Submit a file or URL for malware analysis in IVX Server

To submit a file or URL for analysis:

1. Login to IVX Server appliance.

2. On the Submissions page, click Submit A Sample and select File or URL.

   • For File, select the files.

   • For URL, enter the URL.

3. In the dialog, select the file you want to submit.

4. Enter the timeout value (in seconds). The minimum timeout is 60 seconds, the maximum is 600 seconds, and the default is 240 seconds.

5. (Optional) Select the priority for the analysis when adding multiple jobs to the MVX engine queue. The default value is Normal.

6. (Optional) Select the required guest image profile used by the MVX engine for malware analysis.

7. Turn on Live mode to initiate a real-time malware analysis job. To enable Live mode, execute the following CLI commands:

   analysis live url-dynamic-analysis enable
   analysis live controlled-live-mode enable

   For more details, see Configure Live mode for Malware Analysis using CLI.

8. (Optional) Turn on Enable Prefetch to determine the URL target internally without navigating to the target location.

   Note

   If the user does not provide a prefetch value in the options field, this is enabled by default. If Live malware analysis is disabled, Enable Prefetch is automatically enabled.

9. Turn on VNC to enable Virtual Network Computing (VNC) server which allows you to view and interact with the sample during analysis in the virtual environment. See Handling VNC submissions for more details.

   Note

   When you enable VNC, the Priority option is disabled.

10. (Optional) Enter the password to decrypt the uploaded ZIP file submitted for malware analysis.

11. Click Submit. The submitted file is displayed in the table. Click if the submitted file is not displayed.

12. The following table describes the details on the Submissions page:

    Column Name	Description
    Completed At	The date and time the sample completed analysis. Note When you navigate to Submissions, the date range automatically resets to the default of 2 days, irrespective of the date range you have selected on the dashboard.
    MD5	The MD5 hash of the sample. Click the hash value to view the analysis report for the sample.
    Type	The type of file submitted for analysis. To filter results, enter a file type in the search box under the column heading and press Enter.
    Name	The name of the file submitted for analysis. To search for a specific file, enter its name in the search bar under the column heading and press Enter. Click on the file link to open the analysis report for more information on that alert.
    Verdict	The result of the analysis on the sample. A file or URL can have one of the following verdicts: Clean: No malware was detected in the sample. Malicious: The sample contains malware, and was designed to be used maliciously. Riskware: The sample is not intended to be malicious, but could be used maliciously.
    Signature	The name of the threat group behind a malicious attack. To view all alerts associated with a threat, enter the signature name in the search box under the column heading and press Enter.
    Artifacts	Click icon to download the artifacts associated with the submission. You will see this icon only if there are other artifacts available. Click icon to download the samples. The password to view the file is "protected". Click the Connect to VNC server icon to open a VNC session with the sample in the virtual environment. This icon only appears for submissions where VNC is enabled. The VNC session is available on all systems running IVX Server build 11.0.0.1020552 (11.0.0-abbot-hotfix) or later. See KB14797 for more details.
    Submitter	The name of the user who submitted the sample. To filter samples by a submitter, enter their name in the search bar under the column heading and press Enter. Submissions made through ICAP are now displayed in the Submitter field as ICAP, allowing you to easily identify and track all submissions originating from ICAP.
    UUID	A unique reference ID generated for each file or URL submitted for analysis.
    Analysis mode	Indicates where the analysis was performed for this submission. It displays “Sandbox” for analysis conducted in a sandbox environment and “Live” for real-time analysis.

13. Use the toggle button to switch between Running and Completed to check whether the submitted files are still being analyzed or completed. When viewing Running submissions, only up to 1000 records are displayed.

14. Click to download the report in CSV format. The maximum of 1000 records are only displayed in the report.