Spectra Detect Report Schema

note

This document is a work in progress.

Introduction

This document describes data in the report of the analysis performed by a Spectra Detect Worker.

Notable changes

The format of the report has changed since the last version of this document (v1.6):

The classification field now contains rca_factor, a unique measure of the trustworthiness of a sample (read more in Classification).
The classification field also contains a result, which provides the threat name.
Results by individual scanners may be ignored.
Attack indicators now have descriptions, categories, relevance, and a unique numeric ID.
The interesting_strings and story sections have additional fields.
There is more information for analyzed PE files, including a security_grade.
The metadata section has been reorganized (read the full list of metadata changes in Appendix D):
- redesigned security, media and browser fields
- added signatures, certificates, package, attack and malware fields
- removed certificate field

Data Analysis Workflow

Check the file threat score and classification in the Classification section:

classification
- 0: Unknown
- 1: Goodware
- 2: Suspicious
- 3: Malicious
rca_factor (if classification is not 0) is the trust or threat level, ranging from 0 to 10:
- 0 represents highest trust
- 10 represents most dangerous threat
result shows the threat name (only visible if the analyzed file is a threat)

Analyze interesting strings and strings section

Check URL and IP address information if present

Check the file itself

File name
File format (type, sub-type, format/packer)

Check the Tags section

File type in conjunction with Tag can flag a file with potentially malicious intent
Interesting tags:
- anonymous-email
- cert-expired
- cert-invalid
- cert-revoked-...
- cert-untrusted
- cert-self-signed
- starts with contains-
- cryptocurrency
- starts with ransomware-
- starts with uri-
- starts with av-
- data-exfiltration
- file-download
- ftp-use
- starts with privacy-
- backdoor
- c2
- custom-packed
- downloader
- keylogger
- pos
- ransomware
- anti...
- cert-blacklisted
- starts with capability-
- starts with indicator-
- starts with email-
- deceptive-link
PDF files
check Tags starting with indicator- and capability- to see if the PDF file can execute files or download files
Microsoft Office files
Check whether VBA Scripts/Macros present and exhibit suspicious indicators - see tags such as indicator-macro and starting with indicator- and capability-

Check extracted file statistics

High entropy value (maximum is 8) can be a sign of obfuscation

Microsoft .NET files

Check called functions

JAVA dex files

Check called functions

Adobe Flash files

Check called ActionScript functions

Check YARA matches if any

YARA section

Check file certificate

Check certificate section whether certificate is valid

Check file validation

Check validation section to see if the file is malformed, or if the file certificate is blacklisted

Check who compiled the file and when, sometimes that reveals interesting information

PDB Path section
Debug symbols link in the compiled file, can contain information of the machine that compiled the malware
Compile Date
Look at the Signer section

Check whether file is similar to other files of the same status (MALICIOUS/SUSPICIOUS)

Use RHA statistics section

Windows executables

Check PE VS_Info section
Check if the file content is protected
- PE Protection section
Check the content in taggant section

Basic Data Types

Reports received from Spectra Detect Worker will have fields with the following data types:

Type	Description
`int`	Signed integer, e.g. `int32`
`uint`	Unsigned integer, e.g. `uint16`
`decimal`	Floating-point number, e.g. `decimal64`
`bool`	Boolean value: `True` or `False`
`string`	UTF-8 encoded text

Other data types (enum, list, struct, struct-list) link to their own sections where their components are listed in terms of basic data types.

Spectra Detect Report

The root of the report contains the following fields:

Field	Type	Description
submitted	int32	File submission time (UNIX timestamp).
task_id	int32	ID assigned to the processing task.
processed	int32	File processing time (UNIX timestamp).
worker_ip	string	IP address of the Worker that processed the file.
worker_address	string	Address of the Worker that processed the file.
worker_hostname	string	Hostname of the Worker that processed the file.
direct_sender	string	IP address of the machine that sent the file to the Worker (usually Spectra Detect Hub).
forwarded_for	list: string	IP address of the original sender of the file.
file_link	string	Link to the analyzed file.
custom_data	struct	User-defined data (JSON).
network_reputation	struct-list:Network Reputation	Reputation information on any network resources found within the file
tc_report	struct: Analysis	Analysis report for the file.

Analysis

In the tc_report field of a Spectra Detect report, the following fields are possible:

Field	Type	Description
relationships	struct: Relationships	List of all the children, children of those children, their children etc. ONLY if previously enabled.
info	struct: Info	General information about the file.
metadata	struct: Metadata	File metadata.
strings	struct-list: String	List of strings found in the file.
classification	struct: Classification	Classification of the file (is it malicious or not).
indicators	struct-list: Indicator	Indicators of suspicious behavior.
interesting_strings	struct-list: Interesting string	Interesting strings (such as IP addresses to which a file might try to connect).
story	struct-list: Story	Summary that gives a human-readable overview about this file.
tags	list: string	During analysis, a file receives several tags related to its properties.
index	int32	The position of this report in the set of reports.
parent	int32	The position of the report that is the parent of this report.
children	list: int32	List of report indexes that are considered children of this report. E.g. if a file has two sub-files, there would be three reports in total. The first report representing the main file would contain values [1,2] for children. Reports for 1 and 2 would be analysis reports for the sub-files.

Classification

The key information here is the classification field, which will be a number from 0 to 3:

VALUE	DESCRIPTION
0	No classification (unknown)
1	Goodware
2	Suspicious
3	Malicious

Other fields provide more info:

Field	Type	Description
propagated	boolean	Indicates whether the classification has been propagated from a file contained in the analyzed file.
classification	int32	Final verdict on file’s classification based on all scan results. This result should be used when making classification decisions.
factor	int32	A number from 0 to 5. If `classification` is `1`, this is the "trust factor", or how confident we are that the file is goodware (0 is highest confidence, 5 is lowest confidence). If the `classification` is `3`, then this is the "threat level", or how dangerous the malicious file is (0 is least dangerous, 5 is most dangerous). This field will be deprecated and replaced with `rca_factor`.
result	string	Threat name in case the file is a threat. If not, this field is not present.
rca_factor	int32	Unique measure of the trustworthiness of a file, regardless of its classification. Ranges from 0 to 10, with 0 being most trustworthy files, and 10 being most dangerous malware.
scan_results	struct-list: Scanner result	Contains all scan results from all different sources retrieved by the analysis engine. If this section is not present in the output, that means the file could not be classified by the static analysis engine or by any of the Spectra Intelligence components.
yara	struct-list: YARA	Matched YARA rules.
propagation_source	struct: Pair	Origin of the final top-level classification (the child file which caused the parent file to receive its classification).

Scanner result

Different scanners have their own individual classifications, which are then used as components to form the final classification. See the next section for an overview of used scanners.

Field	Type	Description
ignored	boolean	if true, the result will be excluded from final classification
classification	int32	classification that was assigned by this scanner
factor	int32	this is either trust or threat factor depending on classification; trust is assigned only to goodware classifications
name	string	scanner name
version	string	scanner version
result	string	scanner result
type	enum: scanner_type
rca_factor	int32
properties	struct-list: Property	scanner result properties

Spectra Core Classification Scanners

Scanner name	Description
Spectra Core Format	Certain file formats, such a Windows executable packers, are intended to be used as means of evading security solutions. Detecting that a file is protected with this type of evasive technology is sufficient to declare it, and its payload, as a threat. If the format can also be used by non-malicious applications, the resulting detection will be suspicious or malicious. Threat name is constructed from the format name, for example `Win[32\|64].Packer.{PackerName}`
Spectra Core YARA	Threat detection capabilities included with the engine can be extended by adding user-defined YARA rules. Native integration with classification logic ensures that threats can be both detected and named using these rules. Spectra Core includes hundreds of YARA rules as examples of such integration. While ideally all YARA rules would be updated for best integration with the engine, this isn’t required. Depending on how the engine is configured, any YARA rule can be considered a threat detection rule. In cases when YARA rule integration is superficial, the detected threat name can, for example, be `{Platform}.Malware.YARA`
Spectra Core RHA1	ReversingLabs Hashing Algorithm (RHA1) is a proprietary functional file similarity algorithm. It is primarily designed for executable formats, and as such it is specifically implemented for each supported format. RHA1 converts functional file features, both the code and its layout, to four precision level hashes. Each precision level represents a 25% increase in similarity between files that share the same hash at the same precision level. Lowest precision is 25% and highest is a 100%. Spectra Core comes with an offline database of blacklisted RHA1 hashes. This technology is capable of detecting polymorphic threats and their variants. Even though threats are detected based on similarity, they are still named after the threat the file is most similar to.
Spectra Core RICC	Rules, Indicators, Classifications and Capabilities (RICC) is an offline database that applies static analysis rules to analyzed content. Part of its responsibility is to classify files based on signatures and unique metadata properties found only in malicious files. Two such classification technologies are deployed through RICC. Byte Pattern Matches as signatures that detect known threats, and Malware Artifacts Classifier that looks at the metadata for malware clues. Both of these technologies correlate the detection to a named threat. In terms of classification, they are the most specific detection technologies within the engine, and are reserved to be used only for precise threat detections.
Spectra Core Machine Learning	Machine learning is a predictive detection technology. Explainable Machine Learning, a concept unique to ReversingLabs, bases its classification on the principles of expandability, transparency and relevancy. Based solely on human readable indicators, machine learning models detect specific threat types and can differentiate between threats and benign files. When the machine learning model predicts that a threat type falls into a recognized category, it will name the threat as `Win[32\|64].{ThreatType}.Heuristic`. However, if the model is certain that the file is a threat, but can’t place it into a threat category, it will name the threat as `Win[32\|64].Malware.Heuristic`. Machine learning models are made to detect Windows executable and fileless malware types.
Spectra Core Document Classifier	Scripts and macros embedded within documents represent a significant attack vector. Due to the nature of script programming languages, attacks can easily be modified to the point they are no longer detectable by simple byte pattern signature. Detecting such threats proactively is only possible through heuristics and machine learning models. Spectra Core applies both of these approaches to threat detection. When a threat is detected through machine learning, the detected threat name can, for example, be `Document-{SubPlatform}.Malware.Heuristic`. On the other hand, heuristics are human-written and are more specific with their labeling. An example of a human-written heuristic detection is a threat named `Document-{SubPlatform}.Trojan.Heuristic`
Spectra Core URL Classifier	Many file formats enable active linking to content hosted on remote servers. These are commonly referred to as hyperlinks or uniform resource locators (URL). Since the active content is on a remote server, it can change at any time. However, some URLs itself do contain information that helps to infer the content type to which they are pointing to. With static analysis, Spectra Core can detect various kinds of deceptive links without visiting the content targeted by the URL. Attacker techniques such as typosquatting, domain spoofing, and homoglyphs are detected for more than 5000 popular websites. In addition to deceptive links, the solution includes an offline database of blacklisted domains and known malicious URL patterns. When the engine finds an embedded link that points to a blacklisted domain, it will name the threat as `{Platform}.Hyperlink.Blacklisted`
Spectra Core Email Classifier	Email messages are stored in structured file formats. This encapsulation includes email headers, message body and a number of attachments. Any of these components can be malicious and therefore needs to be inspected. Email headers are checked for identity misrepresentation that relates to phishing and BEC attacks. Message bodies are inspected for URLs that could lead to phishing and malware downloads. Attachments are decomposed through static analysis in search for malicious code. Additionally, any attached file is also inspected for embedded URLs that themselves are checked for malicious intent. When this technology detects phishing, it will name the threat as `Email.Phishing.{ServiceName}`. The following services can be identified: Adobe, Amazon, AmericanExpress, Apple, BankOfAmerica, ChaseBank, DocuSign, Dropbox, Ebay, Facebook, Google, LinkedIn, Microsoft, Netflix, PayPal, Twitter and WhatsApp. If the email was detected as malicious due to embedded URL, the threat name can appear as `Email.Hyperlink.Homoglyph`
Spectra Core Image Analyzer	Multimedia formats are frequently abused as carriers of malicious payloads. They can hide malware using steganography techniques, or they can abuse format parsers to trigger code execution bugs. Static analysis performed for these formats looks for embedded scripts and shellcode. For example, this heuristic detection technology can detect PHP code within a GIF file, or JavaScript within JPEG EXIF properties. In both of these cases, the detected threat name will be `{Platform}.Format.Heuristic`
Spectra Core Exploit Detector	During engine analysis, parsed format structure is validated and any departures from specification are reported. Detected malformations are automatically mapped back to exploits that are known to abuse format parsing bugs. Exploit detectors are a special kind of signature detections. They are implemented individually for each supported format, and are made to detect known exploits. Exploit detection is available for images, documents, archives and mobile application package formats. When an exploit is detected within an image format, the reported threat name can be `{Platform}.Exploit.CVE-{ID}`
Spectra Core Hierarchy Analyzer	During automated file extraction, the supported formats are decomposed recursively. Unexpected format combinations can be discovered during extraction. For example, documents and multimedia files should never embed executable files. If such unusual format combinations are discovered, the engine will declare those files as suspicious with the following threat name: `{Platform}.Format.Content`
Spectra Core Certificate Lists	Applications, archives, documents and software packages can all be digitally signed. These signatures guarantee integrity and certify the origin of the content they are signing. Spectra Core comes with a customizable list of signers, or identities, that own recognized certificates. These identities can be added to either the Spectra Core certificate blacklist or whitelist. The former will declare signed content as malicious, while the latter will classify analyzed content as goodware. When a file is declared to be malicious due to a blacklisted certificate, the threat name will be displayed as `{Platform}.Certificate.Blacklisted`
Spectra Core Certificate Validator	Digital signatures include a file integrity validation hash. Validating digital certificates is a multi-step process. Valid certificates have a properly formed digital certificate chain and pass file hash integrity validation. Spectra Core detects signed file tampering and is capable of detecting signer impersonation, certificate malformation and content modification. Failing to comply with any of these checks will classify the file as at least suspicious. The displayed threat name will reflect the detected type of the tampering attempt. When a self-signed certificate is trying to misrepresent itself and emulates a trusted certificate, the displayed threat name will be `{Platform}.Certificate.Impersonation`. On the other hand, when a file fails integrity validation, the threat name can appear as `{Platform}.Certificate.Invalid` or `{Platform}.Certificate.Malformed`. In case of valid signing time, with signature that is created after signing certificate is already expired or revoked by Certificate Authority, threat name will be `{Platform}.Certificate.SignedAfterExpiration` and `{Platform}.Certificate.SignedAfterRevocation` respectively.
Spectra Core Graylisting	Due to a lack of strong goodware indication, an accurate classification can not be determined for a number of analyzed files. While the file was not determined to be a threat, it could not be linked to a trusted publisher or a data source. Such files would typically have to be classified as unknown. Graylisting as a technology implements weak whitelisting approximation. For certain file types that are not known to carry malicious payloads, graylisting will approximate classification to goodware with lowest trust. To qualify, the file must also have no active content such as scripts, macros, hyperlinks, or any kind of statically deducible behavior pointing to code execution. If this criteria is met, the file will be declared as implicit goodware and will be labeled as `{Platform}.Format.Graylisted`
Spectra Intelligence	Spectra Core can be connected to ReversingLabs Spectra Intelligence as a file reputation source. During automated static analysis, Spectra Core will submit a hash of every file it encounters for additional classification. Spectra Intelligence has file reputation information on over 10B files, including both whitelisted and blacklisted binaries. Depending on the classification assigned to the hash, locally processed content can change or override the final classification.

