Detonate File From URL - ANYRUN Deprecated

Deprecated. Use ANY.RUN Detonate File [Windows, Linux, Android] instead.

ANY.RUN · 7 tasks · 3 inputs · 69 outputs

Details

IDDetonate File From URL - ANYRUN
From Version5.0.0
Tasks7

README

Detonates one or more remote files using the ANYRUN sandbox integration.
Returns relevant reports to the War Room and file reputations to the context data.
This type of analysis works only for direct download links.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • ANYRUN

Scripts

This playbook does not use any scripts.

Commands

  • anyrun-run-analysis
  • anyrun-get-report

Playbook Inputs

Name Description Default Value Source Required
URL The URL of the web file to detonate. None URL Optional
Interval The duration for executing the pooling (in minutes). 1 - Optional
Timeout The duration after which to stop pooling and to resume the playbook (in minutes). 15 - Optional

Playbook Outputs

Path Description Type
ANYRUN.Task.AnalysisDate The date and time the analysis was executed. String
ANYRUN.Task.Behavior.Category The category of a process behavior. String
ANYRUN.Task.Behavior.Action The actions performed by a process. String
ANYRUN.Task.Behavior.ThreatLevel The threat score associated with a process behavior. Number
ANYRUN.Task.Behavior.ProcessUUID The unique ID of the process whose behaviors are being profiled. String
ANYRUN.Task.Connection.Reputation The connection reputation. String
ANYRUN.Task.Connection.ProcessUUID The ID of the process that created the connection. String
ANYRUN.Task.Connection.ASN The connection autonomous system network. String
ANYRUN.Task.Connection.Country The connection country. String
ANYRUN.Task.Connection.Protocol The connection protocol. String
ANYRUN.Task.Connection.Port The connection port number. Number
ANYRUN.Task.Connection.IP The connection IP address number. String
ANYRUN.Task.DnsRequest.Reputation The reputation of the DNS request. String
ANYRUN.Task.DnsRequest.IP The IP addresses associated with a DNS request. Unknown
ANYRUN.Task.DnsRequest.Domain THe domain resolution of a DNS request. String
ANYRUN.Task.Threat.ProcessUUID The unique process ID from where the threat originated. String
ANYRUN.Task.Threat.Msg The threat message. String
ANYRUN.Task.Threat.Class The class of the threat. String
ANYRUN.Task.Threat.SrcPort The port on which the threat originated. Number
ANYRUN.Task.Threat.DstPort The destination port of the threat. Number
ANYRUN.Task.Threat.SrcIP THe source IP address where the threat originated. String
ANYRUN.Task.Threat.DstIP The destination IP address of the threat. String
ANYRUN.Task.HttpRequest.Reputation The reputation of the HTTP request. String
ANYRUN.Task.HttpRequest.Country THe HTTP request country. String
ANYRUN.Task.HttpRequest.ProcessUUID The ID of the process making the HTTP request. String
ANYRUN.Task.HttpRequest.Body The HTTP request body parameters and details. Unknown
ANYRUN.Task.HttpRequest.HttpCode The HTTP request response code. Number
