File Enrichment - VMRay

Get file information using the VMRay integration.

Pack

VMRay

Tasks

10

Inputs

• MD5 — File MD5 to enrich
• SHA256 — File SHA256 to enrich
• SHA1 — File SHA1 to enrich

Outputs

• File.Name — The full file name (including file extension).
• File.MD5 — The MD5 hash of the file.
• File.SHA1 — The SHA1 hash of the file.
• File.SHA256 — The SHA256 hash of the file.
• File.SSDeep — The SSDeep hash of the file.
• DBotScore.Indicator — The indicator that was tested.
• DBotScore.Type — The indicator type.
• DBotScore.Vendor — The vendor used to calculate the score.
• DBotScore.Score — The actual score.
• DBotScore.Reliability — Reliability of the source providing the intelligence data.
• VMRay.Sample.SampleID — ID of the sample.
• VMRay.Sample.SampleURL — URL to sample page.
• VMRay.Sample.FileName — File name of the sample.
• VMRay.Sample.MD5 — MD5 hash of the sample.
• VMRay.Sample.SHA1 — SHA1 hash of the sample.
• VMRay.Sample.SHA256 — SHA256 hash of the sample.
• VMRay.Sample.SSDeep — ssdeep hash of the sample.
• VMRay.Sample.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
• VMRay.Sample.VerdictReason — Description of the Verdict Reason.
• VMRay.Sample.Severity — Severity of the sample in the submission (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
• VMRay.Sample.Type — File type.
• VMRay.Sample.Created — Timestamp of sample creation.
• VMRay.Sample.Classifications — Classifications of the sample.
• VMRay.Sample.ChildSampleIDs — List of child sample IDs.
• VMRay.Sample.ParentSampleIDs — List of parent sample IDs.

Commands used

• vmray-get-sample-by-hash