YARA

Field	Type	Description
classification	int32	Classification as determined by YARA rule.
identifier	string	YARA rule name.
filename	string	Filename of the YARA rule.
ns	string	YARA rule namespace.
hash	string	YARA ruleset hash.
tags	list: string	Tags that the YARA rule is tagged with.
metas	struct-list: Pair	YARA rule metadata.
strings	struct-list: YARA string	Strings that matched the YARA rule.

YARA string

Field	Type
string	string
match	struct-list: YARA string match

YARA string match

Field	Type	Description
offset	int64	match offset
length	int32	full matched data length
data	string	matched data

Relationships

If this section is enabled in the report service, it lists all children files (and their children files) of the analyzed file.

The full analysis report includes additional parent/child metadata in the form of index numbers starting with 0 and ending with N, where 0 indicates the starting ("root" parent) file, and N the last extracted child file.

If you notice any of the documents embedded in MS DOC, RTF or PDF files of the types documented in Appendix A: Suspicious Embedded File Types there is a reasonable possibility that the original, parent file has malicious intent.

Field	Type	Description
id	string	SHA1 hash of the analyzed file.
parent	string	SHA1 of the parent file. This value is not returned for the top-level entry in the list (the "root" parent file), because that file does not have a parent.
container	string	SHA1 of the top-level parent file.
children	struct-list: Relationships	List of all the direct children of this particular file.

Info

Field	Type
statistics	struct: Statistics
file	struct: File
identification	struct: Identification
binary_layer	struct: Binary layer
validation	struct: Validation
unpacking	struct: Unpacking
properties	struct-list: Property
overlays	struct-list: Overlay
warnings	list: string
errors	list: string

Statistics

Field	Type
file_stats	struct-list: file_stats_item

file_stats_item

Field	Type
type	string
subtype	string
count	int64
identifications	struct-list: file_stats_item_identification

file_stats_item_identification

Field	Type
count	int64
name	string

File

Some archive files (containers) preserve file modification dates, which are propagated down to their children files (contained files). This metadata is stored in the file_properties section.

Field	Type	Description
file_type	string	File type.
file_subtype	string	File sub-type.
file_name	string	File name as assigned by engine.
file_path	string	File path as assigned by engine.
size	uint16	File size.
entropy	decimal64	File entropy calculated using Shannon's algorithm.
hashes	struct-list: Pair	Calculated file hashes.
modified_time	string	File modified time (ISO-8601).
access_time	string	File accessed time (ISO-8601).
proposed_filename	string	Supposed filename extracted from other metadata if the original filename is not available.
creation_time	string	File created time (ISO-8601).

Identification

Field	Type	Description
success	boolean	format identification successful
name	string	format name
version	string	format version
author	string	matching signature author

Binary Layer

Field	Type	Description
is_binary_layer	boolean	whether this is a binary layer
type	enum: binary_layer_type	type of binary layer
offset	uint64	first byte position where layer starts
size	uint64	size of the layer in bytes
info	string	additional info

binary_layer_type (enum)

unknown
resource
section
overlay
stego

Validation

Field	Type	Description
valid	boolean	whether file is valid (if all results are valid)
scan_results	struct-list: Validation Result	validation results

Validation Result

Field	Type	Description
valid	boolean	whether the certificate was found to be valid
name	string	scanner name
version	string	scanner version
results	list: validation_description	possible outcomes related to the analysis of certificates
warnings	list: string	list of warnings related to validation
type	enum: scanner_type	used scanners

validation_description (enum)

bad_checksum
bad_signature
invalid_certificate
expired_certificate
blacklisted_certificate
whitelisted_certificate
malformed_certificate
self_signed_certificate
impersonation_attempt
untrusted_certificate
revoked_certificate
revoked_certificate_unspecified
revoked_certificate_key_compromise
revoked_certificate_ca_compromise
revoked_certificate_affiliation_changed
revoked_certificate_superseded
revoked_certificate_cessation_of_operation
revoked_certificate_hold
revoked_certificate_remove_from_crl
revoked_certificate_privilege_withdrawn
revoked_certificate_aa_compromise
signed_after_revocation
bad_certificate_timestamp
security_catalog
signed_after_expiration

scanner_type (enum)

generic
av
sandbox
validator
unpacker
internal
cloud
user_override
certificate
whitelisting
analyst_override
ng_av

Unpacking

Field	Type
status	enum: unpacking_status
warnings	list: string

unpacking_status (enum)

unknown
failed
success
partial

Overlay

Field	Type	Description
from	enum: overlay_from	where the overlay comes from
offset	uint64	overlay physical offset
size	uint64	overlay physical size
entropy	decimal64	overlay entropy calculated using Shannon's algorithm
hashes	struct-list: Pair	set of overlay content hashes

overlay_from (enum)

pe
pe_security_directory
archive
binary
container
document
scripts
text
video
image

Metadata

This section contains the information about a sample extracted from static analysis. The information that is retrieved depends on the sample type, so some sections will not contain any data if they are inapplicable to the sample type.

Field	Type
application	struct: Application
protection	struct: Protection
security	struct: Security
behaviour	struct: Behaviour
signatures	struct-list: Signature
certificates	struct-list: Certificate
document	struct: Document
mobile	struct: Mobile
media	struct: Media
browser	struct: Browser
email	struct: Email
package	struct: Package
attack	struct-list: Attack
malware	struct: Malware

Application (Metadata)

Field	Type	Description
capabilities	uint32	capabilities of the application
pe	struct: PE	PE application metadata
elf	struct: ELF	ELF application metadata
macho	struct: Macho	MachO application metadata
dex	struct: Dex	DEX application metadata
dotnet	struct: Dotnet	NET application metadata
libraries	struct-list: Identity	detected libraries
identity	struct: Identity	application identity

The capabilities provide a brief overview of actions that a sample is capable of performing by outlining its basic features. Capabilities are expressed as a bit array (several capabilities can be expressed with one number code), and the name of each bit is provided.

Bit	Meaning
0x00000001	clipboard
0x00000002	ipc
0x00000004	threads
0x00000008	processes
0x00000010	storage
0x00000020	filesystem
0x00000040	peripherals
0x00000080	user_input
0x00000100	hardware_interfaces
0x00000200	networking
0x00000400	cryptography
0x00000800	security
0x00001000	system
0x00002000	modules
0x00004000	memory_management
0x00008000	user_interface
0x00010000	command_line
0x00020000	time_and_date
0x00040000	identity
0x00080000	monitoring
0x00100000	configuration
0x00200000	compression
0x00400000	multimedia
0x00800000	deprecated
0x01000000	undocumented
0x02000000	application_management
0x04000000	service_management
0x08000000	messaging
0x10000000	protection
0x20000000	drivers_k

Capabilities bit array for PE files

These are named and expressed in terms of bits as well (bitwise operations), with an additional clarification for what each bit represents.

none_k = 0,
clipboard_k = 1 << 0, whether app has capability for managing the clipboard
ipc_k = 1 << 1, whether app has capability for inter-process communication
threads_k = 1 << 2, whether app has capability for using and managing threads
processes_k = 1 << 3, whether app has capability for using and managing processes
storage_k = 1 << 4, whether app has capability for managing storage devices or volumes
filesystem_k = 1 << 5, whether app has capability for managing files or folders
peripherals_k = 1 << 6, whether app has capability for managing peripheral hardware devices
user_input_k = 1 << 7, whether app has capability for receiving user input
hardware_interfaces_k = 1 << 8, whether app has capability for managing hardware interfaces, ports or buses
networking_k = 1 << 9, whether app has capability for network communication
cryptography_k = 1 << 10, whether app has capability for cryptographic operations
security_k = 1 << 11, whether app has capability for managing security contexts
system_k = 1 << 12, whether app has capability for accessing operating system facilities
modules_k = 1 << 13, whether app has capability for using additional modules
memory_management_k = 1 << 14, whether app has capability for requesting and managing memory
user_interface_k = 1 << 15, whether app has capability for managing the user interface
command_line_k = 1 << 16, whether app has capability for using command line interface
time_and_date_k = 1 << 17, whether app has capability for managing time information or timers
identity_k = 1 << 18, whether app has capability for user identity management
monitoring_k = 1 << 19, whether app has capability for system status monitoring
configuration_k = 1 << 20, whether app has capability for managing system settings or configurations
compression_k = 1 << 21, whether app has capability for compressing or extracting data
multimedia_k = 1 << 22, whether app has capability for graphics, animation, audio or video
deprecated_k = 1 << 23, whether app has capability for using deprecated functionality
undocumented_k = 1 << 24, whether app has capability for using undocumented functionality
application_management_k = 1 << 25, whether app has capability for managing applications
service_management_k = 1 << 26, whether app has capability for managing services
messaging_k = 1 << 27, whether app has capability for sending messages
protection_k = 1 << 28, whether app has capability for securing the execution environment
drivers_k = 1 << 29, whether app has capability for managing drivers or kernel modules

PE

Field	Type
analysis	struct: Analysis
dos_header	struct: DOS header
rich_header	struct: Rich header
file_header	struct: File header
optional_header	struct: Optional header
sections	struct-list: PE section
imports	struct-list: Import
exports	struct: Export
resources	struct-list: Resource
version_info	struct-list: Pair
codeviews	struct-list: Codeview
taggant	struct: Taggant

Analysis

Field	Type
analysis_state	int32
security_grade	int32
issues	struct-list: Issue

Issue

Field	Type	Description
code	int32	unique issue code
name	string	unique issue name
description	string	issue description
relevance	int32	relevance for ML classification
count	int32

DOS header

Field	Type	Description
e_cblp	uint16	bytes on last page of file
e_cp	uint16	pages in file
e_crlc	uint16	relocations
e_cparhdr	uint16	size of header in paragraphs
e_minalloc	uint16	minimum extra paragraphs needed
e_maxalloc	uint16	maximum extra paragraphs needed
e_ss	uint16	initial (relative) SS value
e_sp	uint16	initial SP value
e_csum	uint16	checksum
e_ip	uint16	initial IP value
e_cs	uint16	checksum
e_lfarlc	uint16	file address of relocation table
e_ovno	uint16	overlay number
e_res	string
e_oemid	uint16	OEM identifier (for e_oeminfo)
e_oeminfo	uint16	OEM information (e_oemid specific)
e_res2	string
e_lfanew	uint32	file address of new exe header

Rich header

Field	Type	Description
checksum	uint32	Rich Header checksum as present in file
offset	uint64	Rich Header start offset
size	uint64	Rich Header size in bytes
entries	struct-list: Entry	Rich header entries

Entry

Field	Type	Description
tooling	uint32	toolchain component type
version	uint16	toolchain component product version
product	uint16	toolchain component product id
counter	uint32	number of times used

File header

Field	Type
machine	uint16
number_of_sections	uint16
time_date_stamp	uint32
time_date_stamp_decoded	string
pointer_to_symbol_table	uint32
number_of_symbols	uint32
size_of_optional_headers	uint16
characteristics	uint16

Optional header

Field	Type
is_checksum_valid	boolean
major_linker_version	uint8
minor_linker_version	uint8
size_of_code	uint32
size_of_initialized_data	uint32
size_of_uninitialized_data	uint32
address_of_entry_point	uint32
base_of_code	uint32
base_of_data	uint32
image_base	uint64
section_alignment	uint32
file_alignment	uint32
major_os_version	uint16
minor_os_version	uint16
major_image_version	uint16
minor_image_version	uint16
major_subsystem_version	uint16
minor_subsystem_version	uint16
win32_version_value	uint32
size_of_image	uint32
size_of_headers	uint32
checksum	uint32
subsystem	uint16
dll_characteristics	uint16
size_of_stack_reserve	uint64
size_of_stack_commit	uint64
size_of_heap_reserve	uint64
size_of_heap_commit	uint64
loader_flags	uint32
number_of_rva_and_sizes	uint32
data_directories	struct-list: Data directory

Data directory

Field	Type	Description
address	uint32	data directory relative start
size	uint32	data directory size

PE section

Field	Type	Description
name	string	section name
flags	uint32	section flags
relative_base	uint32	section relative virtual address
physical_base	uint32	section physical offset
relative_size	uint32	section relative size
physical_size	uint32	section physical size
entropy	decimal64	section content entropy
hashes	struct-list: Pair	set of section content hashes

Import

Field	Type
name	string
apis	list: string

Export

Field	Type
name	string
apis	list: string

Resource

Field	Type	Description
type	string	resource type name or the corresponding ID
name	string	resource name or the corresponding ID
language_id_name	string	language ID decoded to language name
language_id	uint32	language ID
code_page	uint32	code page used
offset	uint32	resource physical offset
size	uint32	resource physical size
entropy	decimal64	data entropy calculated using Shannon's algorithm
hashes	struct-list: Pair	set of resource content hashes

