Detonate URL - Group-IB TDS Polygon

Detonate URL using Group-IB THF Polygon integration.

Pack

Polygon

Tasks

10

Inputs

• Interval — Report requests frequency (minutes)
• Timeout — Report waiting timeout (minutes)
• url — URL to detonate

Outputs

• File.Name — The full file name (including file extension).
• File.MD5 — The MD5 hash of the file
• File.SHA1 — The SHA1 hash of the file
• File.SHA256 — The SHA256 hash of the file
• File.Type — File type
• File.Malicious.Vendor — The vendor that reported the file as malicious
• File.Malicious.Description — A description explaining why the file was determined to be malicious
• DBotScore.Indicator — The indicator that was tested
• DBotScore.Type — The indicator type
• DBotScore.Vendor — The vendor used to calculate the score
• DBotScore.Score — The actual score
• IP.Address — IP address
• Domain.Name — The Domain name
• Domain.DNS — A list of IP objects resolved by DNS.
• URL.Data — The URL
• RegistryKey.Path — The path to the registry key
• RegistryKey.Value — The value at the given RegistryKey.
• Process.Name — Process name
• Process.PID — Process PID
• Process.CommandLine — Process Command Line
• Process.Path — Process path
• Process.StartTime — Process start time
• Process.EndTime — Process end time
• Polygon.Analysis.ID — Analysis ID in THF
• Polygon.Analysis.Name — File Name
• Polygon.Analysis.Size — File Size
• Polygon.Analysis.Started — Analysis start timestamp
• Polygon.Analysis.Analyzed — Analysis finish timestamp
• Polygon.Analysis.MD5 — Analyzed file MD5 hash
• Polygon.Analysis.SHA1 — Analyzed file SHA1 hash
• Polygon.Analysis.SHA256 — Analyzed file SHA256
• Polygon.Analysis.Result — Analysis verdict
• Polygon.Analysis.Status — The analysis status
• Polygon.Analysis.Verdict — Analysis verdict
• Polygon.Analysis.Probability — Verdict probability
• Polygon.Analysis.Families — Malware families
• Polygon.Analysis.Score — Polygon score
• Polygon.Analysis.Internet-connection — Internet availability
• Polygon.Analysis.Type — File type
• Polygon.Analysis.DumpExists — Network activity dump exists
• Polygon.Analysis.File — The information about files in analysis
• Polygon.Analysis.URL — The information about URL indicators
• Polygon.Analysis.IP — The information about IP indicators
• Polygon.Analysis.Domain — The information about Domain indicators
• Polygon.Analysis.RegistryKey — The information about registry keys which were modified during the analysis
• Polygon.Analysis.Process — The information about processes started during the analysis

Commands used

• polygon-analysis-info
• polygon-export-pcap
• polygon-export-report
• polygon-export-video
• polygon-upload-url