File Preview / Visualization

There are several ways to preview a file:

• by clicking the “Preview / Visualizations” link in the persistent sample summary above the navigation sidebar
• from the Preview / Visualizations menu item in the sidebar
• by clicking the View HEX option in the actions menu (☰) for a file on the Extracted Files page

The file preview window contains three tabs: Hex, Structure and Entropy.

For samples that matched a YARA rule, the Hex tab displays a YARA Matches filter, allowing the users to see the exact parts of the file that matched a specific YARA rule. Matches can be filtered by ruleset, rule or matched value.

The Entropy tab visualizes the amount of entropy per each section of the file. Entropy is used to express “randomness” of the data in a file, or to measure predictability of any character in the file based on preceding character distribution. It is measured in a scale of 1 to 8, where 8 indicates highest entropy (highest measure of randomness). Typical user data, such as text files, rarely exhibits true randomness. On the other hand, encrypted or compressed files have a high measure of entropy. Therefore, entropy can be used to detect encryption and compression in suspicious files.

The Structure tab visualizes the sections of a PE/PE+ file, such as PE header, Import table, and Overlay. It is possible to click the items in the list on the right (Virtual, Physical, Import table, Resource table…). Clicking an item redirects the user to the related section of the static analysis results (on the Spectra Core page).

For supported image formats (PNG, JPG, GIF), additional View Image tab will be present. The View Image tab allows the users to preview the image. The appliance displays a warning message before allowing the image preview.

The RLCS Screenshots tab displays a preview of screenshots taken during the Reversing Labs Cloud Sandbox analysis. If no screenshots or analysis were made, the preview window displays a message with a link to send the sample for reanalysis.