Detonate File - Lastline

Detonates a File using the Lastline sandbox. Lastline supports the following File Types: EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH

Lastline · 11 tasks · 3 inputs · 38 outputs

Details

IDDetonate File - Lastline
From Version5.0.0
Tasks11

README

Detonates a File using the Lastline sandbox.

Lastline supports the following File Types:
EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

  • lastline-upload-file
  • lastline-get-report
  • lastline-check-status

Playbook Inputs

Name Description Default Value Source Required
File The file to detonate. The file is taken from the context. None File Optional
Interval The polling frequency. How often the polling command should run (in minutes). 1 - Optional
Timeout How much time to wait before a timeout occurs (in minutes). 15 - Optional

Playbook Outputs

Path Description Type
DBotScore.Type The type of the indicator (only in case of report type=json). string
InfoFile.EntryID The EntryID of the report file. string
DBotScore.Vendor The vendor used to calculate the score (only in case of report type=json). string
IP.Address The IP address’s relevant to the sample. string
DBotScore.Score The actual score (only in case of report type=json). number
DBotScore.Indicator The indicator we tested (only in case of report type=json). string
InfoFile.Extension The extension of the report file. string
InfoFile.Name The name of the report file. string
InfoFile.Info The info of the report file. string
InfoFile.Size The size of the report file. number
InfoFile.Type The type of the report file. string
URL.Data The list of malicious URLs identified by Lastline analysis. string
URL.Malicious.Vendor The vendor that made the decision that the URL is malicious. string
URL.Malicious.Description The reason for the vendor to make the decision that the URL is malicious. string
URL.Malicious.Score The score from the vendor that the URL is malicious. number
File.MD5 The bad MD5 hash of the file. string
File.SHA1 The bad SHA1 hash of the file. string
File.SHA256 The bad SHA256 hash of the file. string
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
File.Malicious.Score The score from the vendor that the file is malicious. number
Lastline.Submission.Status The status of the submission. string
Lastline.Submission.DNSqueries The list of DNS queries done by the analysis subject. string
Lastline.Submission.NetworkConnections The list of network connections done by the analysis subject. string
Lastline.Submission.DownloadedFiles The list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element. string
Lastline.Submission.UUID The task UUID of the submitted sample. number
Lastline.Submission.YaraSignatures.name The Yara signatures name. string
Lastline.Submission.YaraSignatures.score The score according to the Yara signatures. Must be between 0 to 100. number
Lastline.Submission.Process.arguments The argument of the process. string
Lastline.Submission.Process.process_id The process ID. string
Lastline.Submission.Process.executable.abs_path The absolute path of the executable of the process. string
Lastline.Submission.Process.executable.filename The filename of the executable. string
Lastline.Submission.Process.executable.yara_signature_hits The Yara signature of the executable of the process. string
Lastline.Submission.Process.executable.ext_info The executable info of the process. string
Lastline.Submission.YaraSignatures.internal Whether the signature is only for internal usage. “True” if yes. boolean
File The file object. unknown
File.Malicious The file malicious object. unknown
DBotScore The DBot score object. unknown
Lastline.Submission The Lastline submission object. unknown

Playbook Image

Detonate_File_Lastline

Inputs

  • File — The file to detonate. File is taken from the context.
  • Interval — Polling frequency - how often the polling command should run (minutes)
  • Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

  • DBotScore.Type — The type of the indicator (only in case of report type=json)
  • InfoFile.EntryID — The EntryID of the report file
  • DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
  • IP.Address — IP's relevant to the sample
  • DBotScore.Score — The actual score (only in case of report type=json)
  • DBotScore.Indicator — The indicator we tested (only in case of report type=json)
  • InfoFile.Extension — The extension of the report file
  • InfoFile.Name — The name of the report file
  • InfoFile.Info — The info of the report file
  • InfoFile.Size — The size of the report file
  • InfoFile.Type — The type of the report file
  • URL.Data — List of malicious URLs identified by Lastline analysis
  • URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
  • URL.Malicious.Description — For malicious URLs, the reason for the vendor to make the decision
  • URL.Malicious.Score — For malicious URLs, the score from the vendor
  • File.MD5 — Bad hash MD5
  • File.SHA1 — Bad hash SHA1
  • File.SHA256 — Bad hash SHA256
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • File.Malicious.Score — For malicious files, the score from the vendor
  • Lastline.Submission.Status — Status of the submission
  • Lastline.Submission.DNSqueries — List of DNS queries done by the analysis subject
  • Lastline.Submission.NetworkConnections — ist of network connections done by the analysis subject
  • Lastline.Submission.DownloadedFiles — List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
  • Lastline.Submission.UUID — Task UUID of submitted sample
  • Lastline.Submission.YaraSignatures.name — Yara signatures name
  • Lastline.Submission.YaraSignatures.score — The score according to the yara signatures. from 0 to 100.
  • Lastline.Submission.Process.arguments — Argument of the process
  • Lastline.Submission.Process.process_id — The process ID
  • Lastline.Submission.Process.executable.abs_path — Absolute path of the executable of the process
  • Lastline.Submission.Process.executable.filename — Filename of the executable
  • Lastline.Submission.Process.executable.yara_signature_hits — Yara signature of the executable of the process
  • Lastline.Submission.Process.executable.ext_info — Executable info of the process
  • Lastline.Submission.YaraSignatures.internal — True if the signature is only for internal usage
  • File — File object
  • File.Malicious — File Malicious object
  • DBotScore — DBot score object
  • Lastline.Submission — Lastline submission object