ANYRUN.Task.HttpRequest.Status The status of the HTTP request. String
ANYRUN.Task.HttpRequest.ProxyDetected Whether the HTTP request was made through a proxy. Boolean
ANYRUN.Task.HttpRequest.Port The HTTP request port. Number
ANYRUN.Task.HttpRequest.IP The HTTP request IP address. String
ANYRUN.Task.HttpRequest.URL The HTTP request URL. String
ANYRUN.Task.HttpRequest.Host The HTTP request host. String
ANYRUN.Task.HttpRequest.Method The HTTP request method type. String
ANYRUN.Task.FileInfo The details of the submitted file. String
ANYRUN.Task.OS The OS of the sandbox in which the file was analyzed. String
ANYRUN.Task.ID The unique ID of the task. String
ANYRUN.Task.MIME The MIME of the file submitted for analysis. String
ANYRUN.Task.MD5 The MD5 hash of the file submitted for analysis. String
ANYRUN.Task.SHA1 The SHA1 hash of the file submitted for analysis. String
ANYRUN.Task.SHA256 The SHA256 hash of the file submitted for analysis. String
ANYRUN.Task.SSDeep SSDeep hash of the file submitted for analysis. String
ANYRUN.Task.Verdict The ANY.RUN verdict for the maliciousness of the submitted file or URL. String
ANYRUN.Task.Process.FileName The file name of the process. String
ANYRUN.Task.Process.PID The process identification number. Number
ANYRUN.Task.Process.PPID The parent process identification number. Number
ANYRUN.Task.Process.ProcessUUID The unique process ID (used by ANY.RUN). String
ANYRUN.Task.Process.CMD The process command. String
ANYRUN.Task.Process.Path The path of the executed command. String
ANYRUN.Task.Process.User The user who executed the command. String
ANYRUN.Task.Process.IntegrityLevel The process integrity level. String
ANYRUN.Task.Process.ExitCode The process exit code. Number
ANYRUN.Task.Process.MainProcess Whether the process is the main process. Boolean
ANYRUN.Task.Process.Version.Company The company responsible for the program executed. String
ANYRUN.Task.Process.Version.Description The description of the type of program. String
ANYRUN.Task.Process.Version.Version The version of the program executed. String
DBotScore.Indicator The indicator that was tested. String
DBotScore.Score The actual score. Number
DBotScore.Type The type of indicator. String
DBotScore.Vendor The vendor used to calculate the score. String
File.Extension The extension of the file submitted for analysis. String
File.Name The name of the file submitted for analysis. String
File.MD5 The MD5 hash of the file submitted for analysis. String
File.SHA1 The SHA1 hash of the file submitted for analysis. String
File.SHA256 The SHA256 hash of the file submitted for analysis. String
File.SSDeep The SSDeep hash of the file submitted for analysis. String
File.Malicious.Vendor The vendor that made the decision that decided the file is malicious. String
File.Malicious.Description The reason that the vendor made the decision that decided the file is malicious. String
ANYRUN.Task.Status The task analysis status. String

