id: Detonate File - Generic version: -1 name: Detonate File - Generic description: |- Detonate files through one or more active integrations that support file detonation. Supported integrations: - SecneurX Analysis - ANY.RUN Cloud Sandbox - McAfee Advanced Threat Defense - WildFire - Lastline - Cuckoo Sandbox - Cisco Secure Malware Analytics (ThreatGrid) - JoeSecurity - CrowdStrike Falcon Sandbox - FireEye AX - VMRay Analyzer - Polygon - CrowdStrike Falcon Intelligence Sandbox - OPSWAT Filescan. starttaskid: "0" tasks: "0": id: "0" taskid: bfe472b6-a9fd-40d6-846c-6219d9a54e72 type: start task: id: bfe472b6-a9fd-40d6-846c-6219d9a54e72 version: -1 name: "" description: Playbook start point iscommand: false brand: "" nexttasks: '#none#': - "9" - "14" - "15" - "19" - "20" - "23" - "24" - "25" - "27" - "29" - "30" - "31" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2415, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: b0feb039-1a24-4bcb-8a2c-e9124b61cfa0 type: title task: id: b0feb039-1a24-4bcb-8a2c-e9124b61cfa0 version: -1 name: Done description: Done type: title iscommand: false brand: "" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3295, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 053c6544-8faa-447a-893b-069da330da1e type: playbook task: id: 053c6544-8faa-447a-893b-069da330da1e version: -1 name: ATD - Detonate File description: |- Detonates a File using the McAfee Advanced Threat Defense sandbox. Advanced Threat Defense supports the following File Types: 32-bit Portable Executables (PE)files; 64-bit PE+files exe, sys, dll, com, scr, cpl, ocx, cgi Microsoft Office Suite documents doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar Just Systems Ichitaro documents jtd, jtdc Adobe pdf, swf Compressed files gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar Android application package apk, Java, JAR, CLASS, Java Script, Java bin files Image files jpeg, png, gif Other file types cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh playbookName: ATD - Detonate File type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File Interval: simple: "1" Timeout: simple: "15" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 50, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 13d629fd-83d1-4096-8e89-4d8ca6b4322e type: playbook task: id: 13d629fd-83d1-4096-8e89-4d8ca6b4322e version: -1 name: Detonate File - Lastline v2 description: |- Detonates a file using the Lastline sandbox. Lastline supports the following file types: EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH playbookName: Detonate File - Lastline v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File Interval: simple: "1" Timeout: simple: "15" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 480, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: d8ff24bf-a089-4590-89f1-6640c60c44ea type: playbook task: id: d8ff24bf-a089-4590-89f1-6640c60c44ea version: -1 name: Detonate File - Cuckoo description: Detonates a file using Cuckoo sandbox playbookName: Detonate File - Cuckoo type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File interval: simple: "1" timeout: simple: "10" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 910, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 1b28b735-33ac-4ddd-8649-6f05613db05d type: playbook task: id: 1b28b735-33ac-4ddd-8649-6f05613db05d version: -1 name: Detonate File - FireEye AX description: Detonate one or more files using the FireEye AX integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM, JPG, JPEG, GIF, PNG, XLSX playbookName: Detonate File - FireEye AX type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File Interval: simple: "1" Timeout: simple: "30" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1340, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 9d20f56a-244d-4697-8d0a-f8453eb7e638 type: playbook task: id: 9d20f56a-244d-4697-8d0a-f8453eb7e638 version: -1 name: Detonate File - VMRay description: Detonates a file using VMRay playbookName: Detonate File - VMRay type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File transformers: - operator: uniq interval: simple: "1" timeout: simple: "10" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1770, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: fd1dbf17-5b12-4369-86c7-8082f714df31 type: playbook task: id: fd1dbf17-5b12-4369-86c7-8082f714df31 version: -1 name: Detonate File - Group-IB TDS Polygon description: 'Detonate file using Group-IB TDS Polygon integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types: 7z, ace, ar, arj, bat, bz2, cab, chm, cmd, com, cpgz, cpl, csv, dat, doc, docm, docx, dot, dotm, dotx, eml, exe, gz, gzip, hta, htm, html, iqy, iso, jar, js, jse, lnk, lz, lzma, lzo, lzh, mcl, mht, msg, msi, msp, odp, ods, odt, ots, ott, pdf, pif, potm, potx, pps, ppsm, ppsx, ppt, pptm, pptx, ps1, pub, py, pyc, r*, rar, reg, rtf, scr, settingcontent-ms, stc, svg, sxc, sxw, tar, taz, .tb2, .tbz, .tbz2, tgz, tlz, txz, tzo, txt, url, uue, vbe, vbs, wsf, xar, xls, xlsb, xlsm, xlsx, xml, xz, z*, zip.' playbookName: Detonate File - Group-IB TDS Polygon type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: Interval: simple: "1" Timeout: simple: "60" file_id: complex: root: inputs.EntryID separatecontext: true continueonerrortype: "" view: |- { "position": { "x": 3510, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: c28803a1-9938-4fa0-8994-4f1d01f7e800 type: playbook task: id: c28803a1-9938-4fa0-8994-4f1d01f7e800 version: -1 name: Detonate File - SecneurX Analysis description: Detonates a file using the SecneurX Analysis Integration. Returns relevant reports to the War Room and file reputations to the context data. playbookName: Detonate File - SecneurX Analysis type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" separatecontext: true continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: f19de2c0-c4f0-4e34-8922-c319d40a1781 type: playbook task: id: f19de2c0-c4f0-4e34-8922-c319d40a1781 version: -1 name: Detonate File - JoeSecurity V2 description: The Detonate File using Joe Sandbox Process is designed to streamline and enhance the security assessment of files. This automated system accepts a user-submitted file, sends it for in-depth analysis using Joe Sandbox technology, and returns comprehensive results as attachments to the user. The process is designed to be swift, efficient, and secure, providing users with valuable insights into potential threats and vulnerabilities within their files. playbookName: Detonate File - JoeSecurity V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File InternetAccess: simple: "True" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 2630, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 65920250-c97e-4ff7-8f34-4d409f651a2c type: condition task: id: 65920250-c97e-4ff7-8f34-4d409f651a2c version: -1 name: Check if EntryID exists description: Checks if the entry ID for the file to be detonated exists. type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "26" - "21" - "36" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.EntryID iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 3295, "y": 210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 4643aaf7-5f3b-4851-8773-b74b87e18603 type: regular task: id: 4643aaf7-5f3b-4851-8773-b74b87e18603 version: -1 name: Detonate File - MetaDefender Aether description: Detonates a file using the MetaDefender Aether Integration. Returns relevant reports to the War Room and file reputations to the context data. script: metadefender-aether-scan-file type: regular iscommand: true brand: MetaDefender Aether nexttasks: '#none#': - "3" scriptarguments: entry_id: complex: root: inputs.File accessor: EntryID transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3080, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 8febf391-f313-4539-89c1-bd4df099dc51 type: playbook task: id: 8febf391-f313-4539-89c1-bd4df099dc51 version: -1 name: Detonate file - CrowdStrike Falcon Sandbox v2 description: Detonates a File using CrowdStrike Falcon sandbox. playbookName: Detonate file - CrowdStrike Falcon Sandbox v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: EnvironmentID: simple: "100" File: complex: root: inputs.File transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 5250, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 3136d7d0-e7cc-49e2-8a83-8ff39ee4c834 type: playbook task: id: 3136d7d0-e7cc-49e2-8a83-8ff39ee4c834 version: -1 name: Detonate File - ThreatGrid v2 description: Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM. playbookName: Detonate File - ThreatGrid v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File interval: simple: "60" timeout: simple: "900" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 5680, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: b52cc619-b027-4886-8a06-a0975dbc61a9 type: playbook task: id: b52cc619-b027-4886-8a06-a0975dbc61a9 version: -1 name: Detonate File - CrowdStrike Falcon Intelligence Sandbox v2 description: |- Detonates a file using CrowdStrike Falcon Intelligence Sandbox. Accepted file formats: Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub PDF APK Executable JAR Windows script component: .sct Windows shortcut: .lnk Windows help: .chm HTML application: .hta Windows script file: .wsf Javascript: .js Visual Basic: .vbs, .vbe Shockwave Flash: .swf Perl: .pl Powershell: .ps1, .psd1, .psm1 Scalable vector graphics: .svg Python: .py Linux ELF executables Email files: MIME RFC 822 .eml, Outlook .msg. playbookName: Detonate File - CrowdStrike Falcon Intelligence Sandbox v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: EnvironmentID: simple: '160: Windows 10' File: complex: root: inputs.File transformers: - operator: uniq FullReport: simple: "True" Interval: simple: "1" Timeout: simple: "10" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 6110, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 18f66f67-79fe-416e-86aa-f68470eacfac type: playbook task: id: 18f66f67-79fe-416e-86aa-f68470eacfac version: -1 name: WildFire - Detonate file v2 playbookName: WildFire - Detonate file v2 type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" scriptarguments: File: complex: root: inputs.File transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 6540, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 5a218a31-9417-4da1-818f-e46204e57f90 type: playbook task: id: 5a218a31-9417-4da1-818f-e46204e57f90 description: This playbook submits a file extracted from an incident attachment to the ANY.RUN cloud sandbox for dynamic analysis in an Android environment. It helps to automate malware detonation and behavior observation on Android OS. version: -1 name: ANYRUN Detonate File Android playbookName: ANYRUN Detonate File Android type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" separatecontext: true continueonerrortype: "" view: |- { "position": { "x": 3960, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 97ba62f0-bdcd-42ca-8281-4550ece095bd type: playbook task: id: 97ba62f0-bdcd-42ca-8281-4550ece095bd description: This playbook submits a file extracted from an incident attachment to the ANY.RUN cloud sandbox for dynamic analysis in an Linux environment. It helps to automate malware detonation and behavior observation on Ubuntu OS. version: -1 name: ANYRUN Detonate File Linux playbookName: ANYRUN Detonate File Linux type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" separatecontext: true continueonerrortype: "" view: |- { "position": { "x": 4390, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: cf6dfc9a-fe83-4241-8273-164c93cb29f3 type: playbook task: id: cf6dfc9a-fe83-4241-8273-164c93cb29f3 description: This playbook submits a file extracted from an incident attachment to the ANY.RUN cloud sandbox for dynamic analysis in an Windows environment. It helps to automate malware detonation and behavior observation on Windows OS. version: -1 name: ANYRUN Detonate File Windows playbookName: ANYRUN Detonate File Windows type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" separatecontext: true continueonerrortype: "" view: |- { "position": { "x": 4820, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 9a6ceb8b-af9e-4e7f-8ff3-a4900825e4a0 type: condition task: id: 9a6ceb8b-af9e-4e7f-8ff3-a4900825e4a0 version: -1 name: Check the correctness of the ANY.RUN parameters description: Check the correctness of the ANY.RUN parameters type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "40" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: inputs.anyrun_os iscontext: true continueonerrortype: "" view: |- { "position": { "x": 4062.5, "y": 380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: 9d870bdd-181b-4f7b-b175-04b532a4efbd type: condition task: id: 9d870bdd-181b-4f7b-b175-04b532a4efbd version: -1 name: Select ANY.RUN playbook description: Select ANY.RUN playbook type: condition iscommand: false brand: "" nexttasks: Android: - "33" Linux: - "34" Windows: - "35" separatecontext: false conditions: - label: Windows condition: - - operator: isEqualString left: value: simple: inputs.anyrun_os iscontext: true right: value: simple: windows - label: Android condition: - - operator: isEqualString left: value: simple: inputs.anyrun_os iscontext: true right: value: simple: android - label: Linux condition: - - operator: isEqualString left: value: simple: inputs.anyrun_os iscontext: true right: value: simple: linux continueonerrortype: "" view: |- { "position": { "x": 4390, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "25_21_yes": 0.71, "25_26_yes": 0.5, "25_3_#default#": 0.1, "40_33_Android": 0.52 }, "paper": { "dimensions": { "height": 900, "width": 6870, "x": 50, "y": 50 } } } inputs: - key: EntryID value: complex: root: File accessor: EntryID required: false description: Entry ID of file to be detonated playbookInputQuery: - key: File value: complex: root: File required: false description: File object of file to be detonated playbookInputQuery: - key: anyrun_os value: simple: windows required: false description: 'Specify ANY.RUN operation system type. Supports: windows, linux, android' playbookInputQuery: inputSections: - inputs: - EntryID - File name: General (Inputs group) description: Generic group for inputs - inputs: - anyrun_os name: ANY.RUN description: ANY.RUN group for inputs outputs: - contextPath: Joe.Analysis.Status description: Analysis Status. type: string - contextPath: File.Name description: The file's name (only in case of report type=json). type: string - contextPath: File.SHA1 description: SHA1 hash of the file. type: string - contextPath: File.SHA256 description: SHA256 hash of the file. type: string - contextPath: File.Size description: File size (only in case of report type=json). type: number - contextPath: File.Type description: File type e.g. "PE" (only in case of report type=json). type: string - contextPath: File.Malicious description: The File malicious description. type: unknown - contextPath: File.Malicious.Description description: For malicious files, the reason for the vendor to make the decision. type: string - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: string - contextPath: DBotScore description: The Indicator's object. type: unknown - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The type of the indicator. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: IP.Address description: IP's relevant to the sample. type: string - contextPath: DBotScore.Malicious.