Detonate File - VMRay

Detonates a file with VMRay.

VMRay Analyzer · 15 tasks · 3 inputs · 61 outputs

Inputs

  • File — The file to detonate.
  • interval — The frequency in which to poll for results (minutes).
  • timeout — The amount of time to wait before giving up waiting for results (minutes).

Outputs

  • VMRay.Job.JobID — The ID of a new job.
  • VMRay.Job.SampleID — The ID of sample.
  • VMRay.Job.Created — The timestamp of the created job.
  • VMRay.Job.VMName — The name of virtual machine.
  • VMRay.Job.VMID — The ID of virtual machine.
  • VMRay.Sample.SampleID — The sample ID of the task.
  • VMRay.Sample.Created — The timestamp of the created sample.
  • VMRay.Submission.SubmissionID — The submission ID.
  • VMRay.Submission.HadErrors — Whether there are any errors in the submission.
  • VMRay.Submission.IsFinished — The status of submission. Can be, "true" or "false".
  • VMRay.Submission.MD5 — The MD5 hash of the sample in submission.
  • VMRay.Submission.SHA1 — The SHA1 hash of the sample in submission.
  • VMRay.Submission.SHA256 — The SHA256 hash of the sample in submission.
  • VMRay.Submission.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  • VMRay.Submission.VerdictReason — Description of the Verdict Reason.
  • VMRay.Submission.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  • VMRay.Submission.SSDeep — The SSDeep hash of the sample in submission.
  • VMRay.Submission.SampleID — The ID of the sample in submission.
  • VMRay.Sample.FileName — The file name of the sample.
  • VMRay.Sample.MD5 — The MD5 hash of the sample.
  • VMRay.Sample.SHA1 — The SHA1 hash of the sample.
  • VMRay.Sample.SHA256 — The SHA256 hash of the sample.
  • VMRay.Sample.SSDeep — The SSDeep of the sample.
  • VMRay.Sample.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  • VMRay.Sample.VerdictReason — Description of the Verdict Reason.
  • VMRay.Sample.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  • VMRay.Sample.Type — The file type.
  • VMRay.Sample.Classifications — The classifications of the sample.
  • VMRay.Sample.IOC.URL.AnalysisID — The IDs of the other analyses that contain the given URL.
  • VMRay.Sample.IOC.URL.URL — The URL.
  • VMRay.Sample.IOC.URL.Operation — The operation of the specified URL.
  • VMRay.Sample.IOC.URL.ID — The ID of the URL.
  • VMRay.Sample.IOC.URL.Type — The type of the URL.
  • VMRay.Sample.IOC.Domain.AnalysisID — The IDs of the other analyses that contain the given domain.
  • VMRay.Sample.IOC.Domain.Domain — The domain.
  • VMRay.Sample.IOC.Domain.ID — The ID of the domain.
  • VMRay.Sample.IOC.Domain.Type — The type of the domain.
  • VMRay.Sample.IOC.IP.AnalysisID — The IDs of the other analyses that contain the given IP address.
  • VMRay.Sample.IOC.IP.IP — The IP address.
  • VMRay.Sample.IOC.IP.Operation — The operation of the given IP address.
  • VMRay.Sample.IOC.IP.ID — The ID of the IP address.
  • VMRay.Sample.IOC.IP.Type — The type of the IP address.
  • VMRay.Sample.IOC.Mutex.AnalysisID — The IDs of other analyses that contain the given IP address.
  • VMRay.Sample.IOC.Mutex.Name — The name of the mutex.
  • VMRay.Sample.IOC.Mutex.Operation — The operation of the given mutex
  • VMRay.Sample.IOC.Mutex.ID — The ID of the mutex.
  • VMRay.Sample.IOC.Mutex.Type — The type of the mutex.
  • VMRay.Sample.IOC.File.AnalysisID — The IDs of other analyses that contain the given file.
  • VMRay.Sample.IOC.File.Name — The name of the file.
  • VMRay.Sample.IOC.File.Operation — The operation of the given file.
  • VMRay.Sample.IOC.File.ID — The ID of the file.
  • VMRay.Sample.IOC.File.Type — The type of the file.
  • VMRay.Sample.IOC.File.Hashes.MD5 — The MD5 hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SSDeep — The SSDeep hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SHA256 — The SHA256 hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SHA1 — The SHA1 hash of the given file.
  • VMRay.ThreatIndicator.AnalysisID — The list of connected analysis IDs.
  • VMRay.ThreatIndicator.Category — The category of threat indicators.
  • VMRay.ThreatIndicator.Classification — The classifications of threat indicators.
  • VMRay.ThreatIndicator.ID — The ID of the threat indicator.
  • VMRay.ThreatIndicator.Operation — The operation that caused the indicators.

Commands used

vmray-get-analysis-by-sample vmray-get-iocs vmray-get-sample vmray-get-submission vmray-get-threat-indicators vmray-upload-sample

Flowchart

yes yes yes yes Start Start GenericPolling - GenericPolling GenericPolling GenericPolling Is there any file to detonate? Is there any file to deto... Send file to VMRay - vmray-upload-sample Send file to VMRay vmray-upload-sample Done Done Get sample - vmray-get-sample Get sample vmray-get-sample Get submission - vmray-get-submission Get submission vmray-get-submission Get analysis - vmray-get-analysis-by-sample Get analysis vmray-get-analysis-by-sample Is sample suspicious or malicious? Is sample suspicious or m... Get IOCs - vmray-get-iocs Get IOCs vmray-get-iocs Get Threat Indicators - vmray-get-threat-indicators Get Threat Indicators vmray-get-threat-indicators Is there an active VMRay instance? - IsIntegrationAvailable Is there an active VMRay ... IsIntegrationAvailable Is there a child submission? Is there a child submission? Get Child IOCs - vmray-get-iocs Get Child IOCs vmray-get-iocs Get Child VTIs - vmray-get-threat-indicators Get Child VTIs vmray-get-threat-indicators