File behaviour reports are obtained either by using the [GET /files/\{id}/behaviours](ref:files-relationships) endpoint or the [sandbox behavior feed](ref:feeds-file-behaviour) . They summarize the observed behaviour during the execution or opening of a file. Note that some of these actions could be triggered by children of the file under consideration. ## Object Attributes In a file_behaviour object you will find these attributes: - `analysis_date`: \<_integer_> Unix epoch UTC time (seconds). - `behash`: \<_string_> used to find similar behaviour analyses. - `calls_highlighted`: \<_list of strings_> API calls/Syscalls worth highlighting. - `command_executions`: \<_list of strings_> shell command executions observed during the analysis of the given file. - `files_opened`: \<_list of strings_> files opened during execution. - `files_written`: \<_list of strings_> files written to during execution. - `files_deleted` \<_list of strings_> names of the files deleted. - `files_attribute_changed`: \<_list of strings_> full path of files subject to some sort of active attribute modification. - `has_html_report`: \ whether there is an HTML report for this behaviour analysis. - `has_evtx`: \ whether there is a EVTX file for this behaviour analysis. Check out [/file_behaviours/\{sandbox_id}/evtx](#file-behaviour-evtx) for more information. - `has_memdump`: \ whether there is a memdump file for this behaviour analysis. Check out [/file_behaviours/\{sandbox_id}/memdump](#file-behaviour-memdump). - `has_pcap`: \ whether there is a PCAP network capture for this behaviour analysis. Check out [/file_behaviours/\{sandbox_id}/pcap](#file_behaviours_pcap) for more information. - `hosts_file`: \<_string_> the hosts file field stores the content of the local hostname-ip mapping hosts file IF AND ONLY IF the file was modified, else this field is not populated. - `ids_alerts`: \<_list of dictionaries_> list of IDS alerts, sorted by timestamp. Every item contains the following keys: - `alert_context`: \<_dictionary_> matched alert context: - `dest_ip`: \<_string_> destination IP. - `dest_port`: \<_integer_> destination port. - `hostname`: \<_string_> if the alert is related to an HTTP communication, destination hostname. - `protocol`: \<_string_> communication protocol name. - `src_ip`: \<_string_> source IP. - `src_port`: \<_integer_> source port. - `url`: \<_string_> if the alert is related to an HTTP communication, destination URL. - `alert_severity`: \<_string_> one of `high`, `medium`, `low` or `info`. - `rule_category`: \<_string_> alert category. - `rule_id`: \<_string_> rule SID. - `rule_msg`: \<_string_> alert description. - `rule_source`: \<_string_> rule source, determined by SID range. - `processes_terminated`: \<_list of strings_> name of the processes that were terminated during the execution of a given file. - `processes_killed`: \<_list of strings_> name of the processes that were killed during the execution of a given file. - `processes_injected`: \<_list of strings_> name of the processes that were subjected to some kind of code injection during the execution of the given file. - `services_opened`: \<_list of strings_> names of the services for which a handle was acquired during the analysis of the given file. - `services_created`: \<_list of strings_> new services created. - `services_started`: \<_list of strings_> new services started. - `services_stopped`: \<_list of strings_> services stopped during the execution of the given file. - `services_deleted`: \<_list of strings_> services deleted during the execution of the given file. - `services_bound`: \<_list of strings_> service binding, mainly in Android, see: \. - `windows_searched`: \<_list of strings_> names of windows that are searched for. - `windows_hidden`: \<_list of strings_> names of windows that are set up to be invisible. - `mutexes_opened`: \<_list of strings_> name of the mutexes for which the file acquires a handle. - `mutexes_created`: \<_list of strings_> new mutexes created. - `signals_observed`: \<_list of strings_> OS Signals and broadcast events, note that Android broadcasts are categorized here also. - `invokes`: \<_list of strings_> method/functionality called via reflection or some sort of runtime instantiation. The best example are Java reflection calls, in those cases we flatten the structure to a string: \.