Detonate URL - JoeSecurity
Deprecated. Use the joe-submit-url command instead.
- Pack
- JoeSecurity
- Tasks
- 9
Inputs
- URL — URL to detonate.
- Interval — Duration for executing the pooling (in minutes)
- Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)
- Systems — Operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat
- Comments — Comments for the analysis.
- InternetAccess — Enable internet access (boolean). True= internet access (default), False= no internet access.
- ReportFileType — The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara
Outputs
- DBotScore.Vendor — The vendor used to calculate the score.
- Joe.Analysis.ID — Web ID
- Joe.Analysis.Status — Analysis Status
- Joe.Analysis.Comments — Analysis Comments
- Joe.Analysis.Time — Submitted Time
- Joe.Analysis.Runs — Sub-Analysis Information
- Joe.Analysis.Result — Analysis Results
- Joe.Analysis.Errors — Raised errors during sampling
- Joe.Analysis.Systems — Analysis OS
- Joe.Analysis.MD5 — MD5 of analysis sample
- Joe.Analysis.SHA1 — SHA1 of analysis sample
- Joe.Analysis.SHA256 — SHA256 of analysis sample
- Joe.Analysis.SampleName — Sample Data, could be a file name or URL
- DBotScore.Indicator — The name of the sample file or URL
- DBotScore.Type — 'url' for url samples, otherwise 'file'
- DBotScore.Score — The actual score.
- DBotScore.Malicious.Vendor — The vendor used to calculate the score.
- DBotScore.Malicious.Detections — The sub analysis detection statuses
- DBotScore.Malicious.SHA1 — The SHA1 of the file
- InfoFile.Name — FileName
- InfoFile.EntryID — The EntryID of the sample
- InfoFile.Size — File Size
- InfoFile.Type — File type e.g. "PE"
- InfoFile.Info — Basic information of the file
- File.Extension — File Extension
- InfoFile — Report file object
- File — File object
- Joe.Analysis — Joe analysis object
- DBotScore — DBotScore object
- DBotScore.Malicious — DBotScore malicious object
Commands used
- joe-analysis-info
- joe-analysis-submit-url
- joe-download-report