File hashes search

You can search for file hashes by selecting the File tab after selecting the Search tab.

Searching objects

You can specify one or more files. The search will be done for MD5 hashes of these files.

Terminating the search process

You can terminate the search process while it is being performed. In this case, the search result form is cleared and the "Operation is canceled" message is displayed. The information about the requested file is added to the search requests history with a remark that the search process is not completed.

Search result

After a search is performed, Kaspersky CyberTrace Web displays the search statistics:

• Number of processed hash files
• Number of detected indicators
• Number of detections for each category

For every checked file hash the following information is displayed:

• File name
• MD5 file hash

  The file hash is linked to the information about the hash in Kaspersky Threat Intelligence Portal.

• Fields of feed records that matched the indicator
• Message that there is no detection (if the file hash is not detected)

If you run a search and then switch to another tab, the search results will become available in the search request history.

Downloading search reports

You can download a report with the results of the search operation. The report is a .csv file.

To download a report,

Click the Download report link and specify the directory to which you want to save the report.

A full report about a search result has the following fields:

• file_name—Name of the file whose hash is detected
• detected_indicator—The detected hash
• category—Category of the detected hash
• Context fields from the feed

Page top