\. - `crypto_algorithms_observed`: \<_list of strings_> Example: RSA. - `crypto_keys`: \<_list of strings_> e.g. "MySecret". - `crypto_plain_text`: \<_list of strings_> strings that are either ciphered or deciphered during the observed time frame, we record just the plaintext. - `text_decoded`: \<_list of strings_> plaintext which is the result of a decoding operation. - `text_highlighted` \<_list of strings_> interesting text seen in window dialogs, titles, etc. - `verdict_confidence`: \<_integer_> 99 = 99% confident verdict is correct. - `ja3_digests`: \<_list of strings_> [JA3](https://github.com/salesforce/ja3) fingerprinting of TLS client connections. - `tls`: \<_list of dictionaries_> contacted domains/IPs certificates. Each entry contains the following fields: - `issuer`: \<_dictionary_> certificate issuer information. Keys are certificate fields (C, CN, O, etc) as string and values are always string. - `ja3`: \<_string_> certificate JA3. - `ja3s`: \<_string_> certificate JA3s. - `serial_number`: \<_string_> certificate serial number. - `sni`: \<_string_> certificate's server name indication. - `subject`: \<_dictionary_> certificate subject information. Same format as `issuer` field. - `thumbprint`: \<_string_> certificate thumbprint. - `version`: \<_string_> TLS version. - `sigma_analysis_results`: \<_list of dictionaries_> aggregated [sigma](https://github.com/SigmaHQ/sigma) analyses results from all sandbox generated EVTX files. Each item contains the following subfields: - `rule_title`: \<_string_> matched sigma rule title. - `rule_source`: \<_string_> sigma ruleset where this rule belongs to. - `match_context`: \<_dictionary_> specific matched events. This dictionary contains the following key: - `values`: \<_list of map\>_ all matched events represented as key-value. - `rule_level`: \<_string_> rule level, can be either of "critical", "high", "medium", "low". - `rule_description`: \<_string_> rule description - `rule_author`: \<_string_> rule author - `rule_id`: \<_string_> rule ID in VirusTotal. You can use this to find other files matching this same rule. - `signature_matches`: \<_list of dictionaries_> aggregated list of matching signatures. Each item contains the following subfields: - `format`: \<_string_> any of the following formats: SIG_FORMAT_UNKNOWN, SIG_FORMAT_YARA, SIG_FORMAT_SIGMA, SIG_FORMAT_CAPA or SIG_FORMAT_OPENIOC. - `authors`: \<_dictionary_> list of authors. - `rule_src`: \<_string_> rule source. - `name`: \<_string_> rule name. - `description`: \<_string_> rule description. - `mitre_attack_techniques`: \< \_list of dictionaries\_> aggregated list of mitre attack techniques. Each item contains the following subfields: - `signature_description`: \<_string_> description. - `id`: \<_string_> identifier. - `severity`: \<_string_> severity. Android specific fields: - `activities_started`: \<_list of strings_> Android activities launched by the app under study. - `content_model_observers`: \<_list of strings_> content for which an Android app registers logic to be informed about any changes to it. - `content_model_sets`: \<_list of dictionaries_> content model entries performed by an Android app. - `databases_deleted`: \<_list of strings_> e.g. Android SQLite DBs deleted. - `databases_opened`: \<_list of strings_> interactions with databases, e.g. when an Android app opens an SQLite DB. - `permissions_requested`: \<_list of strings_> Android permissions requested by the app during runtime. In Windows it should also record process token privilege modifications such as SE_LOAD_DRIVER_PRIVILEGE. - `shared_preferences_lookups`: \<_list of strings_> entries in Android's shared preferences that are checked (\). - `shared_preferences_sets`: \<_list