Verdicts to tag a sample from sandbox behaviour
verdicts
contains a list of maliciousness classifications for the file under study based on its behaviour. It is a list of strings, that can contain any of the following:
CLEAN
clean, whitelisted or undetected.MALWARE
should be detected as malware.GREYWARE
PUA, PUP (possibly unwanted program).RANSOM
Ransom or crypter.PHISHING
Tries to phish the user or deceive him to steel his credentials.BANKER
banking trojan malware.ADWARE
displays unwanted advertisements.EXPLOIT
contains or runs an exploit.EVADER
contains logic to evade analysis.RAT
remote access trojan, may listen for inbound connections.TROJAN
trojan or bot.SPREADER
spreads to USB, other drives, network, etc. Work-like functionality.
{
"data": {
"attributes": {
"verdicts": [
"<string>"
]
}
}
}
{
"data": {
"attributes": {
"verdicts": [
"MALWARE"
]
}
}
}