Codeview

Field	Type
timestamp	string
guid	string
pdb_path	string
revision	uint32

Taggant

Field	Type	Description
packer_info	struct: Packer info	Packer information
timestamp	string	Time stamp
spv_certificate	struct: Certificate object	SPV (Software Protection Vendor) certificate
user_certificate	struct: Certificate object	User certificate

Packer info

Field	Type	Description
name	string	Packer name
id	uint32	Packer ID
version_major	uint16	Packer major version
version_minor	uint16	Packer minor version
version_build	uint16	Packer build version
reserved	uint16	Packer reserved field

ELF

Field	Type	Description
type	uint16	object file type
os_abi_name	uint8	OS and ABI to which the object is targeted
abi_version	uint8	version of the ABI to which the object is targeted
machine	uint16	required architecture
entry_va	uint64	entry point virtual address
interpreter_path	string
program_headers	struct-list: Program header	list of program headers
sections	struct-list: Section	list of sections
symbols	struct-list: Symbol	list of symbols
dynamic_table	struct-list: Dynamic table

Program header

Field	Type	Description
type	uint32	segment type
flags	uint32	segment flags
offset	uint64	segment file offset
virtual_address	uint64	segment virtual address
physical_address	uint64	segment physical address
file_size	uint64	segment size in file
memory_size	uint64	segment size in memory
alignment	uint64	segment alignment
entropy	decimal64	segment content entropy
hashes	struct-list: Pair	set of segment content hashes

ELF section

Field	Type	Description
name	string	name of the section
type	uint64	categorizes the section's content and semantics
flags	uint64	1-bit flags that describe miscellaneous attributes
address	uint64	memory address at which the section's first byte should reside
alignment	uint64	address alignment
offset	uint64	byte offset from the beginning of the file to the first byte in section
size	uint64	section's size in bytes
link	uint32	section header table index link

ELF Symbol

Field	Type	Description
info	uint8	type and binding attributes
other	uint8	other
name	string	symbol name
references	uint32	symbol references
sources	uint32	symbol sources

Dynamic table

Field	Type
tag	int64
value	string

Macho

Field	Type	Description
abi64	boolean	64bit or 32bit
cpu_type	uint32	intended architecture to be used
file_type	uint8	usage and alignment of the file
flags	uint32	set of bit flags that indicate the state of certain optional features
segments	struct-list: Segment
sections	struct-list: Section
dynamic_libraries	list: string
symbols	struct-list: Symbol

Segment

Field	Type	Description
name	string
flags	uint32	segment flags
virtual_address	uint64	segment virtual address
virtual_size	uint64
file_offset	uint64
file_size	uint64	segment size in file
maximum_protection	uint32
initial_protection	uint32
entropy	decimal64	segment content entropy
hashes	struct-list: Pair	set of segment content hashes

Macho section

Field	Type	Description
name	string	section name
segment	string	name of the segment that should contain this section
flags	uint32	section type (8 bits) + other attributes (24 bits)
address	uint64	virtual memory address
size	uint64	size in bytes of the virtual memory occupied by this section
offset	uint32	offset to this section in the file
alignment	uint32	section's byte alignment

Macho Symbol

Field	Type	Description
name	string	symbol name
section	string	section that this symbol can be found in
type	uint8	type
external	boolean	whether this symbol cannot be found in any section of this image

Dex

Field	Type	Description
checksum_valid	boolean	whether checksum is valid
signature_valid	boolean	whether signature is valid
classes	struct-list: Dex Class	list of classes

Dex Class

Field	Type	Description
modifiers	uint32	class modifiers
name	string	class name
super_class	string	class' superclass
source_file	string	original source file for this class
annotations	struct-list: Annotation	list of class annotations
interfaces	list: string	list of class interfaces
methods	struct-list: Method	list of class methods
fields	struct-list: Field	list of class fields

Annotation

Field	Type	Description
visibility	uint8	annotation visibility
type_name	string	annotation type name
attributes	struct-list: Attribute	list of annotation attributes

Attribute

Field	Type
name	string
value	struct: Value

Value	type
type	uint32
value	string

Method

Field	Type	Description
modifiers	uint32	method modifiers
name	string	method name
return_type	string	method return type
parameters	struct-list: Parameter	list of method parameters
annotations	struct-list: Annotation	list of method annotations

Parameter

Field	Type	Description
type_name	string
annotations	struct-list: Annotation	list of method annotations

Field (Dex)

Field	Type	Description
modifiers	uint32	field modifiers
name	string	field name
type	string	field type name
value	string	filed value
annotations	struct-list: Annotation	list of field annotations

Dotnet

Field	Type	Description
module	string	module name
mvid	string	module version ID
entry_point	struct: .NET Method	entry point method
assembly	struct: Assembly	assembly reference
types	struct-list: Type	list of types
assembly_references	struct-list: Assembly	list of assembly references
resources	struct-list: .NET Resource	list of resources
exported_types	struct-list: Exported type	list of exported types

.NET Method

Field	Type	Description
impl_attributes	uint16	method ImplAttributes
attributes	uint16	method attributes
name	string	method name
return_type	string	method return type
pinvoke_info	struct: Pinvoke info	method PInvoke info
parameters	struct-list: Parameter	list of method parameters

Pinvoke info

Field	Type	Description
attributes	uint16	PInvoke attributes
module	string	module name
entry_point	string	module entry point

Parameter

Field	Type	Description
attributes	uint16	parameter attributes
type_name	string	parameter type name
name	string	parameter name

Assembly

Field	Type	Description
name	string	assembly reference name
version	string	assembly reference version formatted string
culture	string	assembly reference culture
public_key_token	string	assembly reference public key token

Type

Field	Type	Description
attributes	uint32	type attributes
name	string	type name
base_type	string	base type name
methods	struct-list: Method	list of types methods
fields	struct-list: Field	list of types fields
interfaces	list: string	list of types interfaces
events	struct-list: Event	list of types events
properties	struct-list: Properties	list of types properties

Field

Field	Type	Description
attributes	uint16	field attributes
name	string	field name
constant	string	field constant value
type	string	field type name

Event

Field	Type	Description
attributes	uint16	event attributes
name	string	event name
type	string	event type name

Properties

Field	Type	Description
attributes	uint16	property attributes
name	string	property name
type	string	declaring type
constant	string	property constant value
parameters	struct-list: Parameter	list of property parameters

.NET Resource

Field	Type	Description
type	uint8	resource type
attributes	uint32	resource attributes
name	string	resource name
file	string	resource file
hash	string	resource file hash
assembly	string	resource assembly

Exported type

Field	Type	Description
attributes	uint32	exported type attributes
name	string	exported type name

Identity

Field	Type	Description
type	enum: identity_type	identity type
verified	enum: Verification	identity verification
name	string	package name
version	string	package version
publisher	string
description	string	package summary
license	string	licence name (e.g. GPLv3)
cpe	string	CPE
vulnerabilities	list:string	known vulnerabilities

identity_type (enum)

ad
social
other
graphics
audio
cloud
messaging
compression
analytics
database
crypto
utility
multimedia
networking
browser
security
virtualization
development
productivity
email
gaming
entertainment
educational
driver
package

Verification (enum)

not_verified
sha256_hash
authentihash
certificate
cloud_source

Protection

Field	Type	Description
features	list: string	Detected encryption features
drm	list: string	Detected DRM protection
crypto	list: string	Detected crypto primitives
compression	list: string	Detected compression algorithm

Security

Field	Type	Description
features	list: string	features detected
exploits	list: string	exploits detected, CVE references
vulnerabilities	struct-list: Vulnerability	known vulnerabilities
owning_user	string	owning user identifier
owning_group	string	owning group identifier
access_list	struct-list: Access	access control list
attributes	list: string	file attributes

Vulnerability

Field	Type	Description
cve	string	CVE identifier
exploit	uint32	Exploit information
cvss	struct: CVSS	CVSS score

CVSS

Field	Type	Description
version	int32	CVSS version (2 or 3x)
base_score	decimal64
metrics	struct-list: Pair	CVSS metrics

Access

Field	Type	Description
type	enum: access_type	who has access
entity	string	entity identifier for either user or group
permissions	uint32	access flags

access_type (enum)

user
group
other
unknown

Behaviour

This section describes how a file would behave if executed. It lists values related to the registry, paths when executing, renaming or copying files, shortcuts that might be used, and more. This section will become available when analyzing PDFs, Docker files, as well as various installers.

Field	Type	Description
registry	struct-list: Registry	list of registry actions
copy	struct-list: Copy	list of copy actions
rename	struct-list: Rename	list of rename actions
process_start	struct-list: Process start	list of process start actions
shortcut	struct-list: Shortcut	list of shortcut creation actions
remove	struct-list: Remove	list of remove actions
edit_ini	struct-list: Edit ini	list of edit INI actions
uri	struct-list: URI	list of URI actions

Registry

Values that the program sets in the Windows Registry.

Field	Type	Description
key	string	registry key
value_name	string	registry value name
value	string	registry value name
properties	struct-list: Property	various properties assigned to object, key-value

Copy

Field	Type	Description
source_path	string
destination_path	string
properties	struct-list: Property	properties that are applied to copy operation

Rename

Field	Type	Description
old_path	string
new_path	string
properties	struct-list: Property	properties that are applied to rename operation

Process start

Field	Type	Description
arguments	string	command-line arguments to use when starting application
create_no_window	boolean	indicates whether to start the process in a new window
domain	string	identifies the domain to use when starting process
environment_variables	string	search paths for files, application-specific options, etc.
filename	string	application or document to start
password	string	user password to use when starting the process
username	string	user name to be used when starting the process
working_directory	string	working directory for the process to be started
properties	struct-list: Property	additional properties

Shortcut

Information on shortcuts related to a file. hotkey designates the keyboard shortcut used to start the program.

Field	Type	Description
source_path	string	path to the file to be executed
destination_path	string	where to create shortcut file
icon_path	string	path to the icon to be displayed
icon_index	int32	index of icon to use from the icon file
description	string	additional description
working_directory	string	working directory for the application
hotkey	string	combination of key with which the program can be started
command_options	string	additional options to use when executing file
properties	struct-list: Property	additional properties

Remove

Field	Type	Description
path	string	path to the file that will be removed
properties	struct-list: Property	additional properties

Edit ini

Field	Type	Description
path	string	path to the INI file that will be edited
section	string	name of the INI section
content	struct: Pair	key-value content to be added
properties	struct-list: Property	additional properties

URI

Information on a URI that a file is trying to connect to.

{"uri_string": "https://bad_domain.evil/malware/infection",
 "protocol": "https",
 "hostname": "bad_domain.evil",
 "port": "80",
 "path": "malware/infection",
 "ip_protocol": "TCP/IP"}

Field	Type	Description
uri_string	string	URI string
protocol	string	application-layer protocol used (e.g. HTTP)
hostname	string
domain	string
port	int32
path	string
ip_protocol	string	transport-layer protocol used (e.g. TCP)
properties	struct-list: Property	additional properties

Signatures

This section holds information about digital signatures and certificates found during the analysis.

Signature object

Field	Type	Description
validation	struct: Validation
version	int32	syntax version number
issuer	struct-list: Pair	issuer distinguished name
serial_number	string	issuer-specific serial number
digest_algorithm	string	message digest algorithm
digest_encryption_algorithm	string
encrypted_digest	string
authenticated_attributes	struct-list: Pair	set of attributes that are signed
unauthenticated_attributes	struct-list: Pair	set of attributes that are not signed
certificate	struct: Certificate object
counter_signatures	struct-list: Signature object

Certificate object

Among other outcomes, certificates can be whitelisted or blacklisted. The validation > results field holds the list of results related to the certificate of the analyzed file. Here are two examples, one of a whitelisted and one of a blacklisted certificate, leading to two different classifications (goodware/malicious).

Whitelisted certificate:

{
    common_name: "Microsoft Corporation",
    serial: "610f784d000000000003",
    thumbprint: "77d73fbbb0a3e91838d5ef1d145e37f025d9ba766604c9aeafd6b3222b252ca9"
}

Blacklisted certificate:

{
    common_name: "Elite Web Development Ltd.",
    serial: "6cfa5050c819c4acbb8fa75979688dff",
    thumbprint: "e7241394097402bf9e32c87cada4ba5e0d1e9923f028683713c2f339f6f59fa9"
}

Field	Type	Description
validation	struct: Validation
version	int32	certificate version
valid_from	string	time when validity period begins
valid_to	string	time when validity period ends
serial_number	string	certificate serial number issued by CA
subject	struct-list: Pair	entity associated with the public key
issuer	struct-list: Pair	entity who has signed and issued the certificate
issuer_certificate	struct: Certificate object
signature_algorithm	string	cryptographic algorithm used by the CA to sign this certificate
signature	string	cryptographic algorithm used by the CA to sign this certificate
public_key	struct
extensions	struct-list: Extension	certificate extensions
thumbprints	struct-list: Pair	set of additional thumbprints

Public key

Field	Type
type	int32
value	string
rsa	struct
dsa	struct
ec	struct

Example of an RSA public key detected in a file with a whitelisted certificate:

{
value: "3082010a0282010100a2db0a8dcfc2c1499bcdaa3a34ad23596bdb6cbe2122b794c8eaaebfc6d526c232118bbcda5d2cfb36561e152bae8f0ddd14a36e284c7f163f41ac8d40b146880dd98194ad9706d05744765ceaf1fc0ee27f74a333cb74e5efe361a17e03b745ffd53e12d5b0ca5e0dd07bf2b7130dfc606a2885758cb7adbc85e817b490bef516b6625ded11df3aee215b8baf8073c345e3958977609be7ad77c1378d33142f13db62c9ae1aa94f9867add420393071e08d6746e2c61cf40d5074412fe805246a216b49b092c4b239c742a56d5c184aab8fd78e833e780a47d8a4b28423c3e2f27b66b14a74bd26414b9c6114604e30c882f3d00b707cee554d77d2085576810203010001"
}

RSA key

Field	Type
enabled	boolean
exponent	string
modulus	string

DSA key

Field	Type
enabled	boolean
prime	string
subprime	string
generator	string

Elliptic Curve Key

Field	Type
enabled	boolean
p	string
a	string
b	string
x	string
y	string
generator	string
order	string
cofactor	string
seed	string
field_type	string
basis_type	string
curve_name	string

Extension

Field	Type
is_critical	boolean
name	string
value	string

Certificates

A list of Certificate objects, defined in the Signatures section.