of dictionaries_> entries written in Android's shared preferences. Every subitem contains the following fields: - `key`: \<_string_> preference name. - `value`: \<_string_> set value. - `signals_hooked`: \<_list of strings_> registering a receiver in Android is considered as a broadcast hook. In windows this field will contain `SetWindowsHookExA` activity and the like. - `system_property_lookups`: \<_list of strings_> interactions with Android's system properties dataset (getInt, getString, putInt, putString, etc. all get simply translated into strings. android.os.SystemProperties.). - `system_property_sets`: \<_list of dictionaries_> keys and values set in Android's system properties dataset. Windows specific fields: - `modules_loaded`: \<_list of strings_> operations related to dynamic loading of libraries, shared objects and components. - `registry_keys_opened`: \<_list of strings_> Windows registry keys for which a handle is acquired. - `registry_keys_set`: \<_list of dictionaries_> keys and values of registry keys that are set. It is a list of dictionaries, each one containing the following fields: - `key`: \<_string_> modified registry key. - `value`: \<_string_> value set to the registry key. - `registry_keys_deleted`: \<_list of strings_> names of Windows registry keys that are deleted. ```json File behaviour report { "data": { "attributes": { "activities_started": [ "" ], "analysis_date": , "behash": "", "calls_highlighted": [ "" ], "command_executions": [ "" ], "files_opened": [ "" ], "files_written": [ "" ], "has_html_report": , "has_pcap": , "ids_results": [ { "alert_context": { "dest_ip": "", "dest_port": , "hostname": "", "protocol": "", "src_ip": "", "src_port": , "url": "" }, "alert_severity": "", "rule_id": "", "rule_msg": "", "rule_source": "" }, ], "last_modification_date": , "modules_loaded": [ "" ], "mutexes_created": [ "" ], "mutexes_opened": [ "" ], "processes_created": [ "" ], "processes_terminated": [ "" ] "registry_keys_deleted": [ "" ], "registry_keys_opened": [ "" ], "registry_keys_set": [ { "key": "", "value": "" } ], "sandbox_name": "", "shared_preferences_sets": [ { "key": "", "value": "" } ], "sigma_analysis_results": [{ "rule_title": "", "rule_source": "", "match_context": [{ "values": { "": ""}}], "rule_level": "", "rule_description": "", "rule_author": "", "rule_id": "" }], "tags": [ "" ], "text_highlighted": [ "" ], "tls": [ { "issuer": { "": "" }, "ja3": "", "ja3s": "", "serial_number": "", "sni": "", "subject": { "": "" }, "thumbprint": "", "version": "" } ], "verdicts": [ "" ] }, "id": "_", "links": { "self": "https://www.virustotal.com/api/v3/file_behaviours/" }, "type": "file_behaviour" } } ``` ```json Windows example { "data": { "attributes": { "analysis_date": 1593304117, "behash": "3212c1418311361831dd10d10b1914c2", "calls_highlighted": [ "GetTickCount" ], "dns_lookups": [ { "hostname": "blablabla.com", "resolved_ips": [ "66.66.66.66" ] } ], "files_dropped": [ { "path": "C:\\Users\\\\AppData\\Local\\Temp\\blablabla.virus.tmp", "sha256": "031a4a19f216d1d713f1b710b1eb13131811c113a151716c131c1161c191f15b" }, { "path": "C:\\Users\\\\AppData\\Local\\Temp\\blablabla.tmp", "sha256": "b20a8d88c550981137ed831f2015f5f11517aeb649c29642d9d61dea5ebc37d1" } ], "files_opened": [ "C:\\Windows\\syswow64\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\syswow64\\en\\KERNELBASE.dll.mui", "C:\\Windows\\system32\\netmsg.dll", "C:\\Users\\\\Downloads\\blablabla.virus.exe", "C:\\Users\\\\AppData\\Local\\Temp" ], "files_written": [ "C:\\Users\\\\AppData\\Local\\Temp\\blablabla.virus.tmp", "C:\\Users\\\\AppData\\Local\\Temp\\blablabla.tmp", "C:\\Users\\\\AppData\\Local\\Temp\\blabla.dll" ], "has_html_report": true, "has_pcap": true, "http_conversations": [ { "request_headers": { "accept": "*/*", "accept-encoding": "gzip, deflate", "connection": "Keep-Alive", "host": "blablabla.com", "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" }, "request_method": "GET", "url": "http://blablabla.com/tempfile/blablabla.virus" } ], "ids_results": [ { "alert_context": { "dest_ip": "234.0.0.12", "protocol": "IGMP", "src_ip": "10.0.44.24" }, "alert_severity": "low", "rule_id": "2200007", "rule_msg": "SURICATA IPv4 padding required ", "rule_source": "Suricata Decoder Events" }, ], "ip_traffic": [ { "destination_ip": "66.66.66.66", "destination_port": 80, "transport_layer_protocol": "TCP" } ], "last_modification_date": 1593304118, "modules_loaded": [ "C:\\Users\\\\Downloads\\blablabla.virus.ENU", "C:\\Users\\\\Downloads\\blablabla.virus.EN", "UxTheme.dll" ], "mutexes_created": [ "Local\\blablabla-blablabla-blablabla" ], "mutexes_opened": [ "blablabla-blablabla-blablabla" ], "processes_created": [ "C:\\Users\\\\AppData\\Local\\Temp\\blablabla.virus.tmp /SL5=$2A0120,2331237,148992,C:\\Users\\\\Downloads\\blablabla.virus.exe", "C:\\Windows\\system32\\regsvr32.exe /s C:\\Windows\\system32\\jscript.dll" ], "processes_terminated": [ "C:\\Windows\\system32\\regsvr32.exe /s C:\\Windows\\system32\\jscript.dll" ], "processes_tree": [ { "children": [ { "children": [ { "name": "C:\\Windows\\system32\\regsvr32.exe /s C:\\Windows\\system32\\jscript.dll", "process_id": "2700", "time_offset": 8 } ], "name": "C:\\Users\\\\AppData\\Local\\Temp\\blablabla.virus.tmp /SL5=$2A0120,2331237,148992,C:\\Users\\\\Downloads\\blablabla.virus.exe", "process_id": "2372", "time_offset": 1 } ], "name": "blablabla.virus.exe", "process_id": "2668" } ], "registry_keys_deleted": [ "HKCR\\JScript\\CLSID", "HKCR\\JScript\\OLEScript", "HKCR\\JScript", "HKCR\\LiveScript\\CLSID", "HKCR\\LiveScript\\OLEScript", "HKCR\\LiveScript", "HKCR\\JavaScript\\CLSID", "HKCR\\JavaScript\\OLEScript", "HKCR\\JavaScript", "HKCR\\JavaScript1.1\\CLSID", "HKCR\\JavaScript1.1\\OLEScript" ], "registry_keys_opened": [ "HKCU\\Software\\CodeGear\\Locales", "HKCU\\Software\\Borland\\Locales", "HKCU\\Software\\Borland\\Delphi\\Locales", "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes", "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2", "HKLM\\System\\CurrentControlSet\\Control\\Keyboard Layouts\\04090409", "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion", "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir", "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir", "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ], "registry_keys_set": [ { "key": "Software\\Microsoft\\RestartManager\\Session0000\\Owner", "value": "ॄ" }, { "key": "Software\\Microsoft\\RestartManager\\Session0000\\SessionHash" }, { "key": "Software\\Microsoft\\RestartManager\\Session0000\\Sequence", "value": "1" } ], "sandbox_name": "VirusTotal Jujubox", "sigma_analysis_results": [ { "rule_title": "File deletion via CMD (via cmdline)", "rule_source": "SOC Prime Threat Detection Marketplace", "match_context": [ { "values": { "TerminalSessionId": "0", "ProcessGuid": "C784477D-ED34-629E-4105-000000003000", "ProcessId": "4164", "Product": "Microsoft® Windows® Operating System", "Description": "Windows Command Processor", "Company": "Microsoft Corporation", "ParentProcessGuid": "C784477D-ED16-629E-2305-000000003000", "User": "NT AUTHORITY\\SYSTEM", "Hashes": "MD5=4E2ACF4F8A396486AB4268C94A6A245F,SHA256=9A7C58BD98D70631AA1473F7B57B426DB367D72429A5455B433A05EE251F3236,IMPHASH=8542FB14699D84D7E8DA92F66145C7FE", "OriginalFileName": "Cmd.Exe", "ParentImage": "C:\\Program Files\\rempl\\sedlauncher.exe", "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "ParentProcessId": "5204", "CurrentDirectory": "C:\\Windows\\system32\\", "CommandLine": "C:\\Windows\\System32\\cmd.exe /c C:\\Windows\\System32\\ipconfig.exe /flushdns >C:\\Windows\\TEMP\\ipconfig.out 2>&1", "EventID": "1", "LogonGuid": "C784477D-EC60-629E-E703-000000000000", "LogonId": "999", "Image": "C:\\Windows\\System32\\cmd.exe", "IntegrityLevel": "System", "ParentCommandLine": "\"C:\\Program Files\\rempl\\sedlauncher.exe\"", "UtcTime": "2022-06-07 06:16:20.702", "RuleName": "-" } }, { "values": { "TerminalSessionId": "0", "ProcessGuid": "C784477D-ED34-629E-4405-000000003000", "ProcessId": "1368", "Product": "Microsoft® Windows® Operating