Playbook Image

Detonate_File_From_URL_ANYRUN

Inputs

  • URL — URL of the web file to detonate.
  • Interval — Duration for executing the pooling (in minutes)
  • Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)

Outputs

  • ANYRUN.Task.AnalysisDate — Date and time the analysis was executed.
  • ANYRUN.Task.Behavior.Category — Category of a process behavior.
  • ANYRUN.Task.Behavior.Action — Actions performed by a process.
  • ANYRUN.Task.Behavior.ThreatLevel — Threat score associated with a process behavior.
  • ANYRUN.Task.Behavior.ProcessUUID — Unique ID of the process whose behaviors are being profiled.
  • ANYRUN.Task.Connection.Reputation — Connection reputation.
  • ANYRUN.Task.Connection.ProcessUUID — ID of the process that created the connection.
  • ANYRUN.Task.Connection.ASN — Connection autonomous system network.
  • ANYRUN.Task.Connection.Country — Connection country.
  • ANYRUN.Task.Connection.Protocol — Connection protocol.
  • ANYRUN.Task.Connection.Port — Connection port number.
  • ANYRUN.Task.Connection.IP — Connection IP number.
  • ANYRUN.Task.DnsRequest.Reputation — Reputation of the DNS request.
  • ANYRUN.Task.DnsRequest.IP — IP addresses associated with a DNS request.
  • ANYRUN.Task.DnsRequest.Domain — Domain resolution of a DNS request.
  • ANYRUN.Task.Threat.ProcessUUID — Unique process ID from where the threat originated.
  • ANYRUN.Task.Threat.Msg — Threat message.
  • ANYRUN.Task.Threat.Class — Class of the threat.
  • ANYRUN.Task.Threat.SrcPort — Port on which the threat originated.
  • ANYRUN.Task.Threat.DstPort — Destination port of the threat.
  • ANYRUN.Task.Threat.SrcIP — Source IP address where the threat originated.
  • ANYRUN.Task.Threat.DstIP — Destination IP address of the threat.
  • ANYRUN.Task.HttpRequest.Reputation — Reputation of the HTTP request.
  • ANYRUN.Task.HttpRequest.Country — HTTP request country.
  • ANYRUN.Task.HttpRequest.ProcessUUID — ID of the process making the HTTP request.
  • ANYRUN.Task.HttpRequest.Body — HTTP request body parameters and details.
  • ANYRUN.Task.HttpRequest.HttpCode — HTTP request response code.
  • ANYRUN.Task.HttpRequest.Status — Status of the HTTP request.
  • ANYRUN.Task.HttpRequest.ProxyDetected — Whether the HTTP request was made through a proxy.
  • ANYRUN.Task.HttpRequest.Port — HTTP request port.
  • ANYRUN.Task.HttpRequest.IP — HTTP request IP address.
  • ANYRUN.Task.HttpRequest.URL — HTTP request URL.
  • ANYRUN.Task.HttpRequest.Host — HTTP request host.
  • ANYRUN.Task.HttpRequest.Method — HTTP request method type.
  • ANYRUN.Task.FileInfo — Details of the submitted file.
  • ANYRUN.Task.OS — OS of the sandbox in which the file was analyzed.
  • ANYRUN.Task.ID — The unique ID of the task.
  • ANYRUN.Task.MIME — The MIME of the file submitted for analysis.
  • ANYRUN.Task.MD5 — The MD5 hash of the file submitted for analysis.
  • ANYRUN.Task.SHA1 — The SHA1 hash of the file submitted for analysis.
  • ANYRUN.Task.SHA256 — The SHA256 hash of the file submitted for analysis.
  • ANYRUN.Task.SSDeep — SSDeep hash of the file submitted for analysis.
  • ANYRUN.Task.Verdict — ANY.RUN verdict for the maliciousness of the submitted file or URL.
  • ANYRUN.Task.Process.FileName — File name of the process.
  • ANYRUN.Task.Process.PID — Process identification number.
  • ANYRUN.Task.Process.PPID — Parent process identification number.
  • ANYRUN.Task.Process.ProcessUUID — Unique process ID (used by ANY.RUN).
  • ANYRUN.Task.Process.CMD — Process command.
  • ANYRUN.Task.Process.Path — Path of the executed command.
  • ANYRUN.Task.Process.User — User who executed the command.
  • ANYRUN.Task.Process.IntegrityLevel — The process integrity level.
  • ANYRUN.Task.Process.ExitCode — Process exit code.
  • ANYRUN.Task.Process.MainProcess — Whether the process is the main process.
  • ANYRUN.Task.Process.Version.Company — Company responsible for the program executed.
  • ANYRUN.Task.Process.Version.Description — Description of the type of program.
  • ANYRUN.Task.Process.Version.Version — Version of the program executed.
  • DBotScore.Indicator — The indicator that was tested.
  • DBotScore.Score — The actual score.
  • DBotScore.Type — Type of indicator.
  • DBotScore.Vendor — Vendor used to calculate the score.
  • File.Extension — Extension of the file submitted for analysis.
  • File.Name — The name of the file submitted for analysis.
  • File.MD5 — MD5 hash of the file submitted for analysis.
  • File.SHA1 — SHA1 hash of the file submitted for analysis.
  • File.SHA256 — SHA256 hash of the file submitted for analysis.
  • File.SSDeep — SSDeep hash of the file submitted for analysis.
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision.
  • File.Malicious.Description — For malicious files, the reason that the vendor made the decision.
  • ANYRUN.Task.Status — Task analysis status.

Commands used

anyrun-get-report anyrun-run-analysis

Flowchart

yes yes Start Start ANYRUN Submit File from URL for Analysis - anyrun-run-analysis ANYRUN Submit File from U... anyrun-run-analysis GenericPolling - GenericPolling GenericPolling GenericPolling ANYRUN Get Report - anyrun-get-report ANYRUN Get Report anyrun-get-report Done Done Is there a download URL to detonate? Is there a download URL t... Is ANYRUN sandbox enabled? Is ANYRUN sandbox enabled?

