Detonate File - Lastline v2

Detonates a File using the Lastline sandbox. Lastline supports the following File Types: EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH

Lastline · 11 tasks · 3 inputs · 38 outputs

Details

ID	`Detonate File - Lastline v2`
From Version	5.0.0
Tasks	11

README

Detonates a file using the Lastline sandbox.

Lastline supports the following File Types:
EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

Commands

lastline-get-report
lastline-check-status
lastline-upload-file

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file to detonate. The file is taken from the context.	None	File	Optional
Interval	The polling frequency. How often the polling command should run (in minutes).	1	-	Optional
Timeout	The amount of time to wait before a timeout occurs (in minutes).	15	-	Optional

Playbook Outputs

Path	Description	Type
DBotScore.Type	The type of the indicator (only in case of report type=json).	string
InfoFile.EntryID	The EntryID of the report file.	string
DBotScore.Vendor	The vendor used to calculate the score (only in case of report type=json).	string
IP.Address	The IP addresses’s relevant to the sample.	string
DBotScore.Score	The actual score (only in case of report type=json).	number
DBotScore.Indicator	The indicator that was tested (only in case of report type=json).	string
InfoFile.Extension	The extension of the report file.	string
InfoFile.Name	The name of the report file.	string
InfoFile.Info	The info of the report file.	string
InfoFile.Size	The size of the report file.	number
InfoFile.Type	The type of the report file.	string
URL.Data	The list of malicious URLs identified by Lastline analysis.	string
URL.Malicious.Vendor	The vendor that made the decision that the URL is malicious.	string
URL.Malicious.Description	The reason the vendor made the decision that the URL is malicious.	string
URL.Malicious.Score	The score from the vendor that decided the URL is malicious.	number
File.MD5	The bad MD5 hash of the file.	string
File.SHA1	The bad SHA1 hash of the file.	string
File.SHA256	The bad SHA256 hash of the file.	string
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
File.Malicious.Score	The score from the vendor that made the decision that the file is malicious.	number
Lastline.Submission.Status	The status of the submission.	string
Lastline.Submission.DNSqueries	The list of DNS queries done by the analysis subject.	string
Lastline.Submission.NetworkConnections	The list of network connections done by the analysis subject.	string
Lastline.Submission.DownloadedFiles	The list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.	string
Lastline.Submission.UUID	The task UUID of submitted sample.	number
Lastline.Submission.YaraSignatures.name	The Yara signature’s name.	string
Lastline.Submission.YaraSignatures.score	The score according to the yara signatures. Must be from 0 to 100.	number
Lastline.Submission.Process.arguments	The argument of the process.	string
Lastline.Submission.Process.process_id	The process ID.	string
Lastline.Submission.Process.executable.abs_path	The absolute path of the executable of the process.	string
Lastline.Submission.Process.executable.filename	The filename of the executable.	string
Lastline.Submission.Process.executable.yara_signature_hits	The Yara signature of the executable of the process.	string
Lastline.Submission.Process.executable.ext_info	The executable info of the process.	string
Lastline.Submission.YaraSignatures.internal	Whether the signature is only for internal usage.	boolean
File	The file object.	unknown
File.Malicious	The file’s malicious object.	unknown
DBotScore	The DBot score object.	unknown
Lastline.Submission	The Lastline submission object.	unknown

Playbook Image

Detonate_File_Lastline_v2

Inputs

File — The file to detonate. File is taken from the context.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