System", "Description": "Windows Command Processor", "Company": "Microsoft Corporation", "ParentProcessGuid": "C784477D-ED16-629E-2305-000000003000", "User": "NT AUTHORITY\\SYSTEM", "Hashes": "MD5=4E2ACF4F8A396486AB4268C94A6A245F,SHA256=9A7C58BD98D70631AA1473F7B57B426DB367D72429A5455B433A05EE251F3236,IMPHASH=8542FB14699D84D7E8DA92F66145C7FE", "OriginalFileName": "Cmd.Exe", "ParentImage": "C:\\Program Files\\rempl\\sedlauncher.exe", "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "ParentProcessId": "5204", "CurrentDirectory": "C:\\Windows\\system32\\", "CommandLine": "C:\\Windows\\System32\\cmd.exe /c C:\\Windows\\System32\\netsh.exe interface ip delete arpcache >C:\\Windows\\TEMP\\ipconfig.out 2>&1", "EventID": "1", "LogonGuid": "C784477D-EC60-629E-E703-000000000000", "LogonId": "999", "Image": "C:\\Windows\\System32\\cmd.exe", "IntegrityLevel": "System", "ParentCommandLine": "\"C:\\Program Files\\rempl\\sedlauncher.exe\"", "UtcTime": "2022-06-07 06:16:20.741", "RuleName": "-" } } ], "rule_level": "high", "rule_description": "Detects \"cmd\" utilization to self-delete files in some critical Windows destinations.", "rule_author": "Ariel Millahuel", "rule_id": "f9333cf120369debd56e4e238fffa10bdb2a1497c11e08a082befd02f9f3bdf2" }, { "rule_title": "Failed Code Integrity Checks", "rule_source": "Sigma Integrated Rule Set (GitHub)", "match_context": [ { "values": { "EventID": "5038", "param1": "\\Device\\HarddiskVolume4\\Program Files (x86)\\sandbox\\driver\\sandbox-driver.sys" } } ], "rule_level": "low", "rule_description": "Code integrity failures may indicate tampered executables.", "rule_author": "Thomas Patzke", "rule_id": "134564d292d785dff102940b8a1ee06dba2d462c5fb852124b3771a49d7885f1" }, { "match_context": [ { "values": { "TerminalSessionId": "0", "ProcessGuid": "C784477D-ED34-629E-4105-000000003000", "ProcessId": "4164", "Product": "Microsoft® Windows® Operating System", "Description": "Windows Command Processor", "Company": "Microsoft Corporation", "ParentProcessGuid": "C784477D-ED16-629E-2305-000000003000", "User": "NT AUTHORITY\\SYSTEM", "Hashes": "MD5=4E2ACF4F8A396486AB4268C94A6A245F,SHA256=9A7C58BD98D70631AA1473F7B57B426DB367D72429A5455B433A05EE251F3236,IMPHASH=8542FB14699D84D7E8DA92F66145C7FE", "OriginalFileName": "Cmd.Exe", "ParentImage": "C:\\Program Files\\rempl\\sedlauncher.exe", "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "ParentProcessId": "5204", "CurrentDirectory": "C:\\Windows\\system32\\", "CommandLine": "C:\\Windows\\System32\\cmd.exe /c C:\\Windows\\System32\\ipconfig.exe /flushdns >C:\\Windows\\TEMP\\ipconfig.out 2>&1", "EventID": "1", "LogonGuid": "C784477D-EC60-629E-E703-000000000000", "LogonId": "999", "Image": "C:\\Windows\\System32\\cmd.exe", "IntegrityLevel": "System", "ParentCommandLine": "\"C:\\Program Files\\rempl\\sedlauncher.exe\"", "UtcTime": "2022-06-07 06:16:20.702", "RuleName": "-" } }, { "values": { "TerminalSessionId": "0", "ProcessGuid": "C784477D-ED34-629E-4405-000000003000", "ProcessId": "1368", "Product": "Microsoft® Windows® Operating System", "Description": "Windows Command Processor", "Company": "Microsoft Corporation", "ParentProcessGuid": "C784477D-ED16-629E-2305-000000003000", "User": "NT AUTHORITY\\SYSTEM", "Hashes": "MD5=4E2ACF4F8A396486AB4268C94A6A245F,SHA256=9A7C58BD98D70631AA1473F7B57B426DB367D72429A5455B433A05EE251F3236,IMPHASH=8542FB14699D84D7E8DA92F66145C7FE", "OriginalFileName": "Cmd.Exe", "ParentImage": "C:\\Program Files\\rempl\\sedlauncher.exe", "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "ParentProcessId": "5204", "CurrentDirectory": "C:\\Windows\\system32\\", "CommandLine": "C:\\Windows\\System32\\cmd.exe /c C:\\Windows\\System32\\netsh.exe interface ip delete arpcache >C:\\Windows\\TEMP\\ipconfig.out 2>&1", "EventID": "1", "LogonGuid": "C784477D-EC60-629E-E703-000000000000", "LogonId": "999", "Image": "C:\\Windows\\System32\\cmd.exe", "IntegrityLevel": "System", "ParentCommandLine": "\"C:\\Program Files\\rempl\\sedlauncher.exe\"", "UtcTime": "2022-06-07 06:16:20.741", "RuleName": "-" } } ] } ], "tags": [ "DIRECT_CPU_CLOCK_ACCESS", "RUNTIME_MODULES" ], "text_highlighted": [ "Setup", "C:\\Windows\\system32\\cmd.exe" ], "tls": [ { "issuer": { "C": "US", "CN": "GTS CA 1O1", "O": "Google Trust Services" }, "ja3": "28a2c9bd18a11de089ef85a160da29e4", "ja3s": "eca9b8f0f3eae50309eaf901cb822d9b", "serial_number": "00c4ea98ea7e5e1f430200000000870182", "sni": "clients2.google.com", "subject": { "C": "US", "L": "Mountain View", "O": "Google LLC", "ST": "California" }, "thumbprint": "c25b1dc8be5f679087ecd28fb5eae7b3985cf604", "version": "TLS 1.2" } ] }, "id": "5353e23f3653402339c93a8565307c6308ff378e03fcf23a4378f31c434030b0_VirusTotal Jujubox", "links": { "self": "https://www.virustotal.com/api/v3/file_behaviours/5353e23f3653402339c93a8565307c6308ff378e03fcf23a4378f31c434030b0_VirusTotal Jujubox" }, "type": "file_behaviour" } } ``` ```json Android example { "data": { "attributes": { "activities_started": [ "com.software.application.Main (com.software.application)", "com.blabla.superuser.RequestActivity (com.thirdparty.superuser)" ], "analysis_date": 1528096752, "behash": "3f613ca3cd3a43fd3723539233a23e45", "calls_highlighted": [ "android.telephony.TelephonyManager.getNetworkOperator" ], "command_executions": [ "su" ], "dns_lookups": [ { "hostname": "blablabla.com", "resolved_ips": [ "66.66.66.66" ] } ], "files_copied": [ { "destination": "/data/data/com.software.application/shared_prefs/PREFS.xml.bak", "source": "/data/data/com.software.application/shared_prefs/PREFS.xml" } ], "files_deleted": [ "/data/data/com.software.application/shared_prefs/PREFS.xml.bak", "/data/data/com.software.application/shared_prefs/PREFS.xml" ], "files_opened": [ "/data/data/com.software.application/shared_prefs/PREFS.xml", "/data/data/com.software.application/shared_prefs/PREFS.xml.bak" ], "has_html_report": true, "has_pcap": false, "http_conversations": [ { "request_headers": { "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "accept-encoding": "gzip,deflate", "accept-language": "en-US", "connection": "keep-alive", "host": "www.blablabla.com", "user-agent": "Mozilla/5.0 (Linux; Android 4.4.2; VirtualBox Build/KVT49L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36", "x-requested-with": "com.android.browser" }, "request_method": "GET", "url": "http://www.blablabla.com/download.php" } ], "ip_traffic": [ { "destination_ip": "66.66.66.66", "destination_port": 80, "transport_layer_protocol": "TCP" } ], "last_modification_date": 1593383110, "sandbox_name": "VirusTotal Droidy", "services_opened": [ "com.google.android.gms.people.service.bg.PeopleBackgroundTasks (com.google.android.gms)", "com.google.android.gms.icing.service.IndexWorkerService (com.google.android.gms)", "com.google.android.gsf.gtalkservice.PushMessagingRegistrar (com.google.process.gapps)" ], "shared_preferences_sets": [ { "key": "NET_OP", "value": "46001" }, { "key": "SMS_DATA_KEY", "value": "blablabla" } ], "signals_hooked": [ "INTENT_DONE" ] "system_property_lookups": [ "debug.force_rtl", "debug.second-display.pkg" ], "tags": [ "TELEPHONY", "SENDS_SMS" ], "text_highlighted": [ "Open", "This may cause charges on your mobile account.", "Remember my choice", "Cancel", "Send", "Download File", ] }, "id": "cb41ce8487854d28441b74eef485d4044c7d474942624fde44c364c9c249f438_VirusTotal Droidy", "links": { "self": "https://www.virustotal.com/api/v3/file_behaviours/cb41ce8487854d28441b74eef485d4044c7d474942624fde44c364c9c249f438_VirusTotal Droidy" }, "type": "file_behaviour" } } ``` ## Relationships In addition to the previously described attributes, file behaviour objects contain relationships with other objects in our dataset that can be retrieved as explained in the [Relationships](ref:introduction-relationships) section. The following table shows a summary of available relationships. | Relationship | Return object type | | :---------------- | :---------------------------------------------------------- | | file | A single [File](ref:file-object) | | attack_techniques | A list of [Attack Techniques](ref:object-attack-techniques) |