Check a file with THOR

[
  {
    "type": "THOR finding",
    "meta": {
      "time": "2026-01-16T13:35:34.11133172+01:00",
      "level": "Alert",
      "module": "HTTPServer",
      "scan_id": "S-qkQv5yHIUHk-2",
      "hostname": "127.0.0.1"
    },
    "message": "Malicious file found",
    "subject": {
      "type": "file",
      "path": "somefile.exe",
      "exists": "yes",
      "extension": ".exe",
      "magic_header": "EXE",
      "hashes": {
        "md5": "7168892693d7716220d98883fffd848c",
        "sha1": "42acd9b554e1c843a9f8139022b560de0bf48682",
        "sha256": "660464c473c47784d8820d3e268c0d1327ac22ce0e607dc35e858628c53f0687"
      },
      "first_bytes": {
        "hex": "4d5a90000300000004000000ffff0000b8000000",
        "ascii": "MZ"
      },
      "size": 1352192,
      "permissions": null,
      "content": {
        "type": "sparse data",
        "elements": [
          {
            "offset": 856110,
            "data": ">`ncrypt.dll"
          }
        ],
        "length": 1352192
      }
    },
    "score": 94,
    "reasons": [
      {
        "type": "reason",
        "summary": "some YARA rule",
        "signature": {
          "score": 85,
          "reference": [
            "Internal Research"
          ],
          "origin": "internal",
          "kind": "YARA Rule",
          "date": "2023-05-12",
          "tags": [
            "EXE",
            "HKTL"
          ],
          "rule_name": "Some_Rule_Name",
          "description": "Detects Something"
        },
        "matched": [
          {
            "data": "%*s**CREDENTIAL**",
            "offset": 918480,
            "field": "/content"
          },
          {
            "data": "%*s  Persist        : %08x - %u - %s",
            "offset": 919056,
            "field": "/content"
          },
          {
            "data": "%*s**DOMAINKEY**",
            "offset": 950688,
            "field": "/content"
          }
        ]
      },
      {
        "type": "reason",
        "summary": "Another rule",
        "signature": {
          "score": 80,
          "reference": [
            "Some reference"
          ],
          "origin": "internal",
          "kind": "YARA Rule",
          "date": "2016-02-05",
          "tags": [
            "T1059_001"
          ],
          "rule_name": "Another_Rule_Name",
          "description": "Detects Something other"
        },
        "matched": [
          {
            "data": "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)",
            "offset": 1100540,
            "field": "/content"
          },
          {
            "data": "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO",
            "offset": 1099708,
            "field": "/content"
          }
        ]
      }
    ],
    "reason_count": 28,
    "context": null,
    "log_version": "v3.0.0"
  }
]