Source

playbook-Detonate_File_From_URL_-_ANYRUN.yml
Download History Raw 
id: Detonate File From URL - ANYRUN
version: -1
name: Detonate File From URL - ANYRUN
deprecated: true
description: Deprecated. Use ANY.RUN Detonate File [Windows, Linux, Android] instead.
fromversion: 5.0.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: b04c121d-294e-4dd0-8148-d9fe0f44be04
    type: start
    task:
      id: b04c121d-294e-4dd0-8148-d9fe0f44be04
      version: -1
      name: ""
      description: Start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 1abf1e54-1633-41fb-80b5-00a994d7c4b5
    type: regular
    task:
      id: 1abf1e54-1633-41fb-80b5-00a994d7c4b5
      version: -1
      name: ANYRUN Submit File from URL for Analysis
      description: Submit a file or url for analysis.
      script: ANYRUN|||anyrun-run-analysis
      type: regular
      iscommand: true
      brand: ANYRUN
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      env_bitness: {}
      env_type: {}
      env_version: {}
      file: {}
      obj_type:
        simple: download
      obj_url:
        complex:
          root: inputs.URL
          accessor: Data
      opt_kernel_heavyevasion: {}
      opt_network_connect: {}
      opt_privacy_type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: faf98979-d9b0-4fcd-86e5-0004f3b98603
    type: playbook
    task:
      id: faf98979-d9b0-4fcd-86e5-0004f3b98603
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Ids:
        complex:
          root: ANYRUN
          accessor: Task.ID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: task
      PollingCommandName:
        simple: anyrun-get-report
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: ANYRUN.Task(val.Status != 'done').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 371e111a-9263-4708-86ae-961495255ff9
    type: regular
    task:
      id: 371e111a-9263-4708-86ae-961495255ff9
      version: -1
      name: ANYRUN Get Report
      description: Get the report for a task created for a submitted file or url.
      script: ANYRUN|||anyrun-get-report
      type: regular
      iscommand: true
      brand: ANYRUN
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      task:
        complex:
          root: ANYRUN
          accessor: Task.ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 7e59cb60-98d6-49a0-8c7f-522c1247ee73
    type: title
    task:
      id: 7e59cb60-98d6-49a0-8c7f-522c1247ee73
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: a1d00028-5388-4ea3-8877-cb5b7fb2a5d0
    type: condition
    task:
      id: a1d00028-5388-4ea3-8877-cb5b7fb2a5d0
      version: -1
      name: Is there a download URL to detonate?
      description: Look for file URLs to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 57c1be55-35b0-4527-83e8-66cc23fc33c9
    type: condition
    task:
      id: 57c1be55-35b0-4527-83e8-66cc23fc33c9
      version: -1
      name: Is ANYRUN sandbox enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ANYRUN
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: state
            iscontext: true
          right:
            value:
              simple: active
    view: |-
      {
        "position": {
          "x": 275,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
  required: false
  description: URL of the web file to detonate.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Duration for executing the pooling (in minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: The duration after which to stop pooling and to resume the playbook (in minutes)
outputs:
- contextPath: ANYRUN.Task.AnalysisDate
  description: Date and time the analysis was executed.
  type: String
- contextPath: ANYRUN.Task.Behavior.Category
  description: Category of a process behavior.
  type: String
- contextPath: ANYRUN.Task.Behavior.Action
  description: Actions performed by a process.
  type: String
- contextPath: ANYRUN.Task.Behavior.ThreatLevel
  description: Threat score associated with a process behavior.
  type: Number
- contextPath: ANYRUN.Task.Behavior.ProcessUUID
  description: Unique ID of the process whose behaviors are being profiled.
  type: String
- contextPath: ANYRUN.Task.Connection.Reputation
  description: Connection reputation.
  type: String
- contextPath: ANYRUN.Task.Connection.ProcessUUID
  description: ID of the process that created the connection.
  type: String
- contextPath: ANYRUN.Task.Connection.ASN
  description: Connection autonomous system network.
  type: String
- contextPath: ANYRUN.Task.Connection.Country
  description: Connection country.
  type: String
- contextPath: ANYRUN.Task.Connection.Protocol
  description: Connection protocol.
  type: String
- contextPath: ANYRUN.Task.Connection.Port
  description: Connection port number.
  type: Number
- contextPath: ANYRUN.Task.Connection.IP
  description: Connection IP number.
  type: String
- contextPath: ANYRUN.Task.DnsRequest.Reputation
  description: Reputation of the DNS request.
  type: String
- contextPath: ANYRUN.Task.DnsRequest.IP
  description: IP addresses associated with a DNS request.
  type: Unknown
- contextPath: ANYRUN.Task.DnsRequest.Domain
  description: Domain resolution of a DNS request.
  type: String
- contextPath: ANYRUN.Task.Threat.ProcessUUID
  description: Unique process ID from where the threat originated.
  type: String
- contextPath: ANYRUN.Task.Threat.Msg
  description: Threat message.
