Status

string

File analysis status. Available values:

in progress—The file is still being analyzed.

complete—The file analysis successfully completed.

not started—The file has not been previously submitted for analysis.

Zone

string

Color of the zone that a file belongs to. Available values:

Red—The file can be classified as Malware.

Yellow—The file is classified as Adware and other (Adware, Pornware, and other programs).

Green—The file has the Clean or No threats detected status. The No threats detected status is applied if the file was not classified by Kaspersky, but it was previously scanned and/or analyzed, and no threats were detected at the time of the analysis.

Grey—No data or not enough information is available for the file.

FileGeneralInfo

object

General information about the requested hash.

FileStatus

string

Status of the submitted file (Malware, Adware and other, Clean, No threats detected, or Not categorized).

Sha1

string

SHA1 hash of the file requested by the hash.

Md5

string

MD5 hash of the file requested by the hash.

Sha256

string

SHA256 hash of the file requested by the hash.

FirstSeen

string <date-time>

Date and time when the requested hash was detected by Kaspersky expert systems for the first time.

LastSeen

string <date-time>

Date and time when the requested hash was detected by Kaspersky expert systems for the last time.

Signer

string

Organization that signed the requested hash.

Packer

string

Packer name (if available).

Size

integer

Size of the object being investigated by the hash (in bytes).

Type

string

Type of the object being investigated by the hash.

HitsCount

integer

Number of hits (popularity) of the requested hash detected by Kaspersky expert systems. Number of hits is rounded to the nearest power of 10.

DetectionsInfo

Array of objects

Information about detected objects.

LastDetectDate

string <date-time>

Date and time when the object was last detected by Kaspersky expert systems.

DescriptionUrl

string

Link to the detected object's description in the Kaspersky threats website (if available).

Zone

string

Color of the zone that the detected object belongs to.

DetectionName

string

Name of the detected object.

DetectionMethod

string

Method used to detect the object.

DynamicAnalisysResults

object

Information about dynamic analysis results.

Detections

Array of objects

The number of detected objects with Malware (red) or Adware and other (yellow) statuses.

Zone—Color of the zone of the detected object (Red or Yellow).

Count—Number of objects that belong to the zone.

SuspiciousActivities

Array of objects

The number of suspicious activities with High (red), Medium (yellow), or Low (grey) levels.

Zone—Color of the zone of the activity (Red, Yellow, or Grey).

Count—Number of activities that belong to the zone.

ExtractedFiles

Array of objects

The number of files that were downloaded or dropped by the file during the execution process, and the proportion of files with the status of Malicious (extracted files that can be classified as malicious, in red), Adware and other (extracted files that can be classified as Not-a-virus, in yellow), Clean (extracted files that can be classified as not malicious, in green), or Not categorized (no information about the extracted files is available, in grey).

Zone—Color of the zone of the file (Red, Yellow, Green, or Grey).

Count—Number of files that belong to the zone.

NetworkActivities

Array of objects

The number of registered network interactions that the file performed during the execution process and the proportion of network interactions with the status of Dangerous (requests to resources with the Dangerous status, in red), Adware and other (requests to resources with the Adware and other status, in yellow), Good (requests to resources with the Good status, in green), or Not categorized (requests to resources with the Not categorized status, in grey).

Zone—Color of the zone of the network activity (Red, Yellow, Green, or Grey).

Count—Number of network activities that belong to the zone.

DynamicDetections

Array of objects

Detects related to the analyzed file.

Zone—Color of the zone of the detected object (Red or Yellow).

Threat—Number of detected objects that belong to the zone.

TriggeredNetworkRules

Array of objects

SNORT and Suricata rules triggered during analysis of traffic from the file.

Zone—Color of the zone of the triggered rule (Red or Yellow).

RuleName—Name of the triggered rule.