Displays information about a specific malware analysis and malware submission job.
Syntax
show malware id <malware_ID>
Parameters
None
Output fields
The following table describes the output fields for the show malware id command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Malware ID | Specific malware analysis job number. |
Submission ID | Specific malware submission job number. |
Analysis Type | Type of malware analysis (sandbox or live) that is associated with the malware submission job number. |
URL | Single URL of the malware sample. |
Analysis Timeout | Number of seconds after which the malware analysis stops if the analysis is not complete. |
Analysis Priority | Priority setting for the current analysis, if you add multiple analysis jobs at the same time to the MVX engine queue. The default priority is normal. |
Force | Force the Malware Analysis appliance to perform the submitted analysis even if it matches a previous submission for which forensic results have been generated. |
Profile Name | Guest image profile that the MVX engine uses for the current malware analysis job. |
Profile ID | Guest image profile ID number. |
Application | Application used to test submitted content. |
Md5Sum | Result of the MD5 checksum. |
State | Whether the malware submission job has been completed, is in the queue waiting to be analyzed, or is currently running. |
Submitted Time | Date and time when the malware analysis job was submitted. |
Download Start Time | Start time of the download. |
Download End Time | End time of the download. |
Run Start Time | Start time of the analysis. |
Run End Time | End time of the analysis. |
IM | Whether the sample is malicious. The results can be Yes, No, or blank. If the entry is blank, the Malware Analysis appliance cannot confirm a malicious attack. Further forensics might be required. |
Number of Events | Number of events identified in the analysis. |
Children Malware ID(s) | Specific child malware analysis job number that is associated with the parent malware submission. |
Parent Malware ID | Specific parent malware analysis job number that is associated with the child malware submission. |
Occurrence Time | Time that the event occurred. |
Event Type | Type of event that is identified with the analysis. |
Analysis Type | Type of analysis that is associated with the event. |
Example
The following example displays malware analysis information for job number 979:
hostname # show malware id 979
Malware ID 979
Submission ID 979
Analysis Type: sandbox
URL: http://172.17.69.101/samples/14R2/newFeatures/GI-2265/clean_cryptofiles/file1.ppt
Analysis Timeout: 120
Analysis Priority: normal
Force: true
Profile Name: winxp-sp3
Profile ID: 43
Application: Multiple-MS-PowerPoint-X
Md5Sum: 88fa84068380c9ceff73450de484d9d8
State: done
Status: success
Submitted Time: 2015-08-21 19:22:07 UTC
Download Start Time: 2015-08-21 19:49:55 UTC
Download End Time: 2015-08-21 19:52:43 UTC
Run Start Time: 2015-08-21 19:49:55 UTC
Run End Time: 2015-08-21 19:52:43 UTC
IM: NO
Number of Events: 1
Children Malware ID(s) -
Parent Malware ID -
Event 5157:
Occurrence Time : 2015-08-21 19:52:43 UTC
Event Type : os-change-anomaly
Analysis Type : Malware
Trace ID : 979
Malware ID : 979
OS Change Analysis:
<analysis mode="malware" ftype="ppt" version="1.1026" product="MAS"/>
<application app-name="Multiple MS PowerPoint X" />
<os name="windows" version="5.1.2600" sp="3" arch="x86"/>
<os_monitor version="15R1" build="403692" date="Aug 13 2015" time="17:02:35"/>
<config-update timestamp="79">
<status>success</status>
<update-requested>true</update-requested>
<files>system-version.json</files>
<version>1.01</version>
</config-update>
<end-of-report/>
<malicious-alert classtype="Suspicious_Embedded_Process">
<display-msg>Suspicious startup behaviour</display-msg>
</malicious-alert>
EDP URL : https://mil.fireeye.com/edp.php?sname=Malware.Binary.ppt
PCAP URL : https://172.16.197.50/event_stream/send_pcap_file?ev_id=5157
PCAP (text) : https://172.16.197.50/event_stream/send_pcap_ascii?ev_id=5157
User role
Admin, Operator, Monitor, or Analyst
Command mode
Enable
Supported appliances
This command is supported on the following appliance running the specified release or later:
Malware Analysis: Release 7.5. The command output was enhanced to display the statistics about a specific malware submission job in Release 7.7.