Document

Field	Type	Description
capabilities	uint32	document capabilities
author	string	document author
version	string	document version
title	string	document title
subject	string	document subject
description	string	document description
language	string	document language
creation_date	string	creation date
modified_date	string	last modification date
needs_rendering	boolean	does document needs rendering
page_count	int32	number of pages
word_count	int32	number of words
char_count	int32	numbers of characters
keywords	list: string	document keywords
requirements	list: string	document requirements
properties	struct-list: Property	various properties assigned to object, key-value
html	struct: HTML	HTML metadata

Similarly to the Application section, documents have a bit array describing their capabilities:

none_k = 0,
execution_k = 1 << 0, whether document has executable content
scripting_k = 1 << 1, whether document uses JavaScript, VBA or similar scripting language
multimedia_k = 1 << 2, whether document has video, has audio, uses webgl, canvas, svg
user_input_k = 1 << 3, whether document has forms and user controls, drag and drop, pointer lock
embeds_k = 1 << 4, whether document has objects / embeds, has frame / iframe, OLE
messaging_k = 1 << 5, whether document has messaging capabilities (e.g. mailto, sendto...)
networking_k = 1 << 6, whether document has networking capabilities (e.g. http, ajax, websockets, hrefs, clickable URL in documents, webrtc, redirect/refresh)
storage_k = 1 << 7, whether document has storage capabilities (e.g. web storage, file api, offline storage)
location_k = 1 << 8, whether document has location capabilities
notifications_k = 1 << 9, whether the document has notification capabilities (e.g. pop-ups, windows notification API...)
camera_k = 1 << 10, whether document has camera access
microphone_k = 1 << 11, whether document has access to microphone
bluetooth_k = 1 << 12, whether document has access to bluetooth
peripherals_k = 1 << 13, whether document has access to peripherals (e.g. usb, midi)
cryptography_k = 1 << 14, whether document has cryptography capabilities (e.g. password protected document / macro, password input fields in HTML...)
advertising_k = 1 << 15, whether document has advertising capabilities
social_k = 1 << 16, whether document has access to social networks (Facebook, Twitter, - specific to HTML / JS)
services_k = 1 << 17, whether document has access to services
memory_management_k = 1 << 18, whether document has access to memory management

HTML

Field	Type	Description
doctype	string	HTML doctype
base_url	string	HTML base url
html_metadata	struct-list: Property	HTML metadata from META tags
resources	struct-list: Resource	extracted resources
links	struct-list: Link	extracted links
forms	struct-list: Form	extracted forms

Resource (HTML)

Field	Type	Description
url	string	URL or path found in HTML
crossorigin	string	value of crossorigin attribute, if present
rel	string	value of rel attribute, if present
type	string	value of type attribute, if present

Link

Field	Type	Description
url	string	URL or path found in HTML
download	string	value of download attribute, if present
rel	string	value of rel attribute, if present

Form

Field	Type	Description
action	string	value of action attribute, if present
enctype	string	value of enctype attribute, if present
method	string	value of method attribute, if present

Mobile

Field	Type	Description
capabilities	uint32	detected capabilities
android	struct: Android	Android metadata
ios	struct: iOS	iOS metadata
windows_phone	struct: Windows Phone	Windows Phone metadata
windows_store_package	struct: Windows Store Package	Windows Store Package metadata

Capabilities, similarly as in the Application section, are expressed as a bit array. Check the integer from the report against the following descriptions:

Bit	Meaning
0x000001	messaging
0x000002	calling_services
0x000004	advertising
0x000008	gaming
0x000010	networking
0x000020	camera
0x000040	microphone
0x000080	bluetooth
0x000100	notifications
0x000200	device_identity
0x000400	user_identity
0x000800	address_book
0x001000	calendar
0x002000	location_services
0x004000	storage
0x008000	social
0x010000	system
0x020000	motion
0x040000	wallet
0x080000	vpn
0x100000	nfc
0x200000	peripheral_devices

In addition, mobile applications have the following bits set in case of a found capability:

none_k = 0,
messaging_k = 1 << 0, whether app has capability for sending messages
calling_services_k = 1 << 1, whether app has access to calling services
advertising_k = 1 << 2, whether app has capability for advertising
gaming_k = 1 << 3, whether app has gaming component
networking_k = 1 << 4, whether app has access to networking
camera_k = 1 << 5, whether app has capability for using camera
microphone_k = 1 << 6, whether app has capability for using microphone
bluetooth_k = 1 << 7, whether app has capability for using bluetooth
notifications_k = 1 << 8, whether app has capability for pushing notifications
device_identity_k = 1 << 9, whether app has access to device id
user_identity_k = 1 << 10, whether app has access to user id
address_book_k = 1 << 11, whether app has access to users address book
calendar_k = 1 << 12, whether app has access to users calendar
location_services_k = 1 << 13, whether app has capability for defining location of device
storage_k = 1 << 14, whether app has access to storage
social_k = 1 << 15, whether app has social component
system_k = 1 << 16, whether app has access to system
motion_k = 1 << 17, whether app has capability for detecting motion and direction (accelerometer, magnetometer...)
wallet_k = 1 << 18, whether app has access to users wallet
vpn_k = 1 << 19, whether app has capability for vpn
nfc_k = 1 << 20, whether app has capability for nfc
peripheral_devices_k = 1 << 21, whether app has access to peripheral devices

Android

Field	Type	Description
package_name	string	full and unique Java-language-style package name for the application
version_code	int32	internal version number
version_name	string	version number shown to the users
install_location	string	location where the application can be installed; accepted are: internalOnly, preferExternal or auto
sdk_version_min	int32	minimum API level required by the application
sdk_version_max	int32	maximum API level required by the application
sdk_version_target	int32	guaranteed compatibility API level
application	struct: Application	android application data
features	list: string	list of hardware/software features required by the application
permissions	list: string	list of permissions required by the application

Application (Android)

Field	Type	Description
name	string	fully qualified name of an application subclass implemented for the application
debuggable	boolean	application has debug symbols
enabled	boolean	application is enabled
has_code	boolean	whether or not the application contains any code
persistent	boolean	whether or not the application should remain running at all times
permission	string	name of a permission that clients must have in order to interact with the application
process	string	name of a process where all components of the application should run
backup_agent	string	name of the class that implement's the application's backup agent
uses_libraries	list: string
activities	struct-list: Activity	list of registered user interface activity callback events
services	struct-list: Service	list of registered service callback events
providers	struct-list: Provider	list of registered broadcast provider callback events
receivers	struct-list: Receiver	list of registered broadcast receiver callback events

Activity

Field	Type	Description
enabled	boolean	activity is enabled
exported	boolean	activity is exported and other applications can use it
exclude_recent	boolean	whether or not the task initiated by this activity should be excluded from the list of recently used applications
name	string	name of the class that implements the activity
parent_name	string	class name of the logical parent of the activity
launch_mode	string	execution mode
permission	string	name of a permission that clients must have to launch the activity or otherwise get it to respond to an intent
process	string	name of the process in which the activity should run
metadata	struct-list: Property
intents	struct-list: Intent	activity intents

Intent

Field	Type
main	boolean
actions	list: string
categories	list: string
data	struct-list: Data

Data
host	string
mime_type	string
path	string
port	string
scheme	string

Service

Field	Type	Description
enabled	boolean	service is enabled
exported	boolean	service is exported and other applications can use it
isolated	boolean	service runs under a special process that is isolated from the rest of the system and has no permissions of its own
name	string	name of the class that implements the service
permission	string	name of a permission that clients must have to launch the service or otherwise get it to respond to an intent
process	string	name of the process in which the service should run
metadata	struct-list: Property
intents	struct-list: Intent	service intents

Provider

Field	Type	Description
enabled	boolean	provider is enabled
exported	boolean	provider is exported and other applications can use it
syncable	boolean	data under the content provider's control is to be synchronized with data on a server
name	string	name of the class that implements the provider
readPermission	string
permission	string	name of a permission that clients must have to read or write the content provider's data
process	string	name of the process in which the content provider should run
metadata	struct-list: Property
intents	struct-list: Intent	provider intents

Receiver

Field	Type	Description
enabled	boolean	receiver is enabled
exported	boolean	receiver is exported and other applications can use it
name	string	name of the class that implements the provider
permission	string	name of a permission that clients must have to read or write the content provider's data
process	string	name of the process in which the content provider should run
metadata	struct-list: Property
intents	struct-list: Intent	receiver intents

iOS

Field	Type
copyright	string
genre	string
genre_id	int32
kind	string
vendor_id	int32
item_id	int32
item_name	string
item_playlist_name	string
artist_id	int32
artist_name	string
artist_playlist_name	string
release_date	string
price	int32
price_display	string
download_info	struct: Download info
bundle_id	string
bundle_version	string
drm_version	int32
version_restrictions	int32
file_extension	string
application_bundle	struct: Application bundle

Download info

Field	Type
apple_id	string
person_id	int32
purchase_date	string

Application bundle

Field	Type
identifier	string
name	string
display_name	string
version	string
package_type	string
main_nib_file	string
main_executable	string
compiler_version	string
xcode_version	string
xcode_build	string
sdk_name	string
sdk_build	string
platform_name	string
platform_version	string
platform_build	string
minimum_os_version	string
dictionary_version	string

Windows Phone

Field	Type
product_id	string
title	string
version	string
description	string
author	string
publisher	string
genre	string
runtime_type	string
has_settings	boolean
platform_version	string
capabilities	list: string

Windows Store Package

Field	Type	Description
name	string	describes contents of the package
name_display	string	friendly name for the app that can be displayed to users
publisher	string	describes publisher information
publisher_display	string	friendly name for the publisher that can be displayed to users
version	string	version number of the package
minimum_os_version	string	minimum version of operating system that the package requires
tested_os_version	string	highest version of Windows that the package was tested on
dependencies	list: string	other packages that the package depends on to complete its software
capabilities	list: string	access to protected user resources that the package requires
extensions	list: string	one or more extensibility points for the package
applications	struct-list: Application	one or more apps that comprise the package

Application

Field	Type	Description
id	string	unique identifier of the application within the package (PRAID)
name_display	string	friendly name for the app that can be displayed to users
description	string	description of the app
entry_point	string	activatable class ID
executable	string	default launch executable for the app
start_page	string	default launch HTML page for the app
extensions	struct-list: Extension	list of extensions

Extension (Application)

Field	Type	Description
category	string	type of app extensibility point
entry_point	string	activatable class ID
executable	string	default launch executable
runtime_type	string	runtime provider
start_page	string	web page that handles the extensibility point

Media

Field	Type	Description
image	struct: Image	image object
audio	struct: Audio	audio object
video	struct: Video	video object

Image

Field	Type	Description
width	uint32	image width in pixels
height	uint32	image height in pixels
bit_depth	uint32	bits per pixel
horizontal_resolution	decimal64	horizontal resolution in dots per inch
vertical_resolution	decimal64	vertical resolution in dots per inch
frame_count	uint32	number of image frames
frame_rate	decimal64	number of frames per second
exif	struct-list: Exif	EXIF map

Exif

Field	Type
name	string
values	struct-list: Exif value

Exif value

Field	Type
name	string
value	string

Video

Field	Type	Description
scan_type	enumeration	Allowed Values: unknown, progressive, interlaced
codec	string	codec name
width	uint32	width in pixels
height	uint32	height in pixels
length	uint64	length in milliseconds
frame_rate	decimal64	frames per second
data_rate	uint32
bit_rate	uint32
audio_tracks	struct-list: Audio track
exif	struct-list: Exif	EXIF map

Audio tracks

Field	Type
name	string
audio	struct: Audio

Audio

Field	Type	Description
codec	string	codec name
length	uint64	length in milliseconds
bit_rate	uint32	audio bit rate
sample_rate	uint32	audio sample rate
channels	uint32	channel count
id3	struct: ID3
exif	struct-list: Exif	EXIF map

ID3

Field	Type	Description
version	string	ID3 version
properties	struct-list: Property	ID3 property list

Browser

Field	Type	Description
type	enum: browser_type
name	string	Extension identifier
shorthand	string	Short version of name
locale	string	Extension default locale
author	string	Extension author
license	string	Extension license
version	string	Extension version
description	string	Extension description
public_key	string	Extension public key
homepage	string	URL of the extension's home page
update_url	string	URL of the extension's update page
permissions	struct-list: Permission	Permissions to be requested
exports	list: string	IDs of extensions allowed to import this extension's resources
imports	list: string	Resources extension depends on
scripts	struct-list: Script	Content scripts
actions	struct-list: Action	Browser actions
resources	list: string
plugins	list: string

browser_type (enum)

none
chrome
opera
firefox
edge

Permission

Field	Type	Description
required	boolean	False indicates that the requested permission is optional
value	string	Permission

Script

Field	Type	Description
url_rules	struct: URL rule	Patterns defining which pages the script will be loaded into
inject_css	list: string	Stylesheets to be loaded into matching pages
inject_js	list: string	Scripts to be loaded into matching pages

URL rule

Field	Type	Description
default_match	list: string	URL patterns to be matched for the script to be loaded
exclude_match	list: string	URL patterns not to be matched for the script to be loaded
include_global	list: string	Globs to be matched for the script to be loaded
exclude_global	list: string	Globs not to be matched for the script to be loaded

Action

Field	Type	Description
title	string	Tooltip
popup	string	Path to HTML file containing popup specification

Email

Field	Type	Description
message	struct: Message
contact	struct: Contact
task	struct: Task
appointment	struct: Appointment

