / malicious, Score 0–4, and Noul questions for packing, C2, persistence, and injection; local policy maps the answers.
Turns heuristic file features into thresholded structured answers rather than a prose verdict; this site has not run or validated protection.
Pinned feature-to-decision and triage policy reviewed. The model sees extracted features and the code can recommend quarantine, allow or SOC review. The site did not execute files, validate malware detection or verify endpoint-protection claims.
Inspect how extracted file features become a triage recommendation rather than a prose antivirus verdict.
Material analysed：
scan_file_features requires malicious plus one of confidence, severity, C2 or injection conditions. Clean also has confidence/severity checks; ambiguous cases route to SOC_REVIEW.
Inspect the supporting source ↗build_state sends extracted structural features, not proof of every runtime behavior. A malware-like indicator or a low risk value is a judgment about that supplied evidence.
Inspect the supporting source ↗Treat it as an experimental triage design. Use established endpoint protections and isolated analysis for unknown files; do not grant deletion/quarantine authority from this review.
Inspect the policy around malicious/clean/SOC_REVIEW using synthetic feature dictionaries and fake answers. Evaluate false positives and missed threats before enabling real file actions.