DBotScore.Type — The type of the indicator (only in case of report type=json)
InfoFile.EntryID — The EntryID of the report file
DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
IP.Address — IP's relevant to the sample
DBotScore.Score — The actual score (only in case of report type=json)
DBotScore.Indicator — The indicator we tested (only in case of report type=json)
InfoFile.Extension — The extension of the report file
InfoFile.Name — The name of the report file
InfoFile.Info — The info of the report file
InfoFile.Size — The size of the report file
InfoFile.Type — The type of the report file
URL.Data — List of malicious URLs identified by Lastline analysis
URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
URL.Malicious.Description — For malicious URLs, the reason for the vendor to make the decision
URL.Malicious.Score — For malicious URLs, the score from the vendor
File.MD5 — Bad hash MD5
File.SHA1 — Bad hash SHA1
File.SHA256 — Bad hash SHA256
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Malicious.Score — For malicious files, the score from the vendor
Lastline.Submission.Status — Status of the submission
Lastline.Submission.DNSqueries — List of DNS queries done by the analysis subject
Lastline.Submission.NetworkConnections — ist of network connections done by the analysis subject
Lastline.Submission.DownloadedFiles — List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
Lastline.Submission.UUID — Task UUID of submitted sample
Lastline.Submission.YaraSignatures.name — Yara signatures name
Lastline.Submission.YaraSignatures.score — The score according to the yara signatures. from 0 to 100.
Lastline.Submission.Process.arguments — Argument of the process
Lastline.Submission.Process.process_id — The process ID
Lastline.Submission.Process.executable.abs_path — Absolute path of the executable of the process
Lastline.Submission.Process.executable.filename — Filename of the executable
Lastline.Submission.Process.executable.yara_signature_hits — Yara signature of the executable of the process
Lastline.Submission.Process.executable.ext_info — Executable info of the process
Lastline.Submission.YaraSignatures.internal — True if the signature is only for internal usage
File — File object
File.Malicious — File Malicious object
DBotScore — DBot score object
Lastline.Submission — Lastline submission object

