Kaspersky Anti Targeted Attack Platform

Information in the Object information section

The Object information section can display the following event information about the detected file:

• File name.

  To expand the Copy value to clipboard action, click the link with the file name.

• File type. For example: ExecutableWin32.

  The Find on KL TIP button allows to find a file on the

  Kaspersky Threat Intelligence Portal

  Kaspersky information system Contains and displays reputation information for files and URL addresses.

  .

  Click Create a prevention rule to prevent the file from running.

  Click Download file to download the file to your computer's hard drive.

  The file is downloaded in the form of a ZIP archive encrypted with the password “infected”. The name of the file inside the archive is replaced by the file's MD5 hash. The file extension of file inside the archive is not displayed.

• File size in kilobytes.
• MD5—MD5 hash of a file.

  Clicking the link with MD5 opens a list in which you can select one of the following actions:

  • Find on KL TIP.
  • Find events.
  • Find alerts.
  • Create a prevention rule.
  • Copy value to clipboard.
• SHA256—SHA256 hash of a file.

  Clicking the SHA256 link opens a list in which you can select one of the following actions:

  • Find on KL TIP.
  • Find on virustotal.com.
  • Find events.
  • Find alerts.
  • Create a prevention rule.
  • Copy value to clipboard.
• Email from—Email address from which the message containing the file was sent.
• Email recipients—One or more email addresses to which the message containing the file was sent.
• Email subject—Message subject.
• Email headers—Extended set of email message headers. For example, it can contain information about email addresses of the message sender and recipients, about mail servers that relayed the message, and the type of content in the email message.