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Malicious.Detections description: The sub analysis detection statuses. type: string - contextPath: DBotScore.Malicious.SHA1 description: The SHA1 of the file. type: string - contextPath: File description: The File's object. type: unknown - contextPath: File.MD5 description: MD5 hash of the file. type: string - contextPath: Joe.Analysis.SampleName description: Sample Data, could be a file name or URL. type: string - contextPath: Joe.Analysis.Comments description: Analysis Comments. type: string - contextPath: Joe.Analysis.Time description: Submitted Time. type: date - contextPath: Joe.Analysis.Runs description: Sub-Analysis Information. type: unknown - contextPath: Joe.Analysis.Result description: Analysis Results. type: string - contextPath: Joe.Analysis.Errors description: Raised errors during sampling. type: unknown - contextPath: Joe.Analysis.Systems description: Analysis OS. type: unknown - contextPath: Joe.Analysis.MD5 description: MD5 of analysis sample. type: string - contextPath: Joe.Analysis.SHA1 description: SHA1 of analysis sample. type: string - contextPath: Joe.Analysis.SHA256 description: SHA256 of analysis sample. type: string - contextPath: InfoFile.Name description: FileName of the report file. type: string - contextPath: InfoFile.EntryID description: The EntryID of the report file. type: string - contextPath: InfoFile.Size description: File Size. type: number - contextPath: InfoFile.Type description: File type e.g. "PE". type: string - contextPath: InfoFile.Info description: Basic information of the file. type: string - contextPath: File.Extension description: The extension of the file. type: string - contextPath: InfoFile description: The report file's object. type: unknown - contextPath: WildFire.Report description: The submission object. type: unknown - contextPath: WildFire.Report.Status description: The status of the submission. type: string - contextPath: WildFire.Report.SHA256 description: SHA256 of the submission. type: string - contextPath: WildFire.Report.MD5 description: MD5 of the submission. type: string - contextPath: WildFire.Report.FileType description: The type of the submission. type: string - contextPath: WildFire.Report.Size description: The size of the submission. type: number - contextPath: Joe.Analysis description: The Analysis object. type: string - contextPath: Cuckoo.Task.Category description: Category of task. type: string - contextPath: Cuckoo.Task.Machine description: Machine of task. type: string - contextPath: Cuckoo.Task.Errors description: Errors of task. type: string - contextPath: Cuckoo.Task.Target description: Target of task. type: string - contextPath: Cuckoo.Task.Package description: Package of task. type: string - contextPath: Cuckoo.Task.SampleID description: Sample ID of task. type: string - contextPath: Cuckoo.Task.Guest description: Task guest. type: string - contextPath: Cuckoo.Task.Custom description: Custom values of task. type: string - contextPath: Cuckoo.Task.Owner description: Task owner. type: string - contextPath: Cuckoo.Task.Priority description: Priority of task. type: string - contextPath: Cuckoo.Task.Platform description: Platform of task. type: string - contextPath: Cuckoo.Task.Options description: Task options. type: string - contextPath: Cuckoo.Task.Status description: Task status. type: string - contextPath: Cuckoo.Task.EnforceTimeout description: Is timeout of task enforced. type: string - contextPath: Cuckoo.Task.Timeout description: Task timeout. type: string - contextPath: Cuckoo.Task.Memory description: Task memory. type: string - contextPath: Cuckoo.Task.Tags description: Task tags. type: string - contextPath: Cuckoo.Task.ID description: ID of task. type: string - contextPath: Cuckoo.Task.AddedOn description: Date on which the task was added. type: string - contextPath: Cuckoo.Task.CompletedOn description: Date on which the task was completed. type: string - contextPath: Cuckoo.Task.Score description: Reported score of the the task. type: string - contextPath: Cuckoo.Task.Monitor description: Monitor of the reported task. type: string - contextPath: VMRay.Job description: The Job Object. type: unknown - contextPath: VMRay.Job.JobID description: The ID of a new job. type: number - contextPath: VMRay.Job.SampleID description: The ID of sample. type: number - contextPath: VMRay.Job.Created description: The timestamp of the created job. type: date - contextPath: VMRay.Job.VMName description: The name of virtual machine. type: string - contextPath: VMRay.Job.VMID description: The ID of virtual machine. type: number - contextPath: VMRay.Sample description: The Sample For Analysis. type: unknown - contextPath: VMRay.Sample.SampleID description: The sample ID of the task. type: number - contextPath: VMRay.Sample.Created description: The timestamp of the created sample. type: date - contextPath: VMRay.Sample.FileName description: The file name of the sample. type: string - contextPath: VMRay.Sample.MD5 description: The MD5 hash of the sample. type: string - contextPath: VMRay.Sample.SHA1 description: The SHA1 hash of the sample. type: string - contextPath: VMRay.Sample.SHA256 description: The SHA256 hash of the sample. type: string - contextPath: VMRay.Sample.SSDeep description: The SSDeep of the sample. type: string - contextPath: VMRay.Sample.Verdict description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available). type: String - contextPath: VMRay.Sample.VerdictReason description: Description of the Verdict Reason. type: String - contextPath: VMRay.Sample.Severity description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated. type: string - contextPath: VMRay.Sample.Type description: The file type. type: string - contextPath: VMRay.Sample.Classifications description: The classifications of the sample. type: string - contextPath: VMRay.Submission description: Submission Object. type: unknown - contextPath: VMRay.Submission.SubmissionID description: The submission ID. type: number - contextPath: VMRay.Submission.HadErrors description: Whether there are any errors in the submission. type: boolean - contextPath: VMRay.Submission.IsFinished description: The status of submission. Can be, "true" or "false". type: boolean - contextPath: VMRay.Submission.MD5 description: The MD5 hash of the sample in submission. type: string - contextPath: VMRay.Submission.SHA1 description: The SHA1 hash of the sample in submission. type: string - contextPath: VMRay.Submission.SHA256 description: The SHA256 hash of the sample in submission. type: string - contextPath: VMRay.Submission.Verdict description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available). type: String - contextPath: VMRay.Submission.VerdictReason description: Description of the Verdict Reason. type: String - contextPath: VMRay.Submission.Severity description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated. type: string - contextPath: VMRay.Submission.SSDeep description: The SSDeep hash of the sample in submission. type: string - contextPath: VMRay.Submission.SampleID description: The ID of the sample in submission. type: number - contextPath: VMRay.Sample.IOC.File description: File Object. type: unknown - contextPath: VMRay.Sample.IOC.File.AnalysisID description: The IDs of other analyses that contain the given file. type: number - contextPath: VMRay.Sample.IOC.File.Name description: The name of the file. type: string - contextPath: VMRay.Sample.IOC.File.Operation description: The operation of the given file. type: string - contextPath: VMRay.Sample.IOC.File.ID description: The ID of the file. type: number - contextPath: VMRay.Sample.IOC.File.Type description: The type of the file. type: string - contextPath: VMRay.Sample.IOC.File.Hashes description: File Hashes Object. type: unknown - contextPath: VMRay.Sample.IOC.File.Hashes.MD5 description: The MD5 hash of the given file. type: string - contextPath: VMRay.Sample.IOC.File.Hashes.SSDeep description: The SSDeep hash of the given file. type: string - contextPath: VMRay.Sample.IOC.File.Hashes.SHA256 description: The SHA256 hash of the given file. type: string - contextPath: VMRay.Sample.IOC.File.Hashes.SHA1 description: The SHA1 hash of the given file. type: string - contextPath: VMRay.Sample.IOC.URL description: URL Object. type: unknown - contextPath: VMRay.Sample.IOC.URL.AnalysisID description: The IDs of the other analyses that contain the given URL. type: number - contextPath: VMRay.Sample.IOC.URL.URL description: The URL. type: string - contextPath: VMRay.Sample.IOC.URL.Operation description: The operation of the specified URL. type: string - contextPath: VMRay.Sample.IOC.URL.ID description: The ID of the URL. type: number - contextPath: VMRay.Sample.IOC.URL.Type description: The type of the URL. type: string - contextPath: VMRay.Sample.IOC.Domain description: Domain Object. type: unknown - contextPath: VMRay.Sample.IOC.Domain.AnalysisID description: The IDs of the other analyses that contain the given domain. type: number - contextPath: VMRay.Sample.IOC.Domain.Domain description: The domain. type: string - contextPath: VMRay.Sample.IOC.Domain.ID description: The ID of the domain. type: number - contextPath: VMRay.Sample.IOC.Domain.Type description: The type of the domain. type: string - contextPath: VMRay.Sample.IOC.IP description: IP Object. type: unknown - contextPath: VMRay.Sample.IOC.IP.AnalysisID description: The IDs of the other analyses that contain the given IP address. type: number - contextPath: VMRay.Sample.IOC.IP.IP description: The IP address. type: string - contextPath: VMRay.Sample.IOC.IP.Operation description: The operation of the given IP address. type: string - contextPath: VMRay.Sample.IOC.IP.ID description: The ID of the IP address. type: number - contextPath: VMRay.Sample.IOC.IP.Type description: The type of the IP address. type: string - contextPath: VMRay.Sample.IOC.Mutex description: Mutex Object. type: unknown - contextPath: VMRay.Sample.IOC.Mutex.AnalysisID description: The IDs of other analyses that contain the given IP address. type: number - contextPath: VMRay.Sample.IOC.Mutex.Name description: The name of the mutex. type: string - contextPath: VMRay.Sample.IOC.Mutex.Operation description: The operation of the given mutex. type: string - contextPath: VMRay.Sample.IOC.Mutex.ID description: The ID of the mutex. type: number - contextPath: VMRay.Sample.IOC.Mutex.Type description: The type of the mutex. type: string - contextPath: VMRay.ThreatIndicator description: Indicator Object. type: unknown - contextPath: VMRay.ThreatIndicator.AnalysisID description: The list of connected analysis IDs. type: number - contextPath: VMRay.ThreatIndicator.Category description: The category of threat indicators. type: string - contextPath: VMRay.ThreatIndicator.Classification description: The classifications of threat indicators. type: string - contextPath: VMRay.ThreatIndicator.ID description: The ID of the threat indicator. type: number - contextPath: VMRay.ThreatIndicator.Operation description: The operation that caused the indicators. type: string - contextPath: SecneurXAnalysis.Report.SHA256 description: SHA256 value of the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.Verdict description: Summary result of the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.Tags description: More details of the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.IOC description: List of IOC's observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.Status description: Analysis queued sample state. type: String - contextPath: SecneurXAnalysis.Report.DnsRequests description: List of DNS data observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.HttpRequests description: List of HTTP data observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.JA3Digests description: List of JA3 data observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.ProcessCreated description: Process behaviour data observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.RegistrySet description: List of Registry creations observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.RegistryDeleted description: List of Registry deletions observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.FileCreated description: List of File creations observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.FileDropped description: List of File drops observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.FileDeleted description: List of File deletions observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.FileModified description: List of File changes observed in the analyzed sample. type: string - contextPath: SecneurXAnalysis.Report.Platform description: Platform of the analyzed sample. type: String - contextPath: ATD.Task.taskId description: The task ID of the sample uploaded. type: string - contextPath: ATD.Task.jobId description: The job ID of the sample uploaded. type: string - contextPath: ATD.Task.messageId description: The message Id relevant to the sample uploaded. type: string - contextPath: ATD.Task.srcIp description: Source IPv4 address. type: string - contextPath: ATD.Task.destIp description: Destination IPv4 address. type: string - contextPath: ATD.Task.MD5 description: MD5 of the sample uploaded. type: string - contextPath: ATD.Task.SHA1 description: SHA1 of the sample uploaded. type: string - contextPath: ATD.Task.SHA256 description: SHA256 of the sample uploaded. type: string - contextPath: InfoFile.Extension description: The extension of the report file. type: string - contextPath: File.EntryID description: The Entry ID of the sample. type: string - contextPath: URL.Data description: List of malicious URLs identified by Lastline analysis. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason for the vendor to make the decision. type: string - contextPath: URL.Malicious.Score description: For malicious URLs, the score from the vendor. type: number - contextPath: Lastline.Submission.Status description: Status of the submission. type: string - contextPath: Lastline.Submission.DNSqueries description: List of DNS queries done by the analysis subject. type: string - contextPath: Lastline.Submission.NetworkConnections description: ist of network connections done by the analysis subject. type: string - contextPath: Lastline.Submission.DownloadedFiles description: List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element. type: string - contextPath: Lastline.Submission.UUID description: Task UUID of submitted sample. type: number - contextPath: Lastline.Submission.YaraSignatures.name description: Yara signatures name. type: string - contextPath: Lastline.Submission.YaraSignatures.score description: The score according to the yara signatures. from 0 to 100. type: number - contextPath: Lastline.Submission.YaraSignatures.internal description: True if the signature is only for internal usage. type: boolean - contextPath: Lastline.Submission.Process.arguments description: Argument of the process. type: string - contextPath: Lastline.Submission.Process.process_id description: The process ID. type: string - contextPath: Lastline.Submission.Process.executable.abs_path description: Absolute path of the executable of the process. type: string - contextPath: Lastline.Submission.Process.executable.filename description: Filename of the executable. type: string - contextPath: Lastline.Submission.Process.executable.yara_signature_hits