File hashes search

You can search for file hashes by selecting the File hashes tab on the Search page. To access this page, you need to switch to the Data management mode.

The File hashes tab

Search for objects

You can specify one or more files. The search will be done for the MD5 hashes of these files.

To search for file hashes:

1. Select the files that you want to search for. Do one of the following:
   • Click the Select files button, and then select the files.
   • Drag the files into the colored area.
2. Click the Search button.

The search result will appear below in the Search report section.

Search result

After a search is performed, Kaspersky CyberTrace Web displays the result in the Search report section.

The Search report section

The search result consists of the following data:

• Number of processed files
• Number of matched indicators
• Number of matches for each category

For every checked file hash, the following information is displayed:

• File name
• MD5 file hash

  The file hash is linked to detailed information about the object.

• Fields of feed records that matched the indicator

If no information is found for the requested file, a message about this is displayed.

If you run a search and then switch to another tab, the search results will become available in the search request history.

Downloading search reports

You can download a report with the results of the search operation. The report is a .csv file.

To download a report,

Click the Download full report button, and then, if asked, specify the directory to which you want to save the report.

A full report about a search result has the following fields:

• file_name—Name of the file whose hash is detected
• detected_indicator—The detected hash
• category—Category of the detected hash
• Context fields from the feed

Page top