Express Malware Analysis

Go to Virtual Security Analysis > Express Malware Analysis to quickly upload a file and get the verdict. Express Malware Analysis is supported in both the GUI and the API. The default file size limit is 200MB. The file size limit can be changed using the CLI.

For information about using the API to submit files, see Appendix A: API guide > Submit files.

Express Malware Analysis is not available in Center mode.

To submit a file for Express Malware Analysis:

1. Go to Virtual Security Analyst > Express Malware Analysis. The Submit New File window opens.

   

2. Submit a file for analysis. The default file size limit is 200MB. The file size limit can be changed using the CLI.
   1. Click Upload then navigate to the file location on your device and click Open.
   2. In the Password field, enter the password for the file. If the file does not require a password, FortiNDR will use Infected by default. The Password field is displayed whether the file requires a password or not.
   3. Click OK. The verdict is displayed.

      Submission Time	The date and time the file was uploaded.
      Submitted Filename	The name of the file that was uploaded.
      Submission User	The user that submitted the file.
      MD5	The verdict result from MD5 checksum of the file.
      Verdict	The attack scenario used to identify the malware attack.
      Confidence	The confidence level as a percentage.
      Risk	The risk verdict (High, Medium, Low or No Risk).
      Status	The submission status.
      File Type	The file type such as Zip or PE. Other indicates the detected file type is not supported by Artificial Neural Networks (ANN).
      Indicator	Indicates the detection has IOC details.

3. Click View Sample Detail to view the sample information. This page explains the verdict by showing the feature composition of the file.

   There are four tabs at the bottom of the page:

   Tab	Description
   History	Displays the history of the same malware (by hash) on the network. FortiNDR does not go back and rescan files based on the previous verdict. If you want to rescan a file based on the latest ANN, use manual or API upload instead.
   Similar files	FortiNDR has a similar engine analysis based on the features detected. This is useful for detecting similar variants of the original malware.
   MITRE information (and Investigator view)	For Portable Executable (PE ) files, FortiNDR can display a drill down of the MITRE ATT&CK matrix that shows the TTPs used for a particular malware.
   IOC (Indicators of Compromise)	For text-based malware, FortiNDR can display more contextual information of malware, such as file contain abnormal javascipt, and so on. This helps you understand why FortiNDR determines it is malware.

   

   When a zip file is uploaded, double-click the entry to view the contents and verdict of the files.

   

4. (Optional) Click Generate Reportto view the report summary in PDF and JSON format.

To change the file size limit with the CLI:

execute file-size-threshold

Configuring the table

You can show or hide columns by clicking the gear icon in the header.

Click Configure Table to select the columns you want to show or hide.