Perform artifact extraction on submitted malware analysis jobs. Examples of artifacts are memory dumps, executable files, and Java Script files.
All the fields in the configuration wizard are optional. To use the wizard, use the following methods:
To change an answer while running the wizard, enter CTRL+C, and then enter the step number.
To skip a parameter, press Enter. To clear a previously saved value, enter clear. Entering a new value will overwrite the previous value of the parameter.
To save changes and exit, press Enter.
The following table lists the configuration prompts in the wizard:
Step | Response |
|---|---|
Enable artifact extraction during DA? | Enter yes to enable the administrator to extract artifacts during dynamic analysis. |
File extraction mode? | Enter production mode. |
File extraction enabled? | Enter yes to perform file extractions. Default is yes. |
Extract all types of dropped files? | Enter yes to extract all dropped file types. Default is yes. |
Extract dropped executable and PE files? | Enter yes to extract dropped executable and PE files. Default is yes. |
Extract dropped script files? | Enter yes to extract dropped script files. Default is yes. |
Extract dropped embedded objects? | Enter yes to extract embedded objects. Default is yes. |
Extract dropped de-obfuscated active content? | Enter yes to extract dropped de-obfuscated active content. Default is yes. |
Extract dropped live mode payload? | Enter yes to extract dropped live mode payloads. Default is yes. |
Extract additional artifacts? | Enter yes to extract additional artifacts associated with malware behavior. Default is yes. |
Total number of artifacts to be extracted? | Enter the number. Default is the maximum of 10 artifacts. |
Memory dump extraction enabled? | Enter yes to enable memory dump extractions. Default is no. |
Extract full memory dump? | Enter yes to extract full memory dumps. Default is no. |
Extract memory regions for an unpacked PE files dump? | Enter yes to extract memory regions for unpacked PE files dumps. Default is no. |
Extract memory regions for a critical API call dump? | Enter yes to extract memory regions for critical API call dumps. Default is no. |
Extract XCSection for a stack dump? | Enter yes to extract the eXecutable Code Section for stack dumps. Default is no. |
Extract heap spray memory dump? | Enter yes to extract heap spray memory dumps. Default is no. |
Extract shell code memory dump? | Enter yes to extract shell code memory dumps. Default is no. |
Extract kernel dumps? | Enter yes to extract kernel dumps. Default is no. |
Max number of dumps to be extracted? | Enter the number. Default is the maximum of 10 artifacts. |
Syntax
analysis extract-artifact
Parameters
None
Example
The following example runs the configuration wizard that allows you to perform artifact extraction on submitted analysis jobs.
hostname (config) # analysis extract-artifact
Respond to the configuration prompts as they appear (see the table above).
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Malware Analysis: Release 8.2