Message

Field	Type	Description
from	struct-list: Mailbox	List of email mailboxes in From: field
sender	struct: Mailbox	Email mailbox indicated in Sender: field
reply_to	struct-list: Mailbox	List of email mailboxes in Reply-To: field
recipients	struct-list: Recipient	List of email recipients
subject	string	Subject of an email
message_id	string	Unique message ID
in_reply_to_ids	list: string	list of message ids in conversation
origination_date	string	Message origination time in ISO 8601 format
headers	struct-list: Header	Extra email headers

Mailbox

Field	Type
name	string
email	string

Field	Type
name	string
value	string

Contact

Field	Type	Description
full_name	string	contact full name
title	string	contact title
company	string	contact company name
url	string	contact url
emails	struct-list: Mailbox	list of emails
phone_numbers	list: string	list of phone numbers
addresses	struct-list: Address	list of addresses

Address

Field	Type	Description
street	string	contact street address
city	string	contact city
state	string	contact state
postal_code	string	contact postal code
country	string	contact country

Task

Field	Type	Description
status	int32	Current status of task
percent_complete	decimal64	Percentage of task that is already completed

Appointment

Field	Type	Description
recurrence	int32	Appointment recurrence
start_time	string	Appointment start time
end_time	string	Appointment end time
location	string	Appointment location

Software package

Field	Type	Description
type	enum: package_type
verified	enum: Verification
unique_id	string	package identifier
name	string	package name
version	string	package version
description	string	package summary
authors	list: string	list of package authors
copyright	string	copyright notice
homepage	string	package homepage URL
repository	string	package source code repository URL
license	string	license name (e.g. GPLv3)
platform	struct: Platform	platform information, if any
permission_requirement_install	int32	indicates whether the installation process requires superuser privileges
permission_requirement_build	int32	indicates whether the build process requires superuser privileges
release_dependencies	struct-list: Software package dependency	list of release dependency packages
develop_dependencies	struct-list: Software package dependency	list of development dependency packages
conflicts	string	list of packages which may cause problems if installed
replaces	string	list of packages which the package replaces and will be removed
vulnerabilities	string	known vulnerabilities

package_type (enum)

unknown
source
binary

Platform

Field	Type	Description
name	string	OS name
version	string	OS version
architecture	string	CPU architecture name
features	list: string	required OS features, such as win32k

Software package dependency

Field	Type	Description
name	string	dependency name
version_min	string	version range lower limit
version_max	string	version range upper limit
vulnerabilities	list: string	known vulnerabilities

MITRE ATT&CK Framework

The behavior of malicious files can be expressed in terms of their actions. The MITRE ATT&CK framework defines the format and taxonomy used to describe threats. Here's an example of a malicious file's attack field.

"attack": [
   {
      "matrix":"Enterprise",
      "tactics":[
         {
            "id":"TA0007",
            "name":"Discovery",
            "description":"The adversary is trying to figure out your environment.",
            "techniques":[
               {
                  "id":"T1082",
                  "name":"System Information Discovery",
                  "description":"An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.",
                  "indicators":[
                     {
                        "priority":4,
                        "category":13,
                        "id":149,
                        "relevance":1,
                        "description":"Enumerates system information."
                     }
                  ]
               }
            ]
         }
      ]
   }
]

Field	Type
matrix	string
tactics	struct-list: Tactic

Tactic

Field	Type	Description
id	string	attack tactic ID
name	string	attack tactic name
description	string	attack tactic description
techniques	struct-list: Technique	list of attack techniques

Technique

Field	Type	Description
id	string	attack technique ID
name	string	attack technique name
description	string	attack technique description
indicators	struct-list: Indicator

Malware Configuration

Provides Command-and-Control server information and other detection strings and patterns.

Field	Type
family	string
version	string
identifier	string
run_mutex	string
log_mutex	string
install_path	string
host_process	string
password	string
servers	struct-list: Server
properties	struct-list: Property

Server

Field	Type
protocol	string
domain_ip	string
domain_name	string
remote_path	string
remote_port	int32
local_path	string
properties	struct-list: Property

Strings

Field	Type	Description
flags	uint32
occurrences	int32	number of occurrences
offset	int64	offset of the first occurrence (-1 if unknown)
value	string	string value

Indicator

Indicators describe sample behavior and indicate what the sample is capable of based on the results of static analysis. They are human readable descriptions of object intent. Because of that, they simplify the code analysis process by converting complex code patterns into descriptions of their behavior. Simply put, they make it possible to describe the file behavior through descriptions like "Downloads a file", "Encrypts or encodes data in memory using Windows API", "Enumerates currently available disk drives", etc.

Field	Type	Description
priority	int32	Priority is a number used to sort the indicators from least to most interesting (0 to 10) within a category. The priority of an indicator is determined by the severity of the action described by the indicator. More dangerous indicators are prioritized higher within their category.
category	int32	Can be one of 24 categories. Each category is indicated by a number. Their descriptions are listed under indicator categories.
id	int32	Unique ID of an indicator.
relevance	int32	Contribution to the final classification.
description	string	Short description of the capability that the detected indicator refers to.
reasons	struct-list: Reason	List of reasons, with individual descriptions.

Indicator categories

0 - network - The file has network-related indicators (e.g. downloads a file, tampering with DNS settings)

1 - evasion - The file tries to evade common debuggers, sandboxes or analysis tools (e.g. VM environment detection)

2 - stealth - The file tries to hide its presence (e.g. tampers with window transparency settings, tampers with firewall settings)

3 - autostart - The file tampers with autostart settings (e.g. tampers with autorun locations)

4 - memory - The file tampers with memory of foreign processes (e.g. does process injection)

5 - document - The file exhibits unusual activities when handling documents (e.g. PDF that creates new documents)

6 - anomaly - The file contains unusual characteristics (e.g. contains known whitelisted executable filenames)

7 - monitor - The file has the ability to monitor host activities (e.g. accesses a list of logged on users)

8 - disable - The file disables system services (e.g. tampers with Windows Update)

9 - registry - The file accesses registry and configuration files in an unusual way (e.g. tampers with Windows registry settings)

10 - execution - The file creates other processes or starts other applications (e.g. creates a service, installs system drivers)

11 - permissions - The file tampers with or request additional permissions for execution (e.g. tampers with user/account privileges)

12 - search - The file enumerates or collects information from a system (e.g. enumerates network shares or mounted drives)

13 - settings - The file accesses or tampers with system settings (e.g. enumerates system information)

14 - macro - The file contains or executes macro functions or scripts (e.g. contains UNIX shell scripts, executes actions associated with bookmarks)

15 - flow - The file leaks sensitive information to external hosts or creates new files with sensitive data (e.g. exports PDF form fields to files)

16 - behavior - The file automatically executes activities as a user (e.g. changes username or password, prints a document)

17 - signature - The file matches a known signature (e.g. contains known compression libraries, HTTP header fields)

18 - steal - The file steals and leaks sensitive information (e.g. accesses Outlook account information and address book)

19 - family - The file is associated with known malicious families

20 - packer - The file contains obfuscated or encrypted code or data (e.g. base64 encoded streams)

21 - exploit - The file contains known exploits against the system

22 - file - The file accesses other files on the filesystem in an unusual way (e.g. creates a cryptographic hash of file contents)

23 - payload - The file extracts and launches new behavior in an unusual way (e.g. injects CSS into a page)

Reason

Field	Type
propagated	boolean
category	string
description	string

Interesting Strings

These are strings found within a file, such as IP addresses.

Field	Type
offset	int64
occurrences	int32
scan_result	struct: Scanner result
value	string
tags	list: string

Story

The story section contains a summarized natural language description of the file's behavior and properties.

Field	Type	Description
caption	string	paragraph caption
content	string	paragraph content with placeholders for story arguments
arguments	struct-list: Story argument	positional arguments to be inserted into placeholders in content

Story argument

Field	Type	Description
link	string	link address or text used for query
text	string	text to display
type	enum: Story argument type

Story argument type (enum)

external_link
internal_link
search_query

Index

An int32, specifying the position within the originally requested report. Index 0 means the parent file (the one originally analyzed), and each subsequent index denotes a child file.

Children

An array of int32, with each value corresponding to an index value of a direct descendant.

Parent

An int32, specifying to the index of the immediate parent.

Common Objects

Property

Field	Type
name	string
value	string

Pair

Field	Type
name	string
value	string

network_reputation

Field	Type	Description
type	string	The type of requested network location
requested_network_location	string	The requested URL, domain or IP address
classification	enum	ReversingLabs classification, available only for URLs. Possible values are malicious, suspicious, known, or unknown.
reason	string	Classification reason (if the classification is not unknown)
categories	string	List of categories that the URI in question belongs to. List items are strings. The strings are arbitrary values.
first_seen	string	Indicates the initial detection of the requested URL/domain/IP by a third-party source, the first instance of obtaining metadata for the requested URL/domain/IP from ReversingLabs static/dynamic file processing services (related files), or the first time the requested URL has been crawled.
last_seen	string	The last time when the requested URL/domain/IP received a detection from a third-party source, the last instance of obtaining metadata for the requested URL/domain/IP from ReversingLabs static/dynamic file processing services (related files), or the last time the requested URL has been crawled.
third_party_reputations	string	Third party URL/domain/IP reputation counters showing the number of third party sources that detected the item as malicious/clean/undetected.
associated_malware	boolean	A boolean indicator showing if ReversingLabs downloaded malware from the submitted URL/domain/IP.

Appendix A: Suspicious Embedded File Types

Binary/None/PythonPYC

DEX/Exe

DEX/None

ELF32 Big/Core

ELF32 Big/Exe

ELF32 Big/None

ELF32 Big/Relocatable

ELF32 Big/SO

ELF32 Little/Core

ELF32 Little/Exe

ELF32 Little/None

ELF32 Little/Relocatable

ELF32 Little/SO

ELF64 Big/Core

ELF64 Big/Exe

ELF64 Big/None

ELF64 Big/Relocatable

ELF64 Big/SO

ELF64 Little/Core

ELF64 Little/Exe

ELF64 Little/None

ELF64 Little/Relocatable

ELF64 Little/SO

MZ/DOS

MZ/None

MZ/Relocatable

MachO32 Big/Bundle

MachO32 Big/Core

MachO32 Big/Exe

MachO32 Big/None

MachO32 Big/Relocatable

MachO32 Big/SO

MachO32 Little/Bundle

MachO32 Little/Core

MachO32 Little/Exe

MachO32 Little/None

MachO32 Little/Relocatable

MachO32 Little/SO

MachO64 Big/Bundle

MachO64 Big/Core

MachO64 Big/Exe

MachO64 Big/None

MachO64 Big/Relocatable

MachO64 Big/SO

MachO64 Little/Bundle

MachO64 Little/Core

MachO64 Little/Exe

MachO64 Little/None

MachO64 Little/Relocatable

MachO64 Little/SO

ODEX/Exe

ODEX/None

PE+/.Net Dll

PE+/.Net Exe

PE+/Dll

PE+/Exe

PE+/None

PE+/VXD

PE/.Net Dll

PE/.Net Exe

PE/Dll

PE/Exe

PE/None

PE/VXD

PE16/Dll

PE16/Exe

PE16/None

Text/Acrobat JavaScript

Text/ActionScript

Text/Batch

Text/CMake

Text/CoffeeScript

Text/JavaScript

Text/Makefile

Text/NodeJS

Text/PHP

Text/Perl

Text/Perl6

Text/PowerShell

Text/Python

Text/Ruby

Text/Shell

Text/TypeScript

Text/VBA

Text/Visual Basic

Video/None/SWF

Video/None/DOSWF

Appendix B: Splunk Format Changes

The format of data that is sent to Splunk differs in minor ways from the format that is specified in this document. The reason why data is changed before being sent to Splunk is to make it more suitable for indexing by Splunk. Reports sent to Splunk differ from the original in the following sections:

if classification is 0 or 1, factor becomes confidence
if classification is 2 or 3, factor becomes severity
a string_status field is added with the overall classification (UNKNOWN, GOODWARE, SUSPICIOUS, MALICIOUS)
scanner name becomes reason
scanner result becomes threat