Commands used

lastline-check-status lastline-get-report lastline-upload-file

Flowchart

yes yes yes yes Start Start GenericPolling - GenericPolling GenericPolling GenericPolling Lastline Get Report - lastline-get-report Lastline Get Report lastline-get-report Done Done Is Lastline sandbox enabled? Is Lastline sandbox enabled? Is File type supported? Is File type supported? Set File to context - Set Set File to context Set Is there a File to Detonate? Is there a File to Detonate? Filter UUIDs Filter UUIDs Lastline Upload File - lastline-upload-file Lastline Upload File lastline-upload-file Lastline Check Status - lastline-check-status Lastline Check Status lastline-check-status

Source

playbook-Detonate_File_-_Lastline.yml playbook-Detonate_File_-_Lastline_v2.yml playbook-Detonate_File_-_Lastline_v2_README.md
Download History Raw 
Detonates a file using the Lastline sandbox.

Lastline supports the following File Types:
EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
* GenericPolling

### Integrations
This playbook does not use any integrations.

### Scripts
* Set

### Commands
* lastline-get-report
* lastline-check-status
* lastline-upload-file

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Source** | **Required** |
| --- | --- | --- | --- | --- |
| File | The file to detonate. The file is taken from the context. | None | File | Optional |
| Interval | The polling frequency. How often the polling command should run (in minutes). | 1 | - | Optional |
| Timeout | The amount of time to wait before a timeout occurs (in minutes). | 15 |-  | Optional |

## Playbook Outputs
---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| DBotScore.Type | The type of the indicator (only in case of report type=json). | string |
| InfoFile.EntryID | The EntryID of the report file. | string |
| DBotScore.Vendor | The vendor used to calculate the score (only in case of report type=json). | string |
| IP.Address | The IP addresses's relevant to the sample. | string |
| DBotScore.Score | The actual score (only in case of report type=json). | number |
| DBotScore.Indicator | The indicator that was tested (only in case of report type=json). | string |
| InfoFile.Extension | The extension of the report file. | string |
| InfoFile.Name | The name of the report file. | string |
| InfoFile.Info | The info of the report file. | string |
| InfoFile.Size | The size of the report file. | number |
| InfoFile.Type | The type of the report file. | string |
| URL.Data | The list of malicious URLs identified by Lastline analysis. | string |
| URL.Malicious.Vendor | The vendor that made the decision that the URL is malicious. | string |
| URL.Malicious.Description | The reason the vendor made the decision that the URL is malicious. | string |
| URL.Malicious.Score | The score from the vendor that decided the URL is malicious. | number |
| File.MD5 | The bad MD5 hash of the file. | string |
| File.SHA1 | The bad SHA1 hash of the file. | string |
| File.SHA256 | The bad SHA256 hash of the file. | string |
| File.Malicious.Vendor | The vendor that made the decision that the file is malicious. | string |
| File.Malicious.Score | The score from the vendor that made the decision that the file is malicious. | number |
| Lastline.Submission.Status | The status of the submission. | string |
| Lastline.Submission.DNSqueries | The list of DNS queries done by the analysis subject. | string |
| Lastline.Submission.NetworkConnections | The list of network connections done by the analysis subject. | string |
| Lastline.Submission.DownloadedFiles | The list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element. | string |
| Lastline.Submission.UUID | The task UUID of submitted sample. | number |
| Lastline.Submission.YaraSignatures.name | The Yara signature's name. | string |
| Lastline.Submission.YaraSignatures.score | The score according to the yara signatures. Must be from 0 to 100. | number |
| Lastline.Submission.Process.arguments | The argument of the process. | string |
| Lastline.Submission.Process.process_id | The process ID. | string |
| Lastline.Submission.Process.executable.abs_path | The absolute path of the executable of the process. | string |
| Lastline.Submission.Process.executable.filename | The filename of the executable. | string |
| Lastline.Submission.Process.executable.yara_signature_hits | The Yara signature of the executable of the process. | string |
| Lastline.Submission.Process.executable.ext_info | The executable info of the process. | string |
| Lastline.Submission.YaraSignatures.internal | Whether the signature is only for internal usage. | boolean |
| File | The file object. | unknown |
| File.Malicious | The file's malicious object. | unknown |
| DBotScore | The DBot score object. | unknown |
| Lastline.Submission | The Lastline submission object. | unknown |

## Playbook Image
---
![Detonate_File_Lastline_v2](../doc_files/Detonate_File_-_Lastline_v2.png)