Email Attachments Scanning Details
To access this page, navigate to Monitor > Files > Email Attachments. Click on the File Hash link in File Analysis tab to go to the Files Details page.
Use this page to view analysis information and malware behavior summaries for the downloaded file. This page is divided into several sections:
Report False Positives—Click the Report False Positive button to launch a new screen which lets you send a report to Juniper Networks, informing Juniper of a false position or a false negative. Juniper will investigate the report, however, this does not change the verdict. If you want to make a correction (mark system as clean) you must do it manually.
Download STIX Report—
When there is a STIX report available, a download link appears on this page. Click the link to view gathered, open-source threat information, such as blocklisted files, addresses and URLs. STIX (Structured Threat Information eXpression) is a language used for reporting and sharing threat information using TAXII (Trusted Automated eXchange of Indicator Information). TAXII is the protocol for communication over HTTPS of threat information between parties.
STIX and TAXII are an open community-driven effort of specifications that assist with the automated exchange of threat information. This allows threat information to be represented in a standardized format for sharing and consuming. Juniper ATP Cloud uses this information as well as other sources. This occurs automatically. There is no administrator configuration required for STIX.
Juniper ATP Cloud can also share threat intelligence. You can control what threat information is shared from the Threat Sharing page. See Configure Threat Intelligence Sharing.
Download Zipped Files—(When available) Click this link to download the quarantined malware for analysis. The link allows you to download a password-protected zipped file containing the malware. The password for the zip file is the SHA256 hash of the malware exe file (64 characters long, alpha numeric string) shown in the General tab in the Juniper ATP Cloud UI for the file in question.
The top of the page provides a quick view of the following information (scroll to the right in the UI to see more boxes):
Threat Level—This is the threat level assigned (0-10), This box also provides the threat category and the action taken.
Top Indicators—In this box, you will find the malware name, the signature it matches, and the IP address/URL from which the file originated.
Prevalence—This box provides information on how often this malware has been seen, how many individual hosts on the network downloaded the file, and the protocol used.
File Summary
Field |
Definition |
|---|---|
Threat Level |
This is the assigned threat level 0-10. 10 is the most malicious. |
Action Taken |
The action taken based on the threat level and host settings: block or permit. |
Global Prevalence |
How often this file has been seen across different customers. |
Last Scanned |
The time and date of the last scan to detect the suspicious file. |
File Name |
The name of the suspicious file. Examples: unzipper-setup.exe, 20160223158005.exe,, wordmui.msi. |
Category |
The type of file. Examples: PDF, executable, document. |
File Size |
The size of the downloaded file. |
Platform |
The target operating system of the file. Example. Win32 |
Malware Name |
If possible, Juniper ATP Cloud determines the name of the malware. |
Type |
If possible, Juniper ATP Cloud determines the type of threat. Example: Trojan, Application, Adware. |
Strain |
If possible, Juniper ATP Cloud determines the strain of malware detected. Example: Outbrowse.1198, Visicom.E, Flystudio. |
|
Other Details |
|
sha256 and md5 |
One way to determine whether a file is malware is to calculate a checksum for the file and then query to see if the file has previously been identified as malware. |
In the Network Activity section, you can view information in the following tabs:
This section will appear blank if there has been no network activity.
Contacted Domains—If available, lists any domains that were contacted while executing the file in the Juniper ATP Cloud sandbox.
Contacted IPs—If available, lists all IPs that were contacted while executing the file, along with the destination IP’s country, ASN, and reputation. The reputation field is based on Juniper IP intelligence data destination.
DNS Activity— This tab lists DNS activity while executing the file, including reverse lookup to find the domain name of externally contacted servers. This tab also provides the known reputation of the destination servers.
In the Behavior Details section, you can view the behavior of the file on the system. This includes any processes that were started, files that were dropped, and network activity seen during the execution of the file. Dropped files are any additional files that were downloaded and installed by the original file.