description: Yara signature of the executable of the process. type: string - contextPath: Lastline.Submission.Process.executable.ext_info description: Executable info of the process. type: string - contextPath: Joe.Analysis.ID description: Web ID. type: string - contextPath: Domain.Name description: The Domain name. type: string - contextPath: Domain.DNS description: A list of IP objects resolved by DNS. type: string - contextPath: RegistryKey.Path description: The path to the registry key. type: string - contextPath: RegistryKey.Value description: The value at the given RegistryKey. type: string - contextPath: Process.Name description: Process name. type: string - contextPath: Process.PID description: Process PID. type: number - contextPath: Process.CommandLine description: Process Command Line. type: string - contextPath: Process.Path description: Process path. type: string - contextPath: Process.StartTime description: Process start time. type: date - contextPath: Process.EndTime description: Process end time. type: date - contextPath: Polygon.Analysis.ID description: Analysis ID in THF. type: number - contextPath: Polygon.Analysis.Name description: File Name. type: string - contextPath: Polygon.Analysis.Size description: File Size. type: number - contextPath: Polygon.Analysis.Started description: Analysis start timestamp. type: date - contextPath: Polygon.Analysis.Analyzed description: Analysis finish timestamp. type: date - contextPath: Polygon.Analysis.MD5 description: Analyzed file MD5 hash. type: string - contextPath: Polygon.Analysis.SHA1 description: Analyzed file SHA1 hash. type: string - contextPath: Polygon.Analysis.SHA256 description: Analyzed file SHA256. type: string - contextPath: Polygon.Analysis.Result description: Analysis verdict. type: string - contextPath: Polygon.Analysis.Status description: The analysis status. type: string - contextPath: Polygon.Analysis.Verdict description: Analysis verdict. type: boolean - contextPath: Polygon.Analysis.Probability description: Verdict probability. type: string - contextPath: Polygon.Analysis.Families description: Malware families. type: string - contextPath: Polygon.Analysis.Score description: Polygon score. type: number - contextPath: Polygon.Analysis.Internet-connection description: Internet availability. type: string - contextPath: Polygon.Analysis.Type description: File type. type: string - contextPath: Polygon.Analysis.DumpExists description: Network activity dump exists. type: boolean - contextPath: Polygon.Analysis.File description: The information about files in analysis. type: string - contextPath: Polygon.Analysis.URL description: The information about URL indicators. type: string - contextPath: Polygon.Analysis.IP description: The information about IP indicators. type: string - contextPath: Polygon.Analysis.Domain description: The information about Domain indicators. type: string - contextPath: Polygon.Analysis.RegistryKey description: The information about registry keys which were modified during the analysis. type: string - contextPath: Polygon.Analysis.Process description: The information about processes started during the analysis. type: string - contextPath: csfalconx.resource.id description: Analysis ID. type: String - contextPath: csfalconx.resource.verdict description: Analysis verdict. type: String - contextPath: csfalconx.resource.created_timestamp description: Analysis start time. type: String - contextPath: csfalconx.resource.environment_id description: Environment ID. type: String - contextPath: csfalconx.resource.threat_score description: Score of the threat. type: Int - contextPath: csfalconx.resource.submit_url description: URL submitted for analysis. type: String - contextPath: csfalconx.resource.submission_type description: Type of submitted artifact, for example file, URL, etc. type: String - contextPath: csfalconx.resource.filetype description: File type. type: String - contextPath: csfalconx.resource.filesize description: File size. type: Int - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the submitted file. type: String - contextPath: csfalconx.resource.ioc_report_strict_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_broad_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_strict_json_artifact_id description: ID of the IOC pack to download (JSON). type: Int - contextPath: csfalconx.resource.ioc_report_broad_json_artifact_id description: ID of the IOC pack to download (JSON). type: String - contextPath: csfalconx.resource.ioc_report_strict_stix_artifact_id description: ID of the IOC pack to download (STIX). type: String - contextPath: csfalconx.resource.ioc_report_broad_stix_artifact_id description: ID of the IOC pack to download (STIX). type: Int - contextPath: csfalconx.resource.ioc_report_strict_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - contextPath: csfalconx.resource.ioc_report_broad_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - contextPath: csfalconx.resource.snadbox.environment_description description: Environment description. type: String - contextPath: OPSWAT.Filescan.Submission.flow_id description: The flow ID. type: string - contextPath: OPSWAT.Filescan.Analysis.finalVerdict.verdict description: The final verdict. type: string - contextPath: OPSWAT.Filescan.Analysis.allTags description: All tags. type: string - contextPath: OPSWAT.Filescan.Analysis.overallState description: Overall state of the scan. type: string - contextPath: OPSWAT.Filescan.Analysis.subtaskReferences description: Status of scan subtasks. type: string - contextPath: OPSWAT.Filescan.Analysis.allSignalGroups description: All signal groups. type: string - contextPath: OPSWAT.Filescan.Analysis.resources description: Resources. type: string - contextPath: OPSWAT.Filescan.Analysis.taskReference.name description: Name of the main scan task. type: string - contextPath: OPSWAT.Filescan.Analysis.taskReference.additionalInfo description: Additional informations about the main scan task. type: string - contextPath: OPSWAT.Filescan.Analysis.taskReference.ID description: ID of the main scan task. type: string - contextPath: OPSWAT.Filescan.Analysis.taskReference.state description: State of the main scan task. type: string - contextPath: OPSWAT.Filescan.Analysis.taskReference.resourceReference description: Resource reference of the main scan task. type: string - contextPath: OPSWAT.Filescan.Analysis.taskReference.opcount description: Counter. type: string - contextPath: OPSWAT.Filescan.Analysis.taskReference.processTime description: processTime. type: string - contextPath: OPSWAT.Filescan.Analysis.file.name description: The name of the file. - contextPath: OPSWAT.Filescan.Analysis.file.hash description: The SHA256 of the file. - contextPath: OPSWAT.Filescan.Analysis.file.type description: The type of the submission. - contextPath: ANYRUN.SandboxAnalysis.mitre.name description: 'MITRE Technic text description.' type: String - contextPath: ANYRUN.SandboxAnalysis.mitre.phases description: "MITRE Technic phases." type: String - contextPath: ANYRUN.SandboxAnalysis.mitre.id description: "MITRE Technic identifier." type: String - contextPath: ANYRUN.SandboxAnalysis.debugStrings type: Unknown description: "Analysis debug information." - contextPath: ANYRUN.SandboxAnalysis.incidents.process description: "Analysis process." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.time type: Date description: "Event time." - contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdline description: "Event command line." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.image description: "Event image." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.v description: "MITRE version." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.sid description: "SID." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.tid description: "TID." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.count description: "Count of related incidents." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.firstSeen type: Date description: "Incident first seen date." - contextPath: ANYRUN.SandboxAnalysis.incidents.source description: "Incident source." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.desc description: "Incident description." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.title description: "Incident title." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.threatLevel description: "Incident threat level." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.typeValue description: "Event type value." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.key description: "Event key." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.value description: "Event value." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.name description: "Event name." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.operation description: "Even operation." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdParent description: "Event parent cmd." type: String - contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdChild description: "Event child cmd." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.registry.time type: Date description: "Registry time." - contextPath: ANYRUN.SandboxAnalysis.modified.registry.process description: "Registry process." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.registry.operation description: "Registry operation." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.registry.value description: "Registry value." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.registry.name description: "Registry name." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.registry.key description: "Registry key." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.process description: "File process." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.size description: "File size." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.filename description: "Filename." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.time type: Date description: "File creating time." - contextPath: ANYRUN.SandboxAnalysis.modified.files.info.mime description: "File MIME type." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.info.file description: "File content." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.permanentUrl description: "File url." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.ssdeep description: "File SSDeep." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.sha256 description: "File sha256 hash." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.sha1 description: "File sha1 hash." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.md5 description: "File md5 hash." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.threatLevel description: "File threat level." type: String - contextPath: ANYRUN.SandboxAnalysis.modified.files.type description: "File type." type: String - contextPath: ANYRUN.SandboxAnalysis.network.threats type: Unknown description: "Analysis network threats." - contextPath: ANYRUN.SandboxAnalysis.network.connections.reputation description: "Network connection reputation." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3SFullstring description: "Network connection ja3S." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3S description: "Network connection ja3S." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3Fullstring description: "Network connection ja3F." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3 description: "Network connection ja3F." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.time type: Date description: "Network connection time." - contextPath: ANYRUN.SandboxAnalysis.network.connections.asn description: "Network connection ASN." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.country description: "Network connection country." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.protocol description: "Network connection protocol." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.port description: "Network connection port." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.ip description: "Network connection ip." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.process description: "Network connection processes." type: String - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.jarm description: "Network connection jarm." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.country description: "HTTP Request country." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.reputation description: "HTTP Request reputation." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.process description: "HTTP Request related process." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.httpCode description: "HTTP Request status code." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.status description: "HTTP Request status." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.user-agent description: "HTTP Request User-Agent header value." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.proxyDetected description: "HTTP Request is proxy detected." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.port description: "HTTP Request port." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.ip description: "HTTP Request ip." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.url description: "HTTP Request url." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.host description: "HTTP Request host." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.method description: "HTTP Request method." type: String - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.time type: Date description: "HTTP Request time estimate." - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.reputationNumber description: "DNS Request reputation number." type: String - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.reputation description: "DNS Request reputation." type: String - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.ips description: "DNS Request IPs." type: String - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.domain description: "DNS Request domain." type: String - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.time type: Date description: "DNS Request time estimate." - contextPath: ANYRUN.SandboxAnalysis.malconf type: Unknown description: "Analysis malconf." - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization type: Unknown description: "Analysis processes synchronization." - contextPath: ANYRUN.SandboxAnalysis.processes.modules type: Unknown description: "Analysis processes modules." - contextPath: ANYRUN.SandboxAnalysis.processes.hasMalwareConfig description: "Process has malware config." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.parentUUID description: "Process parent UUID." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.status description: "Process status." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.malwareConfig description: "Process malware config." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.privEscalation description: "Process priv escalation." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.stealing description: "Process stealing." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.networkLoader description: "Process network loader." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.network description: "Process network." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.lowAccess description: "Process low access." