Hashes
| {{ key }} | {{ data['hashes'][key] }} |
|---|
History
| First submission: | {{ history[0] }} |
|---|---|
| Last submission: | {{ history[1] }} |
Names
{% endfor %}
{% if data['virustotal_detection'] %}
Positives: {{ data['virustotal_detection']['data']['attributes']['last_analysis_stats']['malicious'] }}
First submission date: {{ data['virustotal_detection']['data']['attributes']['first_submission_date'] }}
Last scan date: {{ data['virustotal_detection']['data']['attributes']['last_analysis_date'] }}
{% else %}
{% endif %}
VirusTotal results
First submission date: {{ data['virustotal_detection']['data']['attributes']['first_submission_date'] }}
Last scan date: {{ data['virustotal_detection']['data']['attributes']['last_analysis_date'] }}
Permanent link: https://www.virustotal.com/gui/file/{{ data['hashes']['SHA-1'] }}
| AV | Malicious | Result | Version | Update | ||
|---|---|---|---|---|---|---|
| {{ key }} | {% if values['category'] == 'malicious' %}True | {{ values['result'] }} | {% else %}False | {{ values['category'] }} | {% endif %}{{ values['engine_version'] }} | {{ values['engine_update'] }} |
Trying to get VirusTotal results... You might want to reload this page.
Freki constantly queries the VirusTotal API for reports.
{% if current_user.is_authenticated %} Please save your key at your profile. {% endif %}
{% block analysis %}
{% if data['basic_information']['mime_type'] == 'application/x-dosexec' %}
{% if data['foremost'] %}
{% endif %}
{% for key in data['pe_info']['imports'] %}
{% endfor %}
{% for key in data['capa'] %}
{% endfor %}
{% endfor %}
{% endfor %}
{% else %}
{% endif %}
{% endblock analysis %}
Summary
Product description
| Company name: | {{ data['pe_info']['summary']['CompanyName'] }} |
|---|---|
| Product name: | {{ data['pe_info']['summary']['ProductName'] }} |
| Original file name: | {{ data['pe_info']['summary']['OriginalFilename'] }} |
| Internal name: | {{ data['pe_info']['summary']['InternalName'] }} |
| File description: | {{ data['pe_info']['summary']['FileDescription'] }} |
| File version: | {{ data['pe_info']['summary']['FileVersion'] }} |
| Legal copyright: | {{ data['pe_info']['summary']['LegalCopyright'] }} |
Basic information
| Architecture: | {{ data['pe_info']['summary']['arch'] }} |
|---|---|
| Imphash: | {{ data['pe_info']['summary']['imphash'] }} |
| Compilation date: | {{ data['pe_info']['summary']['compilation_date'] }} |
| EXE: | {{ data['pe_info']['summary']['is_exe'] }} |
| DLL: | {{ data['pe_info']['summary']['is_dll'] }} |
| Warnings: | {{ data['pe_info']['summary']['warnings'] }} |
DOS header
| Magic number: | {{ data['pe_info']['dos_header']['e_magic'] }} |
|---|---|
| Bytes on last page of file: | {{ data['pe_info']['dos_header']['e_cblp'] }} |
| Pages in file: | {{ data['pe_info']['dos_header']['e_cp'] }} |
| Relocations: | {{ data['pe_info']['dos_header']['e_crlc'] }} |
| Size of header: | {{ data['pe_info']['dos_header']['e_cparhdr'] }} |
| Min extra paragraphs: | {{ data['pe_info']['dos_header']['e_minalloc'] }} |
| Max extra paragraphs: | {{ data['pe_info']['dos_header']['e_maxalloc'] }} |
| Initial SS value: | {{ data['pe_info']['dos_header']['e_ss'] }} |
| Initial SP value: | {{ data['pe_info']['dos_header']['e_sp'] }} |
| Checksum: | {{ data['pe_info']['dos_header']['e_csum'] }} |
| Initial IP value: | {{ data['pe_info']['dos_header']['e_ip'] }} |
| Initial CS value: | {{ data['pe_info']['dos_header']['e_cs'] }} |
| OEM identifier: | {{ data['pe_info']['dos_header']['e_oemid'] }} |
| OEM information: | {{ data['pe_info']['dos_header']['e_oeminfo'] }} |
| Address of NE header: | {{ data['pe_info']['dos_header']['e_lfanew'] }} |
File header
| Architecture: | {{ data['pe_info']['file_header']['arch'] }} |
|---|---|
| Time date stamp: | {{ data['pe_info']['file_header']['time_date_stamp'] }} |
| Number of sections: | {{ data['pe_info']['file_header']['number_sections'] }} |
| Pointer to Symbol Table: | {{ data['pe_info']['file_header']['pointer_symbol_table'] }} |
| Number of symbols: | {{ data['pe_info']['file_header']['number_symbols'] }} |
| Size of Optional Header: | {{ data['pe_info']['file_header']['size_optional_header'] }} |
| Characteristics: | {{ ', '.join(data['pe_info']['file_header']['characteristics']) }} |
Optional header
| Magic | {{ data['pe_info']['optional_header']['magic'] }} |
|---|---|
| Image base | {{ data['pe_info']['optional_header']['image_base'] }} |
| File alignment | {{ data['pe_info']['optional_header']['file_alignment'] }} |
| Size of image | {{ data['pe_info']['optional_header']['size_of_image'] }} |
| DLL characteristics | {{ data['pe_info']['optional_header']['dll_characteristics'] }} |
Yara matches
{{ ', '.join(data['yara']) }}
Foremost
| File | Size |
|---|---|
| {{ f }} | {{ data['foremost'][f][1] }} |
Sections
| Section | Virtual Address | Virtual Size | Pointer to raw data | Characteristics | Entropy | MD5 |
|---|---|---|---|---|---|---|
| {{ key }} | {{ data['pe_info']['sections'][key]['vaddress'] }} | {{ data['pe_info']['sections'][key]['vsize'] }} | {{ data['pe_info']['sections'][key]['pointer_to_raw'] }} | {{ data['pe_info']['sections'][key]['characteristics'] }} | {{ data['pe_info']['sections'][key]['entropy'] }} | {{ data['pe_info']['sections'][key]['md5'] }} |
Imports
+ {{ key }}
| Name | Address |
|---|---|
| {{ i['name'] }} | {{ i['address'] }} |
Capabilities
+ {{ key }}
| Namespace | Scope | Matches |
|---|---|---|
| {{ data['capa'][key]['namespace'] }} | {{ data['capa'][key]['scope'] }} |
{% for i in data['capa'][key]['matches'] %}
{{ i }} {% endfor %} |
Strings
URLs
{% for url in data['pe_info']['strings']['urls'] %} {{ url }}{% endfor %}
IPs:
{% for ip in data['pe_info']['strings']['ips'] %} {{ ip }}{% endfor %}
Data directories
| Data directory | Virtual Address | Size |
|---|---|---|
| {{ key }} | {{ data['pe_info']['optional_header']['data_dir'][key]['vaddress'] }} | {{ data['pe_info']['optional_header']['data_dir'][key]['size'] }} |
Static analysis is available only for PE files for now.
Comments
{% for c in comments %}
{% with messages = get_flashed_messages() %}
{% if messages %}
{{ messages[0] }}
{% endif %} {% endwith %}
{{ c.text }}
{% else %} {% endif %}