Appendix C: Spectra Core Tags

Generic tags - can be applied to many file formats

Tag	Description
access-control-information	The file contains access control descriptors such as file permissions, group memberships or similar information about a securable object
anonymous-email	The file contains e-mail addresses from anonymous e-mail providers
cert-appendix	The file contains additional data after the certificate
cert-bad-timestamp	The file is digitally signed with a certificate that has a bad timestamp
cert-dual-signed	The file is digitally signed with two signatures that independently verify file integrity
cert-expired	The file’s certificate chain has at least one expired certificate
cert-impersonate	The file is digitally signed with a certificate that impersonates one of well-known entities (e.g. Microsoft or Google)
cert-invalid	The file was signed with an invalid certificate (it didn’t pass the validation process)
cert-malformed	The file is digitally signed with a certificate that was malformed
cert-revoked	The file is digitally signed with a certificate that has been revoked
cert-revoked-aa-compromise	The file is digitally signed with a certificate that has been revoked due to AA compromise
cert-revoked-affiliation-changed	The file is digitally signed with a certificate that has been revoked due to change in affiliation
cert-revoked-ca-compromise	The file is digitally signed with a certificate that has been revoked due to CA compromise
cert-revoked-cert-hold	The file is digitally signed with a certificate that has been put on hold (the signer has been suspended)
cert-revoked-cessation-of-operation	The file is digitally signed with a certificate that has been revoked because the signer has ceased its operations
cert-revoked-key-compromise	The file is digitally signed with a certificate that has been revoked due to private key compromise
cert-revoked-privilege-withdrawn	The file is digitally signed with a certificate that has been revoked because the signer privilege has been withdrawn
cert-revoked-remove-from-crl	The file is digitally signed with a certificate that has been removed from the revocation list
cert-revoked-superseded	The file is digitally signed with a certificate that has been revoked because it has been superseded
cert-revoked-unspecified	The file is digitally signed with a certificate that has been revoked due to unspecified reason
cert-self-signed	The file is digitally signed with a self-signed certificate (e.g. JAR or APK)
cert-signed	The file is digitally signed with a certificate (signature may or may not be valid)
cert-signed-after-expiration	The file was digitally counter-signed after at least one certificate in certificate chain expired
cert-signed-after-revocation	The file is digitally signed with a certificate that has been revoked at the time of signing
cert-untrusted	The file is digitally signed with a certificate that is valid, but its root CA certificate is not in the Spectra Core certificate store
cert-weak-crypto	The file was digitally signed with certificates using an old hashing algorithm (e.g. MD5) or with a short key
contains-api-key	The file contains an API key used to authenticate a user, developer, or calling program to an API
contains-archive	The file contains one or more archive files (such as ZIP, RAR, Jar)
contains-document	The file contains one or more document files
contains-elf	The file contains one or more ELF (Executable and Linkable Format) files
contains-key-secret-pair	The file contains plaintext credentials, generally used for authentication
contains-macho	The file contains one or more Mach-O files
contains-pe	The file contains one or more PE (Portable Executable) files
contains-private-key-encrypted	The file contains an encrypted PKI private key
contains-private-key-plaintext	The file contains a PKI private key
contains-script	The file contains one or more script files
contains-token	The file contains an access or refresh token generally used for authentication
contains-webhook	The file contains a private webhook which may contain sensitive information
cryptocurrency	The file has cryptocurrency-related indicators (e.g. accesses BitCoin wallet files)
dde	The file has Dynamic Data Exchange capabilities that may be used to interact with other applications
desktop	The file appears to be a desktop application (e.g. PE or ELF)
email-outlook	The file has Outlook-related indicators (e.g. accesses mailbox files, credentials)
email-pattern	The file has generic e-mail-related indicators (e.g. accesses mailbox files, credentials)
email-thunderbird	The file has Thunderbird-related indicators (e.g. accesses mailbox files, credentials)
encrypted	Contains encrypted files (e.g. password-protected archive)
entropy-high	The file has unusually high entropy (i.e. entropy > 7)
entropy-zero	The file is zero-filled (full of 00 bytes)
exif	The file has EXIF metadata (such as camera information or GPS metadata)
geotagging	The file has EXIF metadata containing GPS coordinates
guid-activex-killbit	The file contains ActiveX GUIDs with the Kill-Bit flag set
im-skype	The file has Skype-related indicators (e.g. accesses chat history, credentials)
image-corrupt	The image is corrupt because of some format discrepancy (e.g. invalid segment size)
image-malformed	The image is malformed (e.g. frame dimension is zero)
image-segment-duplicate	The image has a duplicate segment
image-segment-unexpected-location	An image segment has been found in an unexpected location
image-segment-unknown	An unknown image segment has been encountered
linguist	The file’s subtype was determined by a ReversingLabs machine learning model
machine-learning	The file was classified by a ReversingLabs machine learning model
nsis-table-invalid-offset	The NSIS installer is corrupt due to invalid table offset
nsis-table-invalid-size	The NSIS installer is corrupt due to invalid table size
ntfs-alternate-data-stream	The file contains data which was part of an NTFS Alternate Data Stream
obfuscated	The file contains obfuscated code or data
probably-packed	A heuristic method determined that the PE file may be packed
overlay	The file has an overlay (appended data at the file’s end) - applies only to PE files
password	The file is password-protected (e.g. a password-protected archive)
ransomware-artifact	The file contains artifacts associated with ransomware (e.g. mail addresses, domains)
ransomware-encrypted	The file was encrypted by known ransomware (e.g. TeslaCrypt encrypted files)
script	The file appears to be a script (e.g. shell or Javascript)
sql-query	The file contains generic SQL queries
ssh-key	The file can use or modify SSH keys
stego	The file is a result of stego extraction
stego-compressed	The file contains compressed embedded PE files
stego-embedded	The file contains plain embedded PE files
stego-encoded	The file contains encoded embedded PE files
stego-encrypted	The file contains encrypted embedded PE files
uri-banking-website	The file contains URLs related to banking and monetary institutions
uri-credentials	The file contains URLs that embed sign-in credentials in plaintext due to protocol requirements
uri-deceptive-file	The file contains URLs that point to executable content hidden behind double extensions
uri-domain-blacklisted	The file contains URLs that point to a known blacklisted domain
uri-domain-homoglyph	The file contains URLs that try to trick the user into thinking they are visiting a trusted domain
uri-domain-punycode	The file contains URLs that try to trick the user into thinking they are visiting a trusted domain
uri-domain-spoofed	The file contains URLs that try to trick the user into thinking they are visiting a trusted domain
uri-domain-typosquat	The file contains URLs that try to trick the user into thinking they are visiting a trusted domain
uri-dynamic-dns	The file contains URLs pointing to domains hosted on dynamic DNS
uri-hostname-length	The file contains URLs pointing to domains that are unusually long
uri-interesting-file	The file contains URLs that point to interesting files or file extensions
uri-ip-address	The file contains URLs pointing to webservers hosted on IP addresses
uri-malicious-redirect	The file contains URLs that redirect to malicious domains
uri-malware-regex	The file contains URLs that match a known malware regex pattern
uri-onion-website	The file contains URLs pointing to domains hosted on TOR network
uri-open-redirect	The file contains URLs that redirect to other domains
uri-path-length	The file contains URLs pointing to paths that are unusually long
uri-path-spoofed	The file contains URLs that point to a known sign-in path but don't reside on the trusted domain
uri-security-website	The file contains URLs related to security product vendors
uri-shortened	The file contains shortened URLs
uri-subdomain-count	The file contains URLs pointing to paths that contain excessive number of subdomains
uri-suspicious-path	The file contains URLs that contain a suspicious path section
uri-suspicious-port	The file contains URLs that utilize non-standard ports for the specified protocol
uri-suspicious-query	The file contains URLs that include suspicious SQL query commands
uri-suspicious-tld	The file contains URLs pointing to domains hosted on suspicious TLDs

Behavior tags - describe behavior of executables, documents, scripts, and mobile applications

TAG	Description
account-settings-tamper	The file can tamper with user account settings
autorun	The file can tamper with autorun settings (e.g. autorun registry keys, autorun locations)
av-disable	The file can disable services related to security products
av-impersonate	The file can impersonate services related to security products
av-service-detect	The file can detect services related to security products
av-tamper	The file can tamper with services related to security products
backup-tamper	The file can tamper with backup (e.g. erases backup copies, tampers with backup settings)
bitlocker-tamper	The file can tamper with BitLocker settings
data-exfiltration	The file can exfiltrate various data (e.g. stored credentials, mailbox files, configuration data)
dns-tamper	The file can tamper with DNS configuration
dns-use	The file can use the DNS protocol (e.g. issues DNS queries, locates network services)
file-download	The file has the capability to download files
file-upload	The file has the capability to upload files
firewall-tamper	The file can tamper with firewall settings
ftp-use	The file can use the FTP protocol (e.g. to upload files, to download files)
hosts-modifier	The file can tamper with hosts file or registry keys
impersonate-native	The file can impersonate native services (e.g. impersonates Windows Explorer)
irc-use	The file can use the IRC communication protocol
log-tamper	The file can tamper with logging configuration or log files
netntlm-hash-leak	The file contains references to SMB resources that leak NetNTLM hashes
network-settings-tamper	The file can tamper with network settings
nfs-tamper	The file can tamper with NFS settings
privacy-intrusion	The file has indicators related to privacy intrusion (e.g. takes screenshots, monitors users input)
privilege-escalation	The file has the capability to elevate user privileges
process-injection	The file has the capability to write into other processes
process-termination	The file can terminate other processes
proxy	The file can access or modify proxy settings
registry-tamper	The file can tamper with the registry
security-settings-tamper	The file can tamper with various security settings (e.g. security or audit policies)
service-disable	The file can disable services
smb-tamper	The file can tamper with the SMB protocol
startup-tamper	The file can tamper with startup settings (e.g. Windows bootup process)
storage-settings-tamper	The file can tamper with storage settings
storage-tamper	The file can tamper with external storage
uac-bypass	The file can bypass User Account Control
update-disable	The file can disable update services
virtualization-settings-tamper	The file can tamper with virtualization settings
vpn-tamper	The file can tamper with VPN settings
vpn-use	The file has the capability to use VPN
web-request	The file has the capability to generate web requests
wmi-use	The file can use Windows Management Instrumentation (WMI)

Application-related tags - apply only to files with application metadata (PE, ELF, OSX, DEX, …)

TAG	DESCRIPTION
arch-mips	The file’s target CPU architecture is MIPS
arch-powerpc	The file’s target CPU architecture is PowerPC
arch-sparc	The file’s target CPU architecture is SPARC
arch-x86	The file’s target CPU architecture is x86
arch-x86-64	The file’s target CPU architecture is x86-64
arch-arm-64	The file’s target CPU architecture is ARM64
arch-arm	The file’s target CPU architecture is ARM
codeview	The application has debugging symbols metadata
cui	The application uses Console User Interface subsystem (applies to PE files)
gui	The application uses Graphical User Interface subsystem (applies to PE files)
installer	The file is an installer package
library-ad	The application contains advertising-related libraries (e.g. Adfonic)
library-analytics	The application contains advertising and usage analytics-related libraries (e.g. Google Analytics)
library-audio	The application contains audio playback related libraries (e.g. Vorbis)
library-browser	The application contains browser-related libraries
library-cloud	The application contains cloud networking-related libraries (e.g. Dropbox)
library-compression	The application contains compression-related libraries (e.g. Zip)
library-crypto	The application contains cryptography-related libraries (e.g. OAuth)
library-database	The application contains database-related libraries (e.g. MySQL)
library-development	The application contains development-related libraries
library-driver	The application contains driver-related libraries
library-educational	The application contains education-related libraries
library-email	The application contains email-related libraries
library-entertainment	The application contains entertainment-related libraries
library-gaming	The application contains gaming-related libraries
library-graphics	The application contains drawing or rendering libraries (e.g. Unity)
library-messaging	The application contains network messaging-related libraries (e.g. RabbitMQ)
library-multimedia	The application contains multimedia-related libraries (e.g. Amazon Game Circle)
library-networking	The applications contains network communication-related libraries (e.g. curl)
library-productivity	The application contains productivity-related libraries
library-security	The application contains security-related libraries
library-social	The application contains social networking-related libraries (e.g. Facebook)
library-utility	The application contains programming utility libraries (e.g. ICU)
library-virtualization	The application contains virtualization-related libraries
lolbin	The file was identified as a LoLBin (living-off-the-land binary)
plugin	The application is plugin for particular software
protection-aslr	The file has the Address Space Layout Randomisation exploit protection enabled
protection-dep	The file has the Data Execution Prevention exploit protection enabled
protection-ehc	The file has the Exception Handling Continuation exploit protection enabled
protection-cfg	The file has the Control Flow Guard exploit protection enabled
protection-ret	The file has the Retpoline exploit protection enabled
protection-rfg	The file has the Return Flow Guard exploit protection enabled
protection-mpx	The file has the Intel Memory Protection guard enabled
protection-xfg	The file has the Extreme Flow Guard exploit protection enabled
protection-cet	The file has the Intel Control-Flow Enforcement Technology guard enabled
protection-sdl	The file has been compiled to follow the Secure Development Lifecycle guidelines
protection-seh	The file has safe exception handling protection enabled
protection-stack	The file has buffer overrun exploit protection enabled
force-integrity	The file has integrity protection checks that prevent execution on change
packed	The application is packed with a known packer (e.g. with UPX)
rich-header	The application has rich header metadata (applies to PE files)
reproducible-build	The application has been compiled in a reproducible way which invalidates all timestamps
sfx	The file is a self-extracting archive (an application that embeds an archive)
taggant	The application has Taggant-related metadata
tool-hacktool	The application is used to assist hacking
tool-steganography	The application has steganography capabilities
uefi	The application is designed for the UEFI subsystem (applies to PE files)
uninstaller	The application is uninstaller for particular software
unsupported-application	The application is deprecated and no longer supported by vendor
updater	The application is updater for particular software
version-info	The application has version information metadata
vulnerable-with-cve	The application has vulnerability with assigned CVE
vulnerable-without-cve	The application has vulnerability without assigned CVE
xbox	The application is designed for the XBOX subsystem (applies to PE files)

Mobile-related tags - apply only to mobile applications

TAG	DESCRIPTION
android-cupcake	The mobile application uses the Android API level 3
android-donut	The mobile application uses the Android API level 4
android-eclair	The mobile application uses the Android API levels 5 to 7
android-froyo	The mobile application uses the Android API level 8
android-gingerbread	The mobile application uses the Android API levels 9 to 10
android-honeycomb	The mobile application uses the Android API levels 11 to 13
android-ice-cream-sandwich	The mobile application uses the Android API levels 14 to 15
android-jelly-bean	The mobile application uses the Android API levels 16 to 18
android-kitkat	The mobile application uses the Android API levels 19 to 20
android-lollipop	The mobile application uses the Android API levels 21 to 22
android-marshmallow	The mobile application uses the Android API level 23
android-nougat	The mobile application uses the Android API levels 24 to 25
android-oreo	The mobile application uses the Android API levels 26 to 27
android-pie	The mobile application uses the Android API level 28
android-10	The mobile application uses the Android API level 29
android-11	The mobile application uses the Android API level 30
mobile	The file appears to be a mobile application (e.g. Android APK or Windows Phone applications)
mobile-custom-permissions	The mobile application has user-defined permissions
mobile-data-access	The mobile application can read and write to the external storage on the device
mobile-deprecated	The mobile application can abuse permissions from deprecated APIs
mobile-gps	The mobile application can access location services
mobile-infostealer	The mobile application can access and read information such as call logs, contacts, calendars...
mobile-logging	The mobile application can read and modify call logs
mobile-settings	The mobile application can change system settings on the device
mobile-sms	The mobile application can read, write, or receive SMS messages
mobile-telco	The mobile application can access and use the telecom connection service
mobile-voicemail	The mobile application can access and send voicemail messages

