November 27, 2018

Russian anti-virus company Doctor Web presents a new version of Dr.Web vxCube 1.2—its online service for analysing malware and potentially dangerous files. Version 1.2 incorporates many features upgrades and several important fixes for identified defects.

Android application support

The new Dr.Web vxCube version knows how to analyse Android APK packages. The analysis reports for APK files are quite similar to those generated after Windows files are examined. However, they feature a number of additional sections. Specifically, the Manifest section contains the permission list and other information provided by the developer in the application's manifest file. Thus, a user can learn in advance about the system components the application will access in the course of its operation. Additional information is also available in the “Calls and SMS” and “Intents” sections. The latter provides information about application activities involving other programs.

Web threat assessment

The new version of the service uses Parental Control databases to determine how dangerous Internet sites may be. On the graph, websites are marked with red, orange, and grey (depending on how severe the threat is).

Reports redesigned

The analysis report window now provides additional information, including the file format, total analysis time, and advanced settings. It also highlights the files that were created during the examination but weren’t collected for the report. For better security, analysis reports are now provided in password-protected archives—a vxcube password must be entered before the contents can be viewed.

New file types supported

The new service version also supports BAT, SLK, CHM and IQY files. BAT files contain a series of commands that start other applications and utilities in Windows. The SLK file format is used to exchange spreadsheet and database data between Microsoft applications. CHM files usually contain Windows application help files in the HTML format. IQY files are used by Microsoft Excel. Sometimes attackers abuse them to launch malicious scripts in a target system.

Important bug fixes

Thanks to the new video and image display library, issues interfering with the viewing of video reports and screenshots in Safari have been resolved. Furthermore, service features now work better in Safari.

Numerous service defects, including issues preventing the VNC client from running continuously, have been corrected. An issue involving an incorrect number of analysed files being displayed has been resolved.

To use Dr.Web vxCube, you need a trial or a commercial license.

With a Dr.Web vxCube trial license, you can examine 10 objects in 10 days. You can give it a try here.

You can purchase a commercial license for Dr.Web vxCube in Doctor Web's eStore.

#Dr.Web #services #analysis