Analysis Rescans
This article describes how rescans work in ReversingLabs products, covering both static analysis rescans and Spectra Intelligence antivirus (AV) rescans.
Static analysis rescans
Samples are not automatically scheduled for static analysis rescanning by default. Given the high volume of files processed, static rescans only occur when a sample is resubmitted for analysis - for example, by re-uploading the file using the TCA-0202/0203 File Upload API, or by submitting it again from the Spectra Analyze or Spectra Detect appliance interface. The API uses the Spectra Intelligence static analysis cluster to perform the scan, while the appliances use their on-board Spectra Core instance.
Note that the TCA-0205 Re-Analyze File API does not trigger a static analysis rescan; it only triggers an AV reanalysis (see below).
If you report an issue with a sample's classification, ReversingLabs will reanalyze the file, including any related child samples when possible.
Spectra Intelligence antivirus rescans
ReversingLabs automatically rescans samples with updated AV signatures to ensure antivirus results remain current and accurate.
There are three kinds of automatic AV rescans:
- Samples that are deemed to be of special interest are automatically scheduled for rescanning 24 hours after their initial appearance.
- Samples submitted from multiple sources are rescanned upon each submission.
- Samples that are candidates for whitelisting are rescanned if they do not have at least two scans in the last 14 days.
The outcome is that a large portion of files gets processed multiple times over multiple days.
Querying a file hash through Spectra Intelligence returns the most recent cached result but does not trigger a rescan. To request a fresh AV analysis, use the TCA-0205 Re-Analyze File API.