Skip to main content
Version: Spectra Analyze 9.3.0

Sample Details Page

Types of Sample Details pages​

The Sample Details page presents all the available information about a sample.

Local​

For local files, the information is collected from Spectra Core static analysis results, Spectra Intelligence, dynamic analysis, and auxiliary analysis. Administrators can configure processing settings on the appliance (“Fast”, “Normal”, “Best”). This will impact which file formats will be fully processed and how much information will be presented for them.

An image showing the local version of the Sample Summary page.

Cloud​

For samples that are not local, the scope of information will depend on the information provided by Spectra Intelligence. This is usually a subset of what is available for locally available files: a section of static analysis results and Spectra Intelligence scanning results.

An image showing the cloud version of the Sample Summary page.

Network Threat Intelligence​

For URLs, domains and IP addresses, the appliance displays a different type of sample details page focused on Network Threat Intelligence.

Additionally, information displayed on the Sample Details page differs based on the file type and classification status of each sample.

An image showing the network threat intelligence version of the Sample Summary page.

Accessing Sample Details pages​

To access the Sample Details page for a sample, click the sample name in any of the following pages:

  • Search > Local and Spectra Intelligence results
  • Alerts
  • YARA > Local and local-retro ruleset matches

The page consists of a navigation sidebar on the left and the main information area on the right. The sidebar can be collapsed or expanded by clicking the Show/Hide Panel button at the top of the sidebar.

At the top of the navigation sidebar, there’s a persistent short summary showing information such as file hash, predicted filename (if it exists), file size, file type and format, and the Preview / Visualizations link to open the File Preview Dialog. If the predicted filename exists, it can be found right below the file hash.

The right section of the page is the main information area. Its contents change depending on the section selected in the navigation sidebar.

The navigation sidebar provides quick access to all parts of the analysis report. The sidebar sections are collapsed by default, unless the Sample Details page is accessed via a specific link targeting a section in the sidebar.

Main Page Actions​

When any item from the File Analysis Detail section is selected in the sidebar, the main information area will contain the following options in the top right of the page:

Reanalyze​

Opens a floating dialog where users can reanalyze the submission with static, dynamic, or Spectra Intelligence analysis services.

Similarity​

Contains advanced search pivot options to search for similar and functionally similar samples.

Fetch & Analyze​

Only on cloud samples.

This option will download the sample from the Spectra Intelligence cloud and analyze it locally on the appliance. If the sample is not available for download, the button will be disabled.

Actions Button​

Depending on the type of page, different choices are available.

Local samples:

  • PDF:
    • Create PDF option exports the whole Summary page as a PDF file.
    • Export PDF (Short) exports a shortened version, with the current layout.
  • Downloading samples (both extracted files and original samples) always uses ZIP archives (optionally password-protected).
  • Sample management options:
    • editing classification or tags
    • subscribing and unsubscribing
    • deleting the sample

PDF reports have a retention period of 30 minutes and will not reflect changes that happened after they were generated. If a sample’s classification changed after the PDF report was already created, users must wait for the retention period to expire before requesting it again or use the PDF Report API endpoints to immediately generate and download an updated PDF report.

warning

Because some PDF viewers automatically convert all strings with an http[s]* schema into clickable hyperlinks, it is not recommended to click any links in the generated PDF as they may lead to malicious content.

Cloud samples:

Only subscribing and unsubscribing is available.

URLs:

  • Reanalyze
  • Download options:
    • Payload: scraped content (if you used local analysis when submitting the URL).
    • Screenshots and dropped files: OS artifacts taken from dynamic analysis. The artifacts are in a 7z archive (password: infected).

Layouts ⚙​

Only on local samples.

Select one of the preconfigured layouts of the report summary page, or create your own. Created layouts can be either personal or shared. If shared, other users can also use the layout.

Read more about layouts in the Administration chapter.