File Enrichment - VMRay

Get file information using the VMRay integration.

VMRay Analyzer · 10 tasks · 3 inputs · 25 outputs

Details

IDFile Enrichment - VMRay
From Version5.0.0
Tasks10

README

Get file information using the VMRay integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • VMRay

Scripts

  • IsIntegrationAvailable

Commands

  • vmray-get-sample-by-hash

Playbook Inputs

Name Description Default Value Required
MD5 File MD5 to enrich File.MD5 Optional
SHA256 File SHA256 to enrich File.SHA256 Optional
SHA1 File SHA1 to enrich File.SHA1 Optional

Playbook Outputs

Path Description Type
File.Name The full file name (including file extension). String
File.MD5 The MD5 hash of the file. String
File.SHA1 The SHA1 hash of the file. String
File.SHA256 The SHA256 hash of the file. String
File.SSDeep The SSDeep hash of the file. String
DBotScore.Indicator The indicator that was tested. String
DBotScore.Type The indicator type. String
DBotScore.Vendor The vendor used to calculate the score. String
DBotScore.Score The actual score. Number
DBotScore.Reliability String Reliability of the source providing the intelligence data.
VMRay.Sample.SampleID ID of the sample. Number
VMRay.Sample.SampleURL URL to sample page. String
VMRay.Sample.FileName File name of the sample. String
VMRay.Sample.MD5 MD5 hash of the sample. String
VMRay.Sample.SHA1 SHA1 hash of the sample. String
VMRay.Sample.SHA256 SHA256 hash of the sample. String
VMRay.Sample.SSDeep ssdeep hash of the sample. String
VMRay.Sample.Verdict Verdict for the sample (Malicious, Suspicious, Clean, Not Available). String
VMRay.Sample.VerdictReason Description of the Verdict Reason. String
VMRay.Sample.Severity Severity of the sample in the submission (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated. String
VMRay.Sample.Type File type. String
VMRay.Sample.Created Timestamp of sample creation. Date
VMRay.Sample.Classifications Classifications of the sample. String
VMRay.Sample.ChildSampleIDs List of child sample IDs. Number
VMRay.Sample.ParentSampleIDs List of parent sample IDs. Number

Playbook Image

File Enrichment - VMRay

Inputs

  • MD5 — File MD5 to enrich
  • SHA256 — File SHA256 to enrich
  • SHA1 — File SHA1 to enrich

Outputs

  • File.Name — The full file name (including file extension).
  • File.MD5 — The MD5 hash of the file.
  • File.SHA1 — The SHA1 hash of the file.
  • File.SHA256 — The SHA256 hash of the file.
  • File.SSDeep — The SSDeep hash of the file.
  • DBotScore.Indicator — The indicator that was tested.
  • DBotScore.Type — The indicator type.
  • DBotScore.Vendor — The vendor used to calculate the score.
  • DBotScore.Score — The actual score.
  • DBotScore.Reliability — Reliability of the source providing the intelligence data.
  • VMRay.Sample.SampleID — ID of the sample.
  • VMRay.Sample.SampleURL — URL to sample page.
  • VMRay.Sample.FileName — File name of the sample.
  • VMRay.Sample.MD5 — MD5 hash of the sample.
  • VMRay.Sample.SHA1 — SHA1 hash of the sample.
  • VMRay.Sample.SHA256 — SHA256 hash of the sample.
  • VMRay.Sample.SSDeep — ssdeep hash of the sample.
  • VMRay.Sample.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  • VMRay.Sample.VerdictReason — Description of the Verdict Reason.
  • VMRay.Sample.Severity — Severity of the sample in the submission (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  • VMRay.Sample.Type — File type.
  • VMRay.Sample.Created — Timestamp of sample creation.
  • VMRay.Sample.Classifications — Classifications of the sample.
  • VMRay.Sample.ChildSampleIDs — List of child sample IDs.
  • VMRay.Sample.ParentSampleIDs — List of parent sample IDs.

Commands used

vmray-get-sample-by-hash

Flowchart

yes yes yes yes Start Start Enrich hash using VMRay Enrich hash using VMRay Done Done Is there an MD5 hash? Is there an MD5 hash? Is there a SHA256 hash? Is there a SHA256 hash? Is there a SHA1 hash? Is there a SHA1 hash? Query sample based on the MD5 hash - vmray-get-sample-by-hash Query sample based on the... vmray-get-sample-by-hash Query sample based on the SHA256 hash - vmray-get-sample-by-hash Query sample based on the... vmray-get-sample-by-hash Query sample based on the SHA1 hash - vmray-get-sample-by-hash Query sample based on the... vmray-get-sample-by-hash Is there an active VMRay instance? - IsIntegrationAvailable Is there an active VMRay ... IsIntegrationAvailable

