The file type, High Risk Downloader for example.

The name of the virus.

Select to view the FortiGuard Encyclopedia analysis of the file if the file has a Malicious rating. This page provides analysis details, detection information, and recommended actions.

Select to mark the file as clean (false positive) or suspicious (false negative). This field is dependent on the file risk type. In the Apply Override Verdict dialog box type a comment and select Submit or Submit feedback to Cloud to send the file to the FortiGuard team for analysis.

After a file has an overridden verdict, its future rating will be the overridden one until you reset the verdict.

After a file's verdict is overridden, the job will be listed in the Scan Profile > Overridden Verdicts page for easy tracking.

Export the job details to a PDF report.

Download the password protected original file (.zip format) to your management computer for further analysis. The default password for this file is fortisandbox.

Caution: The original file should only be unzipped on a management computer in an analysis environment.

The date and time the file was received by FortiSandbox.

The date and time the scan started and the timezone.

The status of the scan. Status: Done, Canceled, Skipped, and Timed Out.

Which scan module made the rating decision, such as the AV Scanner, FortiSandbox Community Cloud, Static File Scan or VM Engine.

The input source of the file such as FortiMail.

The malware host IP address.

The IP address of the client that downloaded the virus.

The digital signature availability status of the scanned file.

When available, the scan bypass configuration will be displayed.

When the scan was done, its SIMNET is on.

By clicking the Virus Total link, a new page will open to query https://www.virustotal.com.

Only a limited number of queries per minute is allowed without manual interaction with the Virus Total website.

Click the link to view the original job if this one is an AV rescan or On-Demand rescan job.

View additional file information including the following: Packers, File Type, Downloaded From, File Size, Service, MD5, SHA1, SHA256, ID, Submitted By, Submitted Filename, Filename, Received, Scan Start Time, VM Scan Start Time, VM Scan End Time, VM Scan Time, Scan End Time, Total Scan Time, Scan Unit, Launched OS, and Infected OS.

If the file is from FortiMail, Email related information, such as the Email Sender, Receiver, and Subject will also be shown.

A summary of the Malware's behavior indicators if there are any.

View the following analysis details for each Detection OS that is launched during the scan. Each Detection OS's detail will be shown in a separate tab. The Infected OS will have a VM Infected icon in its tab title.

If the Malware is detected by non-Sandboxing scan, such as FortiGuard static scan, the tab title is displayed as N/A.

View the file's behavior over time and its density during its execution.

Clean behaviors: green bubble.

Suspicious behaviors: red, blue, or orange bubble.

The higher the bubble, the more serious the event is.

To view the event details, hover the mouse on top of the bubble.

If a file scan is scanned with more than one VM type, the VM tab will dynamically switch to the chart for that type.

If the file hits any imported YARA rule, a YARA tab will appear with detailed information. including:

• The hit rule
• Rule's risk level
• Rule set name
• Link to original YARA rule file

Select the Captured Packets button to download the tracer PCAP file to your management computer.The packet capture (PCAP) file contains network traffic initiated by the file. You must have a network protocol analyzer installed on your management computer to view this file.

The Captured Packets button is not available for all file types.

Download the compressed .tar file containing the tracer log and related files. The password protected /backup folder in the tracer log contains information about the program’s execution. The default password for this file is fortisandbox.

Caution: The tracer log should only be unzipped on a management computer in an analysis environment.

To see all dropped files by the file being scanned, use the -g argument. This generates a file named filemap.txt in the backup directory of the tracer package.

A text file containing detailed information collected inside the Sandbox VM.

Download the IOC in STIX2 format.

Download a screenshot image when the file was running in the sandbox. This image is not always available.

If the file hits FortiSandbox internal YARA rules, detailed information is displayed.

Suspicious indicators detected by FortiGuard advanced Office file static scan engine.

Suspicious indicators detected by FortiGuard advanced Web file static scan engine.

A summary of behavior indicators, if available.

When detailed information is available below, a question mark icon is displayed. When clicked, detailed information is displayed. For some operations, such as File Operations, users can download files in a password protected ZIP format.

Displays malware's attack techniques and tactics.

By default, a light version is displayed. Click the toggle button to swap between the Lite Matrix and Full Matrix.

The botnet name and target IP address.

The executable has been observed to drop some files.

Click the Files Created dropdown icon to view the files created by the file. This field may not be available for all file types.

This executable has been observed to delete some files.

Click the Files Deleted dropdown icon to view the files deleted by the file. This field may not be available for all file types.

The executable file has been observed to modify some files.

The executable spawns some processes.

Click the Launched Processes dropdown icon to view the processes launched by the file. This field may not be available for all file types.

The executable applies autostart registry modifications to be able to start itself automatically.

Click the Registry Changes dropdown icon to view the registry changed made by the file. This field may not be available for all file types.

Users that are infected by this executable will notice HTTP connections with certain URL/IP addresses.

Click the Network Behaviors dropdown icon to view the network behavior of the file. This field may not be available for all file types.

For certain document files, if they contain malicious URLs, those URLs are displayed here. Users can select a URL to display its detailed information, like rating history and visit volume history.

The executable file's behavior during execution, in time sequence.

The tracer/rating package version is displayed at the bottom of the job detail page and in the PDF Report.

Click the print icon to print the malware details page information.