Malware tags - identify malware types and refer to other malware metadata

TAG	DESCRIPTION
backdoor	The malware was identified as a backdoor
c2	The malware has an embedded malware/data configuration (e.g. C2 info or mutex)
custom-packed	The file appears to be packed with a custom packer
downloader	The malware was identified as a downloader
keylogger	The malware was identified as a keylogger
pos	The malware was identified as a point-of-sale malware
ransomware	The malware was identified as ransomware

Packer tags - refer to packer-related metadata

TAG	DESCRIPTION
antidebugging	The file uses anti-debugging techniques
antidumping	The file uses anti-dumping techniques
antiemulation	The file uses anti-emulation techniques
antisandbox	The file uses anti-sandbox techniques
antitracing	The file uses anti-tracing techniques
fake-signature	The file uses fake signatures to thwart signature-based identification
import-elimination	The packed file eliminates or has eliminated its import information
import-redirection	The packed file redirects imports to make unpacking harder
pe-compression	The file has a compressed payload/configuration
pe-encryption	The file has an encrypted payload/configuration
pe-encryption-rc4	The file uses RC4 to encrypt the payload/configuration
pe-encryption-tea	The file uses TEA to encrypt the payload/configuration
polymorphic	The file was packed with a polymorphic packer
remove-ep	The packed file has a stolen original entry point
remove-header	The packed file removes the PE header during unpacking to make unpacking harder
tamper-protection	The file checks for signs of modification to make unpacking harder

Browser tags - refer to browser-related metadata

TAG	DESCRIPTION
chrome-reference	The file contains references to Chrome or Chrome-related data (e.g. accesses settings, contains Chrome user agent strings)
chrome-tamper	The file can tamper with Chrome or Chrome-related settings (e.g. performs process injection into the Chrome executable)
chromium-reference	The file contains references to Chromium or Chromium-related data (e.g. accesses settings, contains Chromium user agent strings)
chromium-tamper	The file can tamper with Chromium or Chromium-related settings (e.g. performs process injection into the Chromium executable)
firefox-reference	The file contains references to Firefox or Firefox-related data (e.g. accesses settings, contains Firefox user agent strings)
firefox-tamper	The file can tamper with Firefox or Firefox-related settings (e.g. performs process injection into the Firefox executable)
internet-explorer-reference	The file contains references to Internet Explorer or Internet Explorer-related data (e.g. accesses settings, contains Internet Explorer user agent strings)
internet-explorer-tamper	The file can tamper with Internet Explorer or Internet Explorer-related settings (e.g. performs process injection into the Internet Explorer executable)
netscape-reference	The file contains references to Netscape or Netscape-related data (e.g. accesses settings, contains Netscape user agent strings)
netscape-tamper	The file can tamper with Netscape or Netscape-related settings (e.g. performs process injection into the Netscape executable)
opera-reference	The file contains references to Opera or Opera-related data (e.g. accesses settings, contains Opera user agent strings)
opera-tamper	The file can tamper with Opera or Opera-related settings (e.g. performs process injection into the Opera executable)
safari-reference	The file contains references to Safari or Safari-related data (e.g. accesses settings, contains Safari user agent strings)
safari-tamper	The file can tamper with Safari or Safari-related settings (e.g. performs process injection into the Safari executable)

Classification tags - apply only to classified files

TAG	DESCRIPTION
cert-blacklisted	The file was digitally signed with a blacklisted certificate
cert-whitelisted	The file was digitally signed with a whitelisted certificate
cloud	The file was classified by ReversingLabs Malware Presence (e.g. the hash is a well-known threat)
exploit	The file was classified by Spectra Core exploit detection from an unpacker or a validator (e.g. RTF)
graylisting	The file was classified by graylisting (e.g. an archive containing only text files)
hierarchy-analyzer	The file was classified by Spectra Core file hierarchy analysis (e.g. embedded executables within a document format)
image-analyzer	The file was classified by Spectra Core image analyzer (e.g. suspicious data was found within an image)
ricc	The file was classified by Spectra Core RICC (e.g. RHA classification, RICC rule classifications)
signature	The file was classified by Spectra Core signature
antivirus	The file was classified by an AntiVirus component
ng-antivirus	The file was classified by a NextGen AntiVirus component
yara	The file was classified by a YARA rule

Capability tags - refer to capabilities of executables, documents, and mobile applications

TAG	DESCRIPTION
capability-advertising	The file has advertising-related capabilities (e.g. AdMob) - applies to documents and mobile formats
capability-bluetooth	The file can use Bluetooth to communicate with other devices - mobile-specific tag
capability-camera	The file has access to the camera - applies to documents and mobile formats
capability-cryptography	The file has cryptography-related capabilities (e.g. it can encrypt or hash data and files)
capability-deprecated	The file uses deprecated APIs
capability-embeds	The file has other files embedded within (e.g. an iframe or an OLE object) - document-specific tag
capability-execution	The file has execution-related capabilities (e.g. an application can spawn new processes or threads)
capability-filesystem	The file has filesystem-related capabilities (e.g. it can open and read files)
capability-identification	The file has access to user or device identity - mobile-specific tag
capability-microphone	The file has access to the microphone - applies to documents and mobile formats
capability-networking	The file has networking-related capabilities (e.g. it can open a socket and send/receive data)
capability-nfc	The file can use Near Field Communication (NFC) to communicate with other devices - mobile-specific tag
capability-scripting	The file uses a scripting language (e.g. a document contains and uses macros) - document-specific tag
capability-security	The file has security-related capabilities
capability-social	The file has access to social components or providers (e.g. Facebook) - applies to documents and mobile formats
capability-undocumented	The file uses undocumented functions
capability-vpn	The file can access VPNs - mobile-specific tag
capability-wallet	The file has access to user’s wallet - mobile-specific tag

Indicator tags - refer to indicators found in executables, documents, scripts, and mobile applications

An indicator tag will be emitted by Spectra Core only if the priority of a particular indicator is not low (i.e. priority > 3).

TAG	DESCRIPTION
indicator-anomaly	The file contains unusual characteristics (e.g. contains known whitelisted executable filenames)
indicator-autostart	The file tampers with autostart settings (e.g. tampers with autorun locations)
indicator-behavior	The file automatically executes activities as a user (e.g. changes username or password, prints a document)
indicator-disable	The file disables system services (e.g. tampers with Windows Update)
indicator-document	The file exhibits unusual activities when handling documents (e.g. PDF that creates new documents)
indicator-evasion	The file tries to evade common debuggers, sandboxes or analysis tools (e.g. VM environment detection)
indicator-execution	The file creates other processes or starts other applications (e.g. creates a service, installs system drivers)
indicator-exploit	The file contains known exploits against the system
indicator-family	The file is associated with known malicious families
indicator-file	The file accesses other files on the filesystem in an unusual way (e.g. creates a cryptographic hash of file contents)
indicator-flow	The file leaks sensitive information to external hosts or creates new files with sensitive data (e.g. exports PDF form fields to files)
indicator-macro	The file contains or executes macro functions or scripts (e.g. contains UNIX shell scripts, executes actions associated with bookmarks)
indicator-memory	The file tampers with memory of foreign processes (e.g. does process injection)
indicator-monitor	The file has the ability to monitor host activities (e.g. accesses a list of logged on users)
indicator-network	The file has network-related indicators (e.g. downloads a file, tampering with DNS settings)
indicator-packer	The file contains obfuscated or encrypted code or data (e.g. base64 encoded streams)
indicator-payload	The file extracts and launches new behavior in an unusual way (e.g. injects CSS into a page)
indicator-permissions	The file tampers with or request additional permissions for execution (e.g. tampers with user/account privileges)
indicator-registry	The file accesses registry and configuration files in an unusual way (e.g. tampers with Windows registry settings)
indicator-search	The file enumerates or collects information from a system (e.g. enumerates network shares or mounted drives)
indicator-settings	The file accesses or tampers with system settings (e.g. enumerates system information)
indicator-signature	The file matches a known signature (e.g. contains known compression libraries, HTTP header fields)
indicator-steal	The file steals and leaks sensitive information (e.g. accesses Outlook account information and address book)
indicator-stealth	The file tries to hide its presence (e.g. tampers with window transparency settings, tampers with firewall settings)

String tags - related to Spectra Core interesting strings

TAG	DESCRIPTION
string-file	The file contains interesting strings related to the file URI scheme
string-scp	The file contains SCP-related interesting strings
string-callto	The file contains interesting strings related to the CallTo communication protocol
string-h323	The file contains interesting strings related to the H.323 multimedia communication protocol
string-webcal	The file contains interesting strings related to iCalendar files
string-ftp	The file contains FTP-related interesting strings
string-http	The file contains HTTP-related interesting strings
string-https	The file contains HTTPS-related interesting strings
string-mailto	The file contains mailto-related interesting strings
string-sftp	The file contains SFTP-related interesting strings
string-sip	The file contains SIP-related interesting strings
string-ssh	The file contains SSH-related interesting strings
string-telnet	The file contains Telnet-related interesting strings

Compression and crypto tags - related to identified compression and crypto content

TAG	DESCRIPTION
compression-brotli	The file has content related to Brotli compression algorithm
compression-bzip2	The file has content related to BZip2 compression algorithm
compression-deflate	The file has content related to Deflate compression algorithm
compression-dicky	The file has content related to Dicky compression algorithm
compression-gipfeli	The file has content related to Gipfeli compression algorithm
compression-gzip	The file has content related to GZip compression
compression-inflate	The file has content related to Inflate compression algorithm
compression-lz4	The file has content related to LZ4 compression algorithm
compression-lzfse	The file has content related to LZFSE compression algorithm
compression-lzhuf	The file has content related to LZHUF compression algorithm
compression-lzma	The file has content related to LZMA compression algorithm
compression-ncompress42	The file has content related to Ncompress42 compression algorithm
compression-pithy	The file has content related to Pithy compression algorithm
compression-pkzip	The file has content related to PKZIP compression algorithm
compression-pucrunch	The file has content related to Pucrunch compression algorithm
compression-snappy	The file has content related to Snappy compression algorithm
compression-unlzx	The file has content related to UnLZX compression algorithm
compression-unrarlib	The file has content related to unrarlib compression algorithm
compression-zip	The file has content related to Zip compression
compression-zlib	The file has content related to Zlib compression algorithm
compression-zstd	The file has content related to Zstd compression algorithm
crypto-acss	The file has content related to ACSS algorithm
crypto-adler-crc32	The file has content related to Adler-32 algorithm
crypto-base32	The file has content related to Base32 algorithm
crypto-base64	The file has content related to Base64 algorithm
crypto-base64url	The file has content related to Base64URL algorithm
crypto-bcrypt	The file has content related to BCrypt algorithm
crypto-bhencode	The file has content related to Bhencode algorithm
crypto-blake	The file has content related to Blake algorithm
crypto-blowfish	The file has content related to Blowfish algorithm
crypto-bmw512	The file has content related to BMW-512 algorithm
crypto-botan	The file has content found in Botan cryptography library
crypto-camellia	The file has content related to Camellia algorithm
crypto-cast	The file has content related to CAST algorithm
crypto-cast256	The file has content related to CAST-256 algorithm
crypto-clefia	The file has content related to CLEFIA algorithm
crypto-collision	The file contains blocks used in SHA-1 collision attacks
crypto-crc32	The file has content related to CLEFIA algorithm
crypto-cryptlib	The file has content found in Cryptlib cryptography library
crypto-cryptopp	The file has content found in Cryptopp (Crypto++) cryptography library
crypto-des	The file has content related to DES algorithm
crypto-desx	The file has content related to DESX algorithm
crypto-dsa	The file has content related to Digital Signature Algorithm (DSA)
crypto-ecc	The file has content related to Elliptic-curve cryptography (ECC)
crypto-frog	The file has content related to FROG algorithm
crypto-gnupg	The file has content found in GnuPG cryptography library
crypto-gnutls	The file has content found in GnuTLS cryptography library
crypto-gost	The file has content related to GOST algorithm
crypto-haval	The file has content related to HAVAL algorithm
crypto-hmac	The file has content related to HMAC algorithm
crypto-ike	The file has content related to Internet Key Exchange (IKE)
crypto-kasumi	The file has content related to KASUMI algorithm
crypto-keccak	The file has content related to Keccak algorithm
crypto-mars	The file has content related to MARS algorithm
crypto-md2	The file has content related to MD2 algorithm
crypto-md4	The file has content related to MD4 algorithm
crypto-md5	The file has content related to MD5 algorithm
crypto-md5mac	The file has content related to MD5-MAC algorithm
crypto-misty1	The file has content related to Misty1 algorithm
crypto-misty2	The file has content related to Misty2 algorithm
crypto-nacl	The file has content found in NaCl cryptography libray
crypto-nettle	The file has content found in Nettle cryptography library
crypto-noekeon	The file has content related to NOEKEON algorithm
crypto-nss	The file has content found in NSS cryptography library
crypto-nush	The file has content related to NUSH algorithm
crypto-openbsd-base64	The file has content related to OpenBSD Base64 algorithm
crypto-openssl	The file has content found in OpenSSL cryptography library
crypto-pbkdf2	The file has content related to PBKDF2 algorithm
crypto-pkcs	The file has content related to Public Key Cryptography Standards (PKCS)
crypto-rawdes	The file has content related to RawDES algorithm
crypto-rc2	The file has content related to RC2 algorithm
crypto-rijndael	The file has content related to AES (Rijandel) algorithm
crypto-ripemd128	The file has content related to RIPEMD-128 algorithm
crypto-ripemd160	The file has content related to RIPEMD-160 algorithm
crypto-ripemd256	The file has content related to RIPEMD-256 algorithm
crypto-ripemd320	The file has content related to RIPEMD-320 algorithm
crypto-rsa	The file has content related to RSA algorithm
crypto-rtss	The file has content related to Robust Threshold Secret Sharing (RTSS)
crypto-safer	The file has content related to SAFER algorithm
crypto-salsa20	The file has content related to Salsa20 algorithm
crypto-seed	The file has content related to SEED algorithm
crypto-serpent	The file has content related to Serpent algorithm
crypto-sha1	The file has content related to SHA-1 algorithm
crypto-sha224	The file has content related to SHA-224 algorithm
crypto-sha256	The file has content related to SHA-256 algorithm
crypto-sha384	The file has content related to SHA-384 algorithm
crypto-sha512	The file has content related to SHA-512 algorithm
crypto-shark	The file has content related to Shark algorithm
crypto-siphash	The file has content related to SipHash algorithm
crypto-skein	The file has content related to Skein algorithm
crypto-skipjack	The file has content related to Skipjack algorithm
crypto-sms4	The file has content related to SMS4 algorithm
crypto-sosemanuk	The file has content related to Sosemanuk algorithm
crypto-square	The file has content related to Square algorithm
crypto-tiger	The file has content related to Tiger algorithm
crypto-tripledes	The file has content related to TripleDES algorithm
crypto-turing	The file has content related to Turing algorithm
crypto-twofish	The file has content related to Twofish algorithm
crypto-unicorn	The file has content related to Unicorn algorithm
crypto-uuencode	The file has content related to UUencode algorithm
crypto-wake	The file has content related to Wake algorithm
crypto-whirlpool	The file has content related to Whirlpool algorithm
crypto-x509	The file has content related to X.509 standard
crypto-xxencode	The file has content related to XXencode algorithm

