Viewing and exporting the results for the malware analysis

The event results table on the Malware Analysis page displays all the information that is relevant to each malware analysis job.

You can track the effect of malware through the entire lifecycle. Based on the analysis results, you can anticipate future attacks. Researchers can review details about the detected malware, file type, application used to analyze the malware, traffic generated by the virtual machine, and so on.

Fields for the results of the malware analysis submission are described in the following table.

Field	Description
R	Type of results. The results can be sorted by relevance.
ID	System-generated.malware ID of the submitted sample.
Type	File type that was submitted.
IM	Whether the sample is malicious. The results can be Yes, No, or blank. If the entry is blank, the Intelligent Virtual Execution - Server appliance cannot confirm a malicious attack. Further forensics might be required.
Analysis	Type of analysis: Live, Sandbox, or unattended mode.
Malware	Name of the malware that is detected by the MVX engine.
URL	URL or directory path that is used for the submitted malware.
Profile Name	Guest image profile that the MVX engine used for the current malware analysis job.
Application	Application used to test submitted content.
Md5sum	Result of the MD5 checksum.
Submitted	Date and time when the malware analysis job was submitted.
Complete	Date and time when the malware analysis was completed.
Status	Status of the malware analysis job. Success—Analysis job was completed successfully. text—Link to a text summary of the packet capture (pcap) data collected from the virtual machine that was used to test the malware sample. download clip—Link to an mp4 video of the virtual machine testing the malware sample. You can play the file in a browser or download the video. File Empty—File specified for analysis is empty. Download Empty—File downloaded from the URL is empty. Submit Error—An internal error prevented this analysis job from being submitted. Incomplete—Analysis job was not completed successfully. OverLimit—Too many jobs have been submitted to be analyzed. Create Failed—An error occurred in creating the MVX analysis environment for this job. Duplicate—File or downloaded binary was a duplicate of the previously analyzed malware. Run Start—Start time of the analysis. Run End—End time of the analysis. Events—Number of events identified in the analysis. Submit Whitelist—MD5 checksum of the sample has been whitelisted by security content to avoid false positives.
Submitter	Role of the submitter who completed the malware analysis.

To verify and export the results of the malware analysis job:

In the Web UI, click the Analysis tab.
To view or enter notes about the job, click the Note icon next to the more information triangle.
Entries in the Note box are shared with the Dynamic Threat Intelligence (DTI) Network.
(Optional) Click the more information triangle. Additional details are displayed for specific events and incidents during the analysis.
(Optional) In the VM Capture area, click the link to export the pcap or video files.. Further forensics can be performed on the actual objects and files created or modified during malware analysis.
(Optional) Scroll down to view additional details about a particular file or URL. Click Show all.
(Optional) Export an XML or PDF file of the results. The XML contains the event details based on your filter criteria. The PDF file contains only the content that is visible on the page. For example, if an item on the page is not expanded, the details about that item are displayed and will not be included in the PDF output.
- To export the XML file, click the XML dump link (at the bottom of the page).
- To export a PDF, expand sections to show the information you want to capture. Choose the processing time as standard, extra, or heavy. The default processing time is standard. Click Print PDF at the top right-side of the page.

The import hash

The import hash (imphash) is used to track portable executable (PE) imports. Imports are functions that software calls from other files. To track these imports, a hash is created based on library and API names and the order in which they appear in the PE. Due to the way the imphash is generated, the value should be unique for each suspected malware sample. If the imphash value of multiple samples is the same, it is likely that the samples originate from the same threat group.

The imphash is included in the triage bundle and in the Gen Obj Hashes, which you can view by clicking on a malware submission on the Analysis Details page of the Web UI.

The rich header

The rich header appears in most files built using Microsoft Visual Studio. It consists of pairs of 4-byte integers. The first value of each record is the unique number of the compiler used. The second value is the number of items that were compiled by this tool. A hash of the rich header is created from these values, which can be used to identify threat groups.

The rich header hash is included in the triage bundle and in the Gen Obj Hashes, which you can view by clicking on a malware submission on the Analysis Details page of the Web UI.

The telfhash

The telfhash algorithm is an architecture-agnostic tool used to investigate attacks that contain executable and linkable format (ELF) files. It creates imported functions from ELF files and clusters similar files to help identify samples from the same threat group.

The telfhash is included in the triage bundle and in the Gen Obj Hashes, which you can view by clicking on a malware submission on the Analysis Details page of the Web UI.

FLARE Obfuscated String Solver

The FLARE Obfuscated String Solver, FLOSS, formerly theTrellix Labs Obfuscated Labs String Solver, is an open-source tool that detects, extracts, and decodes obfuscated strings in Windows Portable Executable files. Malware authors evade detection by obfuscating key portions of an executable. These portions are usually strings and resources used to configure domains, files, and other artifacts of an infection. FLOSS automatically reveals these strings from malware binaries.

You can view the FLOSS file on the Analysis Details page of the Web UI, and it is also included in the triage bundle.