Commands used

lastline-check-status lastline-get-report lastline-upload-file

Flowchart

Source

playbook-Detonate_File_-_Lastline_v2.yml

Download History Raw

id: Detonate File - Lastline v2
version: -1
name: Detonate File - Lastline v2
description: |-
  Detonates a File using the Lastline sandbox.
  Lastline supports the following File Types:
  EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH
fromversion: 5.0.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 2251b2ee-5743-45f5-81bf-7da8693c7b61
    type: start
    task:
      id: 2251b2ee-5743-45f5-81bf-7da8693c7b61
      version: -1
      name: ""
      description: '-'
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 36e16e34-4b51-4c85-8779-59527ffe8bd9
    type: playbook
    task:
      id: 36e16e34-4b51-4c85-8779-59527ffe8bd9
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      Ids:
        complex:
          root: Lastline
          accessor: Submission.UUID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: uuid
      PollingCommandName:
        simple: lastline-check-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: Lastline.Submission(val.Status != 'Completed').UUID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 0ce1a739-c653-4186-8767-1f18d0383462
    type: regular
    task:
      id: 0ce1a739-c653-4186-8767-1f18d0383462
      version: -1
      name: Lastline Get Report
      description: Get analysis report
      script: '|||lastline-get-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      threshold: {}
      uuid:
        complex:
          root: Lastline
          accessor: Submission.UUID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 6185e7bf-d4ea-428f-84f3-8f69c900e8e8
    type: title
    task:
      id: 6185e7bf-d4ea-428f-84f3-8f69c900e8e8
      version: -1
      name: Done
      description: finished
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: d3ca12aa-6550-4c88-81eb-e2a97b5c51b5
    type: condition
    task:
      id: d3ca12aa-6550-4c88-81eb-e2a97b5c51b5
      version: -1
      name: Is Lastline sandbox enabled?
      description: |
        Verify that there is a valid instance of Lastline enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Lastline v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 60,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: fea8caab-2280-4b3a-81ca-0477bc5d1854
    type: condition
    task:
      id: fea8caab-2280-4b3a-81ca-0477bc5d1854
      version: -1
      name: Is File type supported?
      description: Check if file type is supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 285,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 880a4474-6ff0-4426-83c3-38bbf36f090e
    type: regular
    task:
      id: 880a4474-6ff0-4426-83c3-38bbf36f090e
      version: -1
      name: Set File to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 285,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 823f4f10-b0d8-4c6b-8bc0-b7ec01897534
    type: condition
    task:
      id: 823f4f10-b0d8-4c6b-8bc0-b7ec01897534
      version: -1
      name: Is there a File to Detonate?
      description: Checks that there is a file in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 172.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: cec4ac98-aed7-4400-824b-2244a72dcc1a
    type: condition
    task:
      id: cec4ac98-aed7-4400-824b-2244a72dcc1a
      version: -1
      name: Filter UUIDs
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Lastline
                filters:
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: Lastline.Submission.Status
                      iscontext: true
                    right:
                      value:
                        simple: Completed
                accessor: Submission.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: 224d3a13-cd7a-405a-8241-4624625ab3d1
    type: regular
    task:
      id: 224d3a13-cd7a-405a-8241-4624625ab3d1
      version: -1
      name: Lastline Upload File
      description: Upload file for analysis
      script: '|||lastline-upload-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      EntryID:
        complex:
          root: inputs.File
          filters:
          - - operator: match
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
          accessor: EntryID
      threshold: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 457087e7-a34c-4635-86ed-0aff1ddd2c13
    type: regular
    task:
      id: 457087e7-a34c-4635-86ed-0aff1ddd2c13
      version: -1
      name: Lastline Check Status
      description: Check submissions status
      script: '|||lastline-check-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      uuid:
        complex:
          root: Lastline
          accessor: Submission.UUID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1785,
        "width": 840,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file to detonate. File is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: DBotScore.Type
  description: The type of the indicator (only in case of report type=json)
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score (only in case of report type=json)
  type: string
- contextPath: IP.Address
  description: IP's relevant to the sample
  type: string
- contextPath: DBotScore.Score
  description: The actual score (only in case of report type=json)
  type: number
- contextPath: DBotScore.Indicator
  description: The indicator we tested (only in case of report type=json)
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file
  type: string
- contextPath: URL.Data
  description: List of malicious URLs identified by Lastline analysis
  type: string
- contextPath: URL.Malicious.Vendor
  description: For malicious URLs, the vendor that made the decision
  type: string
- contextPath: URL.Malicious.Description
  description: For malicious URLs, the reason for the vendor to make the decision
  type: string
- contextPath: URL.Malicious.Score
  description: For malicious URLs, the score from the vendor
  type: number
- contextPath: File.MD5
  description: Bad hash MD5
  type: string
- contextPath: File.SHA1
  description: Bad hash SHA1
  type: string
- contextPath: File.SHA256
  description: Bad hash SHA256
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Score
  description: For malicious files, the score from the vendor
  type: number
- contextPath: Lastline.Submission.Status
  description: Status of the submission
  type: string
- contextPath: Lastline.Submission.DNSqueries
  description: List of DNS queries done by the analysis subject
  type: string
- contextPath: Lastline.Submission.NetworkConnections
  description: ist of network connections done by the analysis subject
  type: string
- contextPath: Lastline.Submission.DownloadedFiles
  description: List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
  type: string
- contextPath: Lastline.Submission.UUID
  description: Task UUID of submitted sample
  type: number
- contextPath: Lastline.Submission.YaraSignatures.name
  description: Yara signatures name
  type: string
- contextPath: Lastline.Submission.YaraSignatures.score
  description: The score according to the yara signatures. from 0 to 100.
  type: number
- contextPath: Lastline.Submission.Process.arguments
  description: Argument of the process
  type: string
- contextPath: Lastline.Submission.Process.process_id
  description: The process ID
  type: string
- contextPath: Lastline.Submission.Process.executable.abs_path
  description: Absolute path of the executable of the process
  type: string
- contextPath: Lastline.Submission.Process.executable.filename
  description: Filename of the executable
  type: string
- contextPath: Lastline.Submission.Process.executable.yara_signature_hits
  description: Yara signature of the executable of the process
  type: string
- contextPath: Lastline.Submission.Process.executable.ext_info
  description: Executable info of the process
  type: string
- contextPath: Lastline.Submission.YaraSignatures.internal
  description: True if the signature is only for internal usage
  type: boolean
- contextPath: File
  description: File object
  type: unknown
- contextPath: File.Malicious
  description: File Malicious object
  type: unknown
- contextPath: DBotScore
  description: DBot score object
  type: unknown
- contextPath: Lastline.Submission
  description: Lastline submission object
  type: unknown
tests:
- Detonate File - Generic Test