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.knownThreat description: "Process known threat." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.injects description: "Process inject." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.exploitable description: "Process exploitable." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.executableDropped description: "Process executable dropped." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.debugOutput description: "Process debug output." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.crashedApps description: "Process crashed apps." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.autoStart description: "Process auto start." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.loadsSusp description: "Process loads susp." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.injected description: "Process injected." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.dropped description: "Process dropped." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevelText description: "Process threat level text." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevel description: "Process threat level." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.score description: "Process score." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.context.userName description: "Process context username." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.context.integrityLevel description: "Process context integrity level." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.context.rebootNumber description: "Process context reboot number." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.version description: "Process version." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.description description: "Process description." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.company description: "Process company." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.mainProcess description: "Process main process." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.fileType description: "Process file type." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.fileName description: "Process filename." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.commandLine description: "Process cmd." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.image description: "Process image." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.uuid description: "Process uuid." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.ppid description: "Process PPID." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.important description: "Process important." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.pid description: "Process PID." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.exitCode description: "Process exit code." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.times.terminate type: Date description: "Process time terminate." - contextPath: ANYRUN.SandboxAnalysis.processes.times.start type: Date description: "Process time start." - contextPath: ANYRUN.SandboxAnalysis.processes.resolvedCOM.title description: "Process resolved COM title." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.operation description: "Process sync operation." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.type description: "Process sync type." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.name description: "Process sync name." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.time type: Date description: "Process sync time." - contextPath: ANYRUN.SandboxAnalysis.processes.modules.image description: "Process module image." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.modules.time type: Date description: "Process module time." - contextPath: ANYRUN.SandboxAnalysis.processes.scores.monitoringReason description: "Process monitoring reason." type: String - contextPath: ANYRUN.SandboxAnalysis.processes.times.monitoringSince type: Date description: "Process monitoring since." - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.type.event description: "Process sync event." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.type.mutex description: "Process sync mutex." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.operation.create description: "Process sync operation create." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.operation.open description: "Process sync operation open." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.total description: "Process sync total." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.registry.delete description: "Registry delete." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.registry.write description: "Registry write." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.registry.read description: "Registry reed." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.registry.total description: "Registry total." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.files.malicious description: "File malicious count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.files.suspicious description: "File suspicious count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.files.text description: "File text." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.files.unknown description: "File unknown count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.network.threats description: "Network threats count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.network.dns description: "Network dns count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.network.connections description: "Network connections count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.network.http description: "Network networks count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.processes.malicious description: "Malicious processes count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.processes.suspicious description: "Suspicious processes count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.processes.monitored description: "Monitored processes count." type: String - contextPath: ANYRUN.SandboxAnalysis.counters.processes.total description: "Total processes count." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.hotfixes.title description: "Environment hotfixes title." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.software.version description: "Environment software version." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.software.title description: "Environment software title." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.internetExplorer.kbnum description: "Environment Internet Explorer KBNUM." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.internetExplorer.version description: "Environment Internet Explorer version." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.bitness description: "Environment OS version." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.softSet description: "Environment OS software set." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.servicePack description: "Environment OS service pack." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.major description: "Environment OS major version." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.productType description: "Environment OS product type." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.variant description: "Environment OS variant." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.product description: "Environment OS product." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.build description: "Environment OS build." type: String - contextPath: ANYRUN.SandboxAnalysis.environments.os.title description: "Environment OS title." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.dumps type: Unknown description: "Content dumps." - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.thumbnailUrl description: "Screenshots thumbnail url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.permanentUrl description: "Screenshots permanent url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.time description: "Screenshots time." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.uuid description: "Screenshots uuid." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.sslkeys.present description: "SSL keys present." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.pcap.permanentUrl description: "Pcap dump permanent url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.pcap.present description: "Pcap present." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.video.permanentUrl description: "Video permanent url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.video.present description: "Video present." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.ssdeep description: "Main object ssdeep." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha256 description: "Main object sha256." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha1 description: "Main object sha1." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.md5 description: "Main object md5." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.url description: "Main object url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.type description: "Main object type." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.knownThreat description: "Specs known threat." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.malwareConfig description: "Specs malware Config." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.notStarted description: "Specs not started." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.privEscalation description: "Specs priv escalation." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.torUsed description: "Specs TOR used." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.suspStruct description: "Specs susp structure." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.stealing description: "Specs stealing." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.staticDetections description: "Specs static detections." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.spam description: "Specs spam." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.serviceLauncher description: "Specs service launcher." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.rebooted description: "Specs rebooted." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.networkThreats description: "Specs network threats." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.networkLoader description: "Specs network loader." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.multiprocessing description: "Specs multiprocessing." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.memOverrun description: "Specs memory overrun." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.lowAccess description: "Specs low access." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.exploitable description: "Specs exploitable." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.executableDropped description: "Specs executable dropped." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.debugOutput description: "Specs debug output." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedTask description: "Specs crashed task." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedApps description: "Specs crashed apps." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.cpuOverrun description: "Specs CPU overrun." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.autoStart description: "Specs suto start." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.injects description: "Specs injects." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevelText description: "Verdict threat level text." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevel description: "Verdict threat level." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.score description: "Verdict score." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.automatization.uac description: "Options automatization UAC." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.privateSample description: "Options private sample." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.privacy description: "Options privacy." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.network description: "Options network." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.hideSource description: "Options hide source." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.video description: "Options video." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.presentation description: "Options presentation." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.tor.used description: "Options tor used." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.mitm description: "Options MITM proxy." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.heavyEvasion description: "Options kernel heavy evasion." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.fakeNet description: "Options fake network." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.additionalTime description: "Options additions time." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.options.timeout description: "Options timeout." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.tags type: Unknown description: "Analysis tags." - contextPath: ANYRUN.SandboxAnalysis.analysis.stopExecText type: Date description: "Analysis stopExecText." - contextPath: ANYRUN.SandboxAnalysis.analysis.stopExec type: Date description: "Analysis creation stopExec." - contextPath: ANYRUN.SandboxAnalysis.analysis.creationText type: Date description: "Analysis creation creation text." - contextPath: ANYRUN.SandboxAnalysis.analysis.creation type: Date description: "Analysis creation date." - contextPath: ANYRUN.SandboxAnalysis.analysis.duration description: "Analysis duration." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.sandbox.plan.name description: "Analysis sandbox user plan name." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.sandbox.name description: "Analysis sandbox name." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.graph description: "Analysis reports graph." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.STIX description: "Analysis STIX report url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.HTML description: "Analysis HTML report url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.MISP description: "Analysis MISP report url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.IOC description: "Analysis IOC report url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.permanentUrl description: "Analysis permanent url." type: String - contextPath: ANYRUN.SandboxAnalysis.analysis.uuid description: "Analysis uuid." type: String - contextPath: ANYRUN.SandboxAnalysis.status description: "Analysis status." type: String - contextPath: ANYRUN.SandboxAnalysisReportVerdict description: "The analysis verdict." type: String - contextPath: ANYRUN_DetonateFileAndroid.TaskID description: 'Task UUID.' type: String - contextPath: ANYRUN_DetonateFileLinux.TaskID description: 'Task UUID.' type: String - contextPath: ANYRUN_DetonateFileWindows.TaskID description: 'Task UUID.' type: String fromversion: 5.0.0 tests: - Detonate File - No Files test - Detonate File - Generic Test contentitemexportablefields: contentitemfields: {}