Source

playbook-VMRay-File-Enrichment.yml
Download History Raw 
id: File Enrichment - VMRay
version: -1
name: File Enrichment - VMRay
description: Get file information using the VMRay integration.
fromversion: 5.0.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 63ad8782-e5ae-415a-80d6-43c1c2b26127
    type: start
    task:
      id: 63ad8782-e5ae-415a-80d6-43c1c2b26127
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1155,
          "y": -23
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 0d05f9c8-84ff-4081-8e09-ea3cd7f49461
    type: title
    task:
      id: 0d05f9c8-84ff-4081-8e09-ea3cd7f49461
      version: -1
      name: Enrich hash using VMRay
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
      - "15"
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1155,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: ebfb7519-fff6-40ab-83b8-46d8ae3799a8
    type: title
    task:
      id: ebfb7519-fff6-40ab-83b8-46d8ae3799a8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1155,
          "y": 913
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 5a067997-8a9f-4c4a-845f-eb48152b9fc7
    type: condition
    task:
      id: 5a067997-8a9f-4c4a-845f-eb48152b9fc7
      version: -1
      name: Is there an MD5 hash?
      description: Check if there is an MD5 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "20"
    scriptarguments:
      value:
        simple: ${File.MD5}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 655,
          "y": 525
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 3f7d58d6-57e5-4c0d-8f44-036406d90bbe
    type: condition
    task:
      id: 3f7d58d6-57e5-4c0d-8f44-036406d90bbe
      version: -1
      name: Is there a SHA256 hash?
      description: Check if there is a SHA-256 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "21"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1655,
          "y": 525
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 31b51ec3-c7ce-4455-8b3c-766497378935
    type: condition
    task:
      id: 31b51ec3-c7ce-4455-8b3c-766497378935
      version: -1
      name: Is there a SHA1 hash?
      description: Check if there is a SHA-1 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "22"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1155,
          "y": 525
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: f73def74-6b82-4447-8e94-9a1128fe3fc3
    type: regular
    task:
      id: f73def74-6b82-4447-8e94-9a1128fe3fc3
      version: -1
      name: Query sample based on the MD5 hash
      description: Retrieves sample information by hash.
      script: vmray|||vmray-get-sample-by-hash
      type: regular
      iscommand: true
      brand: vmray
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      hash:
        complex:
          root: inputs.MD5
          transformers:
          - operator: uniq
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 655,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 827666c6-7052-47ab-8735-b4ebfc904fe7
    type: regular
    task:
      id: 827666c6-7052-47ab-8735-b4ebfc904fe7
      version: -1
      name: Query sample based on the SHA256 hash
      description: Retrieves sample information by hash.
      script: vmray|||vmray-get-sample-by-hash
      type: regular
      iscommand: true
      brand: vmray
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      hash:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: uniq
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1655,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 1383ed5d-5ef0-45a4-8e7d-a28ae8dec1ae
    type: regular
    task:
      id: 1383ed5d-5ef0-45a4-8e7d-a28ae8dec1ae
      version: -1
      name: Query sample based on the SHA1 hash
      description: Retrieves sample information by hash.
      script: vmray|||vmray-get-sample-by-hash
      type: regular
      iscommand: true
      brand: vmray
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      hash:
        complex:
          root: inputs.SHA1
          transformers:
          - operator: uniq
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1155,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 46498933-0736-4bd4-826e-44ace83c7794
    type: condition
    task:
      id: 46498933-0736-4bd4-826e-44ace83c7794
      version: -1
      name: Is there an active VMRay instance?
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "1"
    scriptarguments:
      brandname:
        simple: vmray
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1155,
          "y": 151
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "14_7_#default#": 0.37,
      "15_7_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 1001,
        "width": 1380,
        "x": 655,
        "y": -23
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: File MD5 to enrich
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: File SHA256 to enrich
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: File SHA1 to enrich
  playbookInputQuery:
outputs:
# Indicator outputs
- contextPath: File.Name
  description: The full file name (including file extension).
  type: String
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: String
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: String
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: String
- contextPath: File.SSDeep
  description: The SSDeep hash of the file.
  type: String
# DBotScore outputs
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: String
- contextPath: DBotScore.Type
  description: The indicator type.
  type: String
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: String
- contextPath: DBotScore.Score
  description: The actual score.
  type: Number
- contextPath: DBotScore.Reliability
  description: Reliability of the source providing the intelligence data.
  type: String
# VMRay outputs
- contextPath: VMRay.Sample.SampleID
  description: ID of the sample.
  type: Number
- contextPath: VMRay.Sample.SampleURL
  description: URL to sample page.
  type: String
- contextPath: VMRay.Sample.FileName
  description: File name of the sample.
  type: String
- contextPath: VMRay.Sample.MD5
  description: MD5 hash of the sample.
  type: String
- contextPath: VMRay.Sample.SHA1
  description: SHA1 hash of the sample.
  type: String
- contextPath: VMRay.Sample.SHA256
  description: SHA256 hash of the sample.
  type: String
- contextPath: VMRay.Sample.SSDeep
  description: ssdeep hash of the sample.
  type: String
- contextPath: VMRay.Sample.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean,
      Not Available).
  type: String
- contextPath: VMRay.Sample.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Sample.Severity
  description: Severity of the sample in the submission (Malicious, Suspicious,
    Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  type: String
- contextPath: VMRay.Sample.Type
  description: File type.
  type: String
- contextPath: VMRay.Sample.Created
  description: Timestamp of sample creation.
  type: Date
- contextPath: VMRay.Sample.Classifications
  description: Classifications of the sample.
  type: String
- contextPath: VMRay.Sample.ChildSampleIDs
  description: List of child sample IDs.
  type: Number
- contextPath: VMRay.Sample.ParentSampleIDs
  description: List of parent sample IDs.
  type: Number
tests:
- File Enrichment - VMRay - Test