Information in the Sandbox scan results section

The Sandbox scan results section may display the following information about an alert:

• File—Full name and path of the scanned file.
• File size—Size of the file.
• MD5—MD5 hash of a file.

  Clicking the link with MD5 opens a list in which you can select one of the following actions:

  • Find on Kaspersky Threat Intelligence Portal.
  • Find events.
  • Create a prevention rule.
  • Copy value to clipboard.
• Signed by—Author of the certificate containing the digital signature for the detected file.
• Detected—One or multiple categories of detected objects. For example, when the program detects a file infected with the Trojan-Downloader.JS.Cryptoload.ad virus, the Detected—Field shows Trojan-Downloader.JS.Cryptoload.ad for this alert.
• Time processed—Time when the file was scanned.
• Database versions—Versions of the databases of modules and components of Kaspersky Anti Targeted Attack Platform that generated the alert.

Information about the file behavior analysis results is provided for each operating system in which the Sandbox component performed a scan. For the Windows 7 operating system (64-bit), you can view file activity logs for two Sandbox component scan modes: Quick scan mode and Full logging mode.

The following activity logs may be available for each scan mode:

• Activity list—Actions of the file within the operating system.
• Activity tree—Graphical representation of the file analysis process.
• HTTP activity log—Log of the file's HTTP activity. It contains the following information:
  • Destination IP—IP address to which the file is attempting to go from the operating system.
  • Method—HTTP request method, for example, GET or POST.
  • URL—URL of the website link that the file is attempting to open from the operating system.

  Clicking the Destination IP and URL links opens a list in which you can select one of the following actions:

  • Find on Kaspersky Threat Intelligence Portal.
  • Find events.
  • Copy value to clipboard.
• IDS activity log—Log of IDS actions. It contains the following information:
  • Source IP—IP address of the host on which the file is saved.
  • Destination IP—IP address to which the file is attempting to go from the operating system.
  • Method—HTTP request method, for example, GET or POST.
  • URL—URL of the website link that the file is attempting to open from the operating system.
• DNS activity log—Log of the file's DNS activity. It contains the following information:
  • Request—Name and type of the DNS-request.
  • Response—Name and type of the response from the DNS server, as well as the host name or the IP address of the computer from which this response was received.
• Download full log —Log of file behavior analysis in each operating system.

Page top