Email specific tags - related to email content

TAG	DESCRIPTION
email-deceptive-sender	The display name of one of the senders contains a string resembling an email address with a domain different from the specified email address
email-returnpath-mismatch	The "Return-Path" header contains an email address with a domain that is different from the domain of the sender
email-replyto-mismatch	The "Reply-To" header contains an email address with a domain that is different from the domain of the sender
email-sender-mismatch	The "Sender" header contains an email address with a domain that is different from the domain specified in the "From" header
email-envelopefrom-mismatch	The "X-Envelope-From" header contains an email address with a domain that is different from the domain of the sender
email-receivedtime-mismatch	The "Date" header indicates a time that is in the future or more than 1 hour before the time specified in the "Received" header
email-spf-fail	Headers indicate that the SPF (Sender Policy Framework) check has failed
email-dkim-fail	Headers indicate that the DKIM (Domain Keys Identified Mail) check has failed
email-dmarc-fail	Headers indicate that the DMARC (Domain-based Message Authentication, Reporting & Conformance) check has failed
email-pgp	Email is signed and/or encrypted using "Pretty Good Privacy"
email-smime	Email is signed and/or encrypted using "Secure/Multipurpose Internet Mail Extensions"
email-attachment	Email contains at least one attachment
email-deceptive-extension	Email attachment contains multiple extensions (eg. "file.doc.exe")
email-body-plain	Content of email body is available in plain text format
email-body-rtf	Content of email body is available in RTF format
email-body-html	Content of email body is available in HTML format
email-impersonation	The display name of one of the senders impersonates a popular service
email-signature-impersonation	Email contents impersonate an email commonly sent by a popular service
email-urgency	Email contains multiple phrases that imply a sense of urgency
email-sensitive-topic	Email contains multiple phrases related to sensitive topics
email-hidden-text	Email contains a hidden block of text designed to trick classification systems
email-subject-spam	Email subject contains phrases common to spam messages
email-subject-phishing	Email subject is commonly used in phishing messages
email-anonymous-provider	Email is sent using an anonymous email provider

Format specific tags - apply only specific file formats

TAG	DESCRIPTION
html-frame	The HTML file contains one or more IFRAME tags
html-form	The HTML file contains one or more FORM tags
html-input	The HTML file contains one or more INPUT tags
html-password	The HTML file contains one or more tags with the "password" attribute
html-image	The HTML file contains one or more IMAGE tags
html-canvas	The HTML file contains one or more CANVAS tags
html-object	The HTML file contains any of the following tags: APPLET, AUDIO, EMBED, OBJECT, SOURCE, VIDEO
html-download	The HTML file contains one or more links with the "download" attribute
html-local-link	The HTML file contains one or more links to local files
html-tracking	The HTML file contains one or more tracking pixels
html-popup	The HTML file contains an A tag with target="_blank" attribute
html-wsffile	The HTML file contains an A tag with href="jsffile:..." or href="wsffile:..." or href="wsfhile:..."
font-embedded	The HTML file contains embedded fonts
deceptive-link	The HTML file contains potentially deceptive links
platform-unix	The quarantine file was created by a security solution running on a UNIX-like operating system
platform-windows	The quarantine file was created by a security solution running on the Microsoft Windows operating system
private-key-plaintext	The file represents a PKI private key in a standard format (e.g. PEM or DER)
private-key-encrypted	The file represents an encrypted PKI private key in a standard format (e.g. PEM or DER)
quarantine-manual	The quarantine file was added to the quarantine manually by a user, not as a result of an automatic detection by the security solution
quarantine-malicious-content	The quarantine file contains any number of remediated malicious content associated with a detected threat
quarantine-threat-metadata	The quarantine file contains metadata describing the antivirus specific threat which triggered the remediation
version-control-artifact	The file is part of a control structure for a version control repository (e.g. an index or revision data)

Appendix D: Metadata Changes

This lists all metadata changes from Spectra Detect 1.x- to 2.x+, as well as changes from Spectra Analyze 5.x- to 6.x+.

analysis

The report object is now nested inside the analysis object. This new root object combines the analysis report with the metadata describing the analysis and its results. Analysis reports relate to each other by id and parent_id, making it easy to construct relationships between analyzed objects.

Change	Type	Name
Added	uint64	id
Added	uint64	parent_id
Added	string	timestamp
Added	string	version
Added	struct	report
Added	struct	stats

analysis.report

The story object has been redesigned to be able to split the automated static analysis description into paragraphs. Other members have had their members changed to allow for analysis feature expansions.

Change	Type	Name
Changed	struct	info
Changed	struct	metadata
Changed	struct	strings
Changed	struct	classification
Changed	struct-list	indicators
Changed	struct	story

analysis.report.info

The package object has been deprecated and replaced by properties to track general information. Malware configuration, previously found within the package object, has been moved to a dedicated metadata object. Other general information will continue to be reported via the properties key-value list.

Change	Type	Name
Changed	struct	file
Removed	struct	package
Changed	struct	validation
Added	struct	properties
Added	struct	overlays
Changed	string-list	error -> errors

analysis.report.info.file

The properties object has been deprecated. File access, creation and modification time have been made more prominent within the file object. File attributes and access rights have been standardized and moved to the security object.

Change	Type	Name
Added	string	proposed_filename
Added	string	modified_time
Added	string	access_time
Added	string	creation_time
Removed	struct-list	properties

analysis.report.info.validation

The validation object has been redesigned to follow the scanner-based logic established in the classification object. Multiple validation scanners parse the file and report their findings. The entire file is considered valid only if all applicable scanners confirm its validity. Any malformations, or format specification deviations, are reported through scanner descriptions and warnings.

Change	Type	Name
Removed	int32-set	descriptions
Removed	struct	warnings
Added	struct-list	scan_results

analysis.report.classification

The classification object has been extended to better promote the final classification result. Users previously had to look at the first scanner result to retrieve the final detection string. The existing classification object members already describe other classification properties and its impact.

Change	Type	Name
Added	string	result

analysis.report.classification.scan_results.entry

The scan_results entry has been extended to indicate if the scanner was taken into account during classification, or ignored due to Spectra Core configuration.

Change	Type	Name
Added	boolean	present
Added	boolean	ignored

analysis.report.classification.yara.match

Change	Type	Name
Added	uint32	length

analysis.report.indicators.entry

Spectra Core Explainable Machine Learning is based around explainability, transparency and relevancy. Static analysis indicators are considered explainable through their description. The entire system is transparent, as reasons behind indicator appearance are listed. Finally, factors that contribute to Machine Learning classification have been highlighted through indicator relevance.

Change	Type	Name
Added	int32	id
Added	int32	relevance
Added	struct-list	reasons

analysis.report.strings.entry

The list of strings has been converted to a list of properties that describe the string value, where it was found, number of its occurrences, and human readability.

Change	Type	Name
Added	uint32	flags
Added	int32	occurrences
Added	uint64	offset
Added	string	value

analysis.report.interesting_strings.entry

The list of interesting strings has been converted to a list of properties that describe the string value, where it was found, number of its occurrences, and classification. Interesting strings are checked against Spectra Core URL Classifier to detect blacklisted and misleading hyperlinks.

Change	Type	Name
Added	uint64	offset
Added	int32	occurrences
Added	struct	scan_result
Added	string	value
Added	string-set	tags

analysis.report.metadata

The media object has been redesigned. Multimedia metadata now allows for better, unified, reporting of audio and video properties. Previously used structure members are considered deprecated, and their meaning has changed.

The browser object has been redesigned. Browser extension metadata now allows for reporting of new, widely used, extension manifest properties. Previously used structure members are considered deprecated, and their meaning has changed.

The certificate object has been deprecated. Spectra Core now reports digital signatures with their validation states. Any certificate found within the file, but not as a part of the digital signing chain, will be reported as dangling certificate within the new certificates list. Previously used structure members are considered deprecated and their meaning has changed.

Malware configuration has been moved to malware from the package object. Newly defined malware configuration structure standardizes typical networking and malware runtime information.

Change	Type	Name
Changed	struct	security
Removed	struct	certificate
Added	struct	signatures
Added	struct	certificates
Changed	struct	media
Changed	struct	browser
Added	struct	package
Added	struct	attack
Added	struct	malware

analysis.report.metadata.security

The file attributes object has been moved to the security object. Other file access properties, such as ownership and access, are now being reported alongside notable file security properties. With the introduction of Application Identity, known software and library vulnerabilities affecting the detected versions are reported here.

Change	Type	Name
Added	struct-set	vulnerabilities
Added	string	owning_user
Added	string	owning_group
Added	struct-list	access_list
Added	string-set	attributes

analysis.report.metadata.application

With the introduction of Application Identity, the way Spectra Core describes third-party libraries has changed to accommodate for software publisher and origin verification. Similarly, applications themselves can have their respective identities verified. When the software identity is established, a set of known dependency vulnerabilities found within the detected version can be accurately reported.

Change	Type	Name
Changed	struct	libraries
Added	struct	identity

analysis.report.metadata.application.flash

The Flash application metadata object has been deprecated. Spectra Core will no longer collect, nor output, Adobe Flash related metadata properties.

analysis.report.metadata.application.pe

The application-specific overlay information has been moved to the info object, allowing for multiple overlay objects to be reported for a single file.

Change	Type	Name
Added	struct	analysis
Removed	struct	overlay

analysis.report.metadata.application.pe.rich_header

RichHeader validation has been moved to a dedicated format validation scanner. Its results are reported within the validation object.

Change	Type	Name
Removed	boolean	valid
Changed	struct-list	entries

analysis.report.metadata.application.pe.rich_header.entry

The previously bundled compid value has been separated into easier to use product and version values. Added a helper value tooling that maps product to a recognized toolchain software type.

Change	Type	Name
Removed	uint32	compid
Removed	uint32	count
Added	uint32	tooling
Added	uint16	version
Added	uint16	product
Added	uint32	counter

analysis.report.metadata.application.pe.sections.entry

The section information has been extended to include a relative section size, and adjusted to better differentiate between physical and relative values.

Change	Type	Name
Renamed	uint32	offset -> physical_base
Renamed	uint32	size -> physical_size
Renamed	uint32	address -> relative_base
Added	uint32	relative_size

analysis.report.metadata.application.pe.resources.entry

Change	Type	Name
Added	double	entropy

analysis.report.metadata.application.elf.symbols.entry

Change	Type	Name
Added	uint32	references
Added	uint32	sources

Introduction​

Notable changes​

Data Analysis Workflow​

Basic Data Types​

Spectra Detect Report​

Analysis​

Classification​

Scanner result​

Spectra Core Classification Scanners​

YARA​

YARA string​

YARA string match​

Relationships​

Info​

Statistics​

file_stats_item​

file_stats_item_identification​

File​

Identification​

Binary Layer​

binary_layer_type (enum)​

Validation​

Validation Result​

validation_description (enum)​

scanner_type (enum)​

Unpacking​

unpacking_status (enum)​

Overlay​

overlay_from (enum)​

Metadata​

Application (Metadata)​

PE​

Analysis​

Issue​

DOS header​

Rich header​

Entry​

File header​

Optional header​

Data directory​

PE section​

Import​

Export​

Resource​

Codeview​

Taggant​

Packer info​

ELF​

Program header​

ELF section​

ELF Symbol​

Dynamic table​

Macho​

Segment​

Macho section​

Macho Symbol​

Dex​

Dex Class​

Annotation​

Method​

Field (Dex)​

Dotnet​

.NET Method​

Pinvoke info​

Parameter​

Assembly​

Type​

Field​

Event​

Properties​

.NET Resource​

Exported type​

Identity​

identity_type (enum)​

Verification (enum)​

Protection​

Security​

Vulnerability​

CVSS​

Access​

Introduction

Notable changes

Data Analysis Workflow

Basic Data Types

Spectra Detect Report

Analysis

Classification

Scanner result

Spectra Core Classification Scanners

YARA

YARA string

YARA string match

Relationships

Info

Statistics

file_stats_item

file_stats_item_identification

File

Identification

Binary Layer

binary_layer_type (enum)

Validation

Validation Result

validation_description (enum)

scanner_type (enum)

Unpacking

unpacking_status (enum)

Overlay

overlay_from (enum)

Metadata

Application (Metadata)

PE

Analysis

Issue

DOS header

Rich header

Entry

File header

Optional header

Data directory

PE section

Import

Export

Resource

Codeview

Taggant

Packer info

ELF

Program header

ELF section

ELF Symbol

Dynamic table

Macho

Segment

Macho section

Macho Symbol

Dex

Dex Class

Annotation

Method

Field (Dex)

Dotnet

.NET Method

Pinvoke info

Parameter

Assembly

Type

Field

Event

Properties

.NET Resource

Exported type

Identity

identity_type (enum)

Verification (enum)

Protection

Security

Vulnerability

CVSS

Access