  type: String
- contextPath: ANYRUN.Task.Threat.Class
  description: Class of the threat.
  type: String
- contextPath: ANYRUN.Task.Threat.SrcPort
  description: Port on which the threat originated.
  type: Number
- contextPath: ANYRUN.Task.Threat.DstPort
  description: Destination port of the threat.
  type: Number
- contextPath: ANYRUN.Task.Threat.SrcIP
  description: Source IP address where the threat originated.
  type: String
- contextPath: ANYRUN.Task.Threat.DstIP
  description: Destination IP address of the threat.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Reputation
  description: Reputation of the HTTP request.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Country
  description: HTTP request country.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.ProcessUUID
  description: ID of the process making the HTTP request.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Body
  description: HTTP request body parameters and details.
  type: Unknown
- contextPath: ANYRUN.Task.HttpRequest.HttpCode
  description: HTTP request response code.
  type: Number
- contextPath: ANYRUN.Task.HttpRequest.Status
  description: Status of the HTTP request.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.ProxyDetected
  description: Whether the HTTP request was made through a proxy.
  type: Boolean
- contextPath: ANYRUN.Task.HttpRequest.Port
  description: HTTP request port.
  type: Number
- contextPath: ANYRUN.Task.HttpRequest.IP
  description: HTTP request IP address.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.URL
  description: HTTP request URL.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Host
  description: HTTP request host.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Method
  description: HTTP request method type.
  type: String
- contextPath: ANYRUN.Task.FileInfo
  description: Details of the submitted file.
  type: String
- contextPath: ANYRUN.Task.OS
  description: OS of the sandbox in which the file was analyzed.
  type: String
- contextPath: ANYRUN.Task.ID
  description: The unique ID of the task.
  type: String
- contextPath: ANYRUN.Task.MIME
  description: The MIME of the file submitted for analysis.
  type: String
- contextPath: ANYRUN.Task.MD5
  description: The MD5 hash of the file submitted for analysis.
  type: String
- contextPath: ANYRUN.Task.SHA1
  description: The SHA1 hash of the file submitted for analysis.
  type: String
- contextPath: ANYRUN.Task.SHA256
  description: The SHA256 hash of the file submitted for analysis.
  type: String
- contextPath: ANYRUN.Task.SSDeep
  description: SSDeep hash of the file submitted for analysis.
  type: String
- contextPath: ANYRUN.Task.Verdict
  description: ANY.RUN verdict for the maliciousness of the submitted file or URL.
  type: String
- contextPath: ANYRUN.Task.Process.FileName
  description: File name of the process.
  type: String
- contextPath: ANYRUN.Task.Process.PID
  description: Process identification number.
  type: Number
- contextPath: ANYRUN.Task.Process.PPID
  description: Parent process identification number.
  type: Number
- contextPath: ANYRUN.Task.Process.ProcessUUID
  description: Unique process ID (used by ANY.RUN).
  type: String
- contextPath: ANYRUN.Task.Process.CMD
  description: Process command.
  type: String
- contextPath: ANYRUN.Task.Process.Path
  description: Path of the executed command.
  type: String
- contextPath: ANYRUN.Task.Process.User
  description: User who executed the command.
  type: String
- contextPath: ANYRUN.Task.Process.IntegrityLevel
  description: The process integrity level.
  type: String
- contextPath: ANYRUN.Task.Process.ExitCode
  description: Process exit code.
  type: Number
- contextPath: ANYRUN.Task.Process.MainProcess
  description: Whether the process is the main process.
  type: Boolean
- contextPath: ANYRUN.Task.Process.Version.Company
  description: Company responsible for the program executed.
  type: String
- contextPath: ANYRUN.Task.Process.Version.Description
  description: Description of the type of program.
  type: String
- contextPath: ANYRUN.Task.Process.Version.Version
  description: Version of the program executed.
  type: String
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: String
- contextPath: DBotScore.Score
  description: The actual score.
  type: Number
- contextPath: DBotScore.Type
  description: Type of indicator.
  type: String
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: String
- contextPath: File.Extension
  description: Extension of the file submitted for analysis.
  type: String
- contextPath: File.Name
  description: The name of the file submitted for analysis.
  type: String
- contextPath: File.MD5
  description: MD5 hash of the file submitted for analysis.
  type: String
- contextPath: File.SHA1
  description: SHA1 hash of the file submitted for analysis.
  type: String
- contextPath: File.SHA256
  description: SHA256 hash of the file submitted for analysis.
  type: String
- contextPath: File.SSDeep
  description: SSDeep hash of the file submitted for analysis.
  type: String
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision.
  type: String
- contextPath: File.Malicious.Description
  description: For malicious files, the reason that the vendor made the decision.
  type: String
- contextPath: ANYRUN.Task.Status
  description: Task analysis status.
  type: String
tests:
- Detonate File From URL - ANYRUN - Test