Submissions Parent topic

The Submissions screen, in Virtual Analyzer → Submissions, includes a list of samples processed by Virtual Analyzer. Samples are files and URLs submitted automatically by Trend Micro products or manually by TippingPoint Advanced Threat Protection Analyzer administrators or investigators.
The Submissions screen organizes samples into the following tabs:
  • Completed: Samples that Virtual Analyzer has analyzed
  • Processing: Samples that Virtual Analyzer is currently analyzing
  • Queued: Samples that are pending analysis
  • Unsuccessful: Samples that have gone through the analysis process but do not have analysis results due to errors
    Note
    Note
    Samples listed in the Unsuccessful are not counted by any widget.
Each tab displays a table summarizing basic information about the submitted samples. To customize which columns appear in the table, click the gear icon (gear-icon.png), select the columns to be displayed in the table, and click Apply.
The following table outlines all available columns, and includes columns which are available only on specific tabs.

Submission columns

Column
Information
Object Information
Submitted
Date and time when the sample was submitted
File Name
  • File name of the sample
  • File name of the archive / File name of highest risk child object
  • File name of the archive / File name of any child object if no risk
Note
Note
"NONAMEFL" if file size is 0 or too small for analysis
Submitter
  • Name of the Trend Micro product that submitted the sample
  • "Manual Submission" if manually submitted
Submitter Name
  • Host name of the Trend Micro product that submitted the sample
  • No data (indicated by a dash) if manually submitted
SHA-1
SHA-1 value of the sample
SHA-256
SHA-256 value of the sample
This column is available on the Completed tab only.
Object Type
File or a URL
Analysis Information
Risk Level
Virtual Analyzer performs static analysis and behavior simulation to identify a sample's characteristics. During analysis, Virtual Analyzer rates the characteristics in context and then assigns a risk level to the sample based on the accumulated ratings.
  • Red icon (grid_dot_red.png): High risk. The object exhibited highly suspicious characteristics that are commonly associated with malware.
    Examples:
    • Malware signatures; known exploit code
    • Disabling of security software agents
    • Connection to malicious network destinations
    • Self-replication; infection of other files
    • Dropping or downloading of executable files by documents
  • Yellow icon (grid_dot_yellow.png): Low risk. The object exhibited mildly suspicious characteristics that are most likely benign.
  • Green icon (grid_dot_green.png): No risk. The object did not exhibit suspicious characteristics.
  • Gray icon (grid_not_analyzed.png): Not analyzed
    For possible reasons why Virtual Analyzer did not analyze a file, see the Possible Reasons for Analysis Failure table below.
Note
Note
If several instances processed a sample, the icon for the most severe risk level displays. For example, if the risk level on one instance is yellow and then red on another, the red icon displays. Mouseover the icon for details about the risk level.
This column is available on the Completed tab only.
Completed
Date and time that sample analysis was completed
This column is available on the Completed tab only.
File Type
  • File type of the object
  • File type of the archive / File type of the highest risk child object
  • File type of the archive / File type of any child object if no risk
Note
Note
"Empty" or "UNKNOWN" if file size is 0 or too small to identify file type for analysis
This column is available on the Completed tab only.
Threat
Name of threat as detected by Trend Micro pattern files and other components
This column is available on the Completed tab only.
Threat Types
Type of threat as detected by Trend Micro pattern files and other components
This column is available on the Completed tab only.
Elapsed Time
The amount of time that has passed since processing started
This column is available on the Processing tab only.
Processed By
IP address of the node that is processing the object, if TippingPoint Advanced Threat Protection Analyzer is configured in a load-balancing cluster
This column is available on the Completed and Processing tabs only.
Priority
Priority assigned to the sample
This column is available on the Queued tab only.
Time in Queue  
The amount of time that has passed since Virtual Analyzer added the sample to the queue
This column is available on the Queued tab only.
Error Reason
Reason for analysis failure
This column is available on the Unsuccessful tab only.
Event Information
Event Logged
  • For samples submitted by other Trend Micro products, the date and time the product dispatched the sample
  • For manually submitted samples, the date and time TippingPoint Advanced Threat Protection Analyzer received the sample
Source / Sender
Where the sample originated
  • IP address for network traffic or email address for email
  • No data (indicated by a dash) if manually submitted
Destination / Recipient
Where the sample is sent
  • IP address for network traffic or email address for email
  • No data (indicated by a dash) if manually submitted
Protocol
  • Protocol used for sending the sample, such as SMTP for email or HTTP for network traffic
  • No data (indicated by a dash) if manually submitted
URL
URL of the sample
Note
Note
TippingPoint Advanced Threat Protection Analyzer may have normalized the URL when submitted using the management console.
Email Subject
Email subject of the sample
Message ID
Message ID of the sample
If the Risk Level column generates a gray icon (grid_not_analyzed.png), Virtual Analyzer has not analyzed the sample. The following table lists possible reasons for analysis failure and identifies actions you can take.

Possible Reasons for Analysis Failure

Reason
Action
Virtual Analyzer does not support the file format, or the file is empty.
Check the supported file type list in the Virtual Analyzer → Sandbox Management → Submission Settings tab.
The available sandbox images do not support the file format.
Check the sandbox image information in the Virtual Analyzer → Sandbox Management → Images tab.
The URL exceeds the limit of 2083 characters.
Verify that the URL does not exceed 2,083 characters.
The file size exceeds the limit of 60 MB.
Verify that the file size does not exceed 60MB.
Virtual Analyzer does not support the encryption or compression format.
Check the password list in the Virtual Analyzer → Sandbox Management → Archive Passwords tab.
Virtual Analyzer does not support the file format.
Unsupported file type in current sandbox image. Check the sandbox image information in the Virtual Analyzer → Sandbox Management → Images tab.
Virtual Analyzer is unable to access the Internet.
Verify the connection of the management network to the Internet.
An unexpected error has occurred on the cloud sandbox.
Please contact your support provider.
The cloud sandbox did not return an analysis result before the timeout period expired.
Resubmit the object for analysis. If the issue persists, contact your support provider.
Unable to establish a connection to the cloud sandbox.
Verify the connection of the management network to the Internet.
The URL is invalid.
Verify that the specified URL is in a valid format.
Extracted file sizes exceeds total limitation
Verify that the total file size of the extracted samples do not exceed the specified limitation.
Archive extracted for analysis. See child files.
Locate the extracted samples.
Virtual Analyzer is unable to analyze the object. The available disk space is insufficient.
Verify that the disk space is sufficient to perform the analysis.
Virtual Analyzer is unable to analyze the object within the timeout period.
Resubmit the object for analysis. If the issue persists, contact your support provider.
An unexpected error has occurred. Please resubmit the sample for analysis. If the issue persists, contact your support provider.
Resubmit the object for analysis. If the issue persists, contact your support provider.
Related information