Detonate File - Lastline v2

Detonates a File using the Lastline sandbox. Lastline supports the following File Types: EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH

Pack

Lastline

Tasks

11

Inputs

• File — The file to detonate. File is taken from the context.
• Interval — Polling frequency - how often the polling command should run (minutes)
• Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

• DBotScore.Type — The type of the indicator (only in case of report type=json)
• InfoFile.EntryID — The EntryID of the report file
• DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
• IP.Address — IP's relevant to the sample
• DBotScore.Score — The actual score (only in case of report type=json)
• DBotScore.Indicator — The indicator we tested (only in case of report type=json)
• InfoFile.Extension — The extension of the report file
• InfoFile.Name — The name of the report file
• InfoFile.Info — The info of the report file
• InfoFile.Size — The size of the report file
• InfoFile.Type — The type of the report file
• URL.Data — List of malicious URLs identified by Lastline analysis
• URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
• URL.Malicious.Description — For malicious URLs, the reason for the vendor to make the decision
• URL.Malicious.Score — For malicious URLs, the score from the vendor
• File.MD5 — Bad hash MD5
• File.SHA1 — Bad hash SHA1
• File.SHA256 — Bad hash SHA256
• File.Malicious.Vendor — For malicious files, the vendor that made the decision
• File.Malicious.Score — For malicious files, the score from the vendor
• Lastline.Submission.Status — Status of the submission
• Lastline.Submission.DNSqueries — List of DNS queries done by the analysis subject
• Lastline.Submission.NetworkConnections — ist of network connections done by the analysis subject
• Lastline.Submission.DownloadedFiles — List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
• Lastline.Submission.UUID — Task UUID of submitted sample
• Lastline.Submission.YaraSignatures.name — Yara signatures name
• Lastline.Submission.YaraSignatures.score — The score according to the yara signatures. from 0 to 100.
• Lastline.Submission.Process.arguments — Argument of the process
• Lastline.Submission.Process.process_id — The process ID
• Lastline.Submission.Process.executable.abs_path — Absolute path of the executable of the process
• Lastline.Submission.Process.executable.filename — Filename of the executable
• Lastline.Submission.Process.executable.yara_signature_hits — Yara signature of the executable of the process
• Lastline.Submission.Process.executable.ext_info — Executable info of the process
• Lastline.Submission.YaraSignatures.internal — True if the signature is only for internal usage
• File — File object
• File.Malicious — File Malicious object
• DBotScore — DBot score object
• Lastline.Submission — Lastline submission object

Commands used

• lastline-check-status
• lastline-get-report
• lastline-upload-file