Overview

The Lastline Analyst API provides functionality for submitting resources for analysis and obtaining the results. Currently, it supports URLs as well as various types of executables and documents.

Executables are analyzed by running them inside a sandbox, recording the behavior of the program, and classifying the file based on the observed actions. Similarly, documents are opened in an instrumented file-editor/viewer or by analyzing any active components (such as scripts) embedded inside the documents; in either case, the behavior of the code is used for detecting if the file contains any anomalies.

Additionally, the content of a submitted file is analyzed for structural similarities with other, previously classified malware artifacts.

URLs are analyzed by visiting them with special, instrumented browsers and observing actions inside the browser or its interactions with its environment.

The latest version of this documentation can be found at https://analysis.lastline.com/analysis/api-docs/html/overview.html, or downloaded in PDF format from https://analysis.lastline.com/analysis/api-docs/LastlineAnalystAPI.pdf .

Supported Artifacts

The API supports submissions of URLs and files. The maximum file size is 64 MB for the hosted Lastline infrastructure - for On-Premises deployments, the limit is configurable (up to 100MB) and defaults to 10 MB.

The following table provides an overview of the supported file types:

Lastline File Type	Lastline Mime Type	Typical Extensions	Description
AceArchiveFile	application/x-ace	.ace	ACE archive data
BzipArchiveFile	application/x-bzip	.bz2, .bz, .tbz, .tbz2	bzip2 compressed data
CabArchiveFile	application/vnd.ms-cab-compressed	.cab	Microsoft Cabinet archive data
DiagCabArchiveFile	application/vnd.ms-diagcab- compressed	.diagcab	Microsoft Diagnostic Cabinet archive data
OneNotePkgCabArchiveFile	application/vnd.ms-onepkg- compressed	.onepkg	Microsoft OneNote Package
DmgArchiveFile	application/x-apple-diskimage	.smi, .dmg	Apple disk image
Rfc2822EmailArchiveFile	data/email-rfc2822	.eml	RFC2822-formatted Email file
GzipArchiveFile	application/x-gzip	.tgz, .gz	gzip compressed data
JarArchiveFile	application/java-archive	.jar	Java JAR archive
WebappJarArchiveFile	application/war-archive	.war	Java Webapp archive
LhaArchiveFile	application/x-lha	.lzh, .lha	LHa archive data
LzmaArchiveFile	application/x-lzma	.lzma	LZMA compressed data
NugetArchiveFile	application/x-nuget	.nupkg	NuGet package archive
UDFISOArchiveFile	application/x-udf-image	.iso, .udf	UDF filesystem data
ISO9660ISOArchiveFile	application/x-iso9660-image	.iso	ISO 9660 CD-ROM filesystem data
RarArchiveFile	application/x-rar	.rar	RAR archive data
Rar5ArchiveFile	application/x-rar5	.rar	RAR archive data, version 5
TarArchiveFile	application/tar	.tar	POSIX tar archive data
DocumentLLAppBundleTarArchiveFile	application/llappbundle-document	.tar, .llappbundle, .llapp	Lastline Application Bundle Document Type
WindowsExecutableLLAppBundleTarArchiveFile	application/llappbundle-windows- executable	.tar, .llappbundle, .llapp	Lastline Application Bundle Windows Executable Type
WebReplayLLAppBundleTarArchiveFile	application/llappbundle-web-replay	.tar, .llappbundle, .llapp	Lastline Application Bundle Web Replay Type
TnefArchiveFile	application/vnd.ms-tnef	.dat	Transport Neutral Encapsulation Format
XarArchiveFile	application/x-xar	.pkg, .xar	XAR archive data
XzArchiveFile	application/x-xz	.xz, .txz	XZ compressed data
ZipArchiveFile	application/zip	.zip	Zip archive data
SevenZipArchiveFile	application/x-7z-compressed	.7z	7-zip archive data
MicrosoftSettingContentDataFile *	text/ms-settingcontent	.settingcontent-ms	Microsoft Content-Settings data file
CsvDataFile	data/csv	.csv	CSV Data
InternetInquiryDataFile *	text/x-ms-iqy	.iqy	Internet Inquiry data file
SymbolicLinkDataFile	data/symbolic-link	.slk, .sylk	Symbolic Link data file
PcapDataFile	application/vnd.tcpdump.pcap	.pcap, .pcapng	tcpdump capture file
WordHangulCdfDocFile	application/hangul-word	.hwp	Hangul Word Processor document
ChmDocFile	application/x-chm	.chm	Microsoft Windows HtmlHelp data
HangulDocFile *	application/x-hwp	.hwp	Hangul HWP3/HWP2000 document
ExcelMsMimeDocFile	application/msoffice-mime-xls	.xls	Microsoft Excel document in MHTML format
PowerpointMsMimeDocFile	application/msoffice-mime-ppt	.ppt	Microsoft Powerpoint document in MHTML format
WordMsMimeDocFile	application/msoffice-mime-doc	.doc	Microsoft Word document in MHTML format
ExcelMsDocFile	application/msoffice-xls	.xls	Microsoft Office Excel document
TemplateExcelMsDocFile	application/msoffice-xlt	.xlt	Microsoft Office Excel template document
ExcelEncryptedKnownMsDocFile	application/msoffice-xls-encrypted	.xlsx, .xls	Microsoft Office Excel document (with password)
MacroExcelEncryptedKnownMsDocFile	application/msoffice-xlam-encrypted	.xlam	Microsoft Office Excel document (with password), with macros
PowerpointEncryptedKnownMsDocFile	application/msoffice-ppt-encrypted	.pptx, .ppt	Microsoft Office Powerpoint document (with password)
WordEncryptedKnownMsDocFile	application/msoffice-doc-encrypted	.docx, .doc	Microsoft Office Word document (with password)
PowerpointMsDocFile	application/msoffice-ppt	.pps, .ppt	Microsoft Office Powerpoint document
TemplatePowerpointMsDocFile	application/msoffice-pot	.pot	Microsoft Office Powerpoint template document
WordMsDocFile	application/msoffice-doc	.doc	Microsoft Office Word document
PublisherWordMsDocFile	application/msoffice-publisher	.pub	Microsoft Publisher document
TemplateWordMsDocFile	application/msoffice-dot	.dot	Microsoft Office Word document template
OoDocFile	application/vnd.oasis.opendocument	.otp, .odp, .ods, .otg, .odt, .odg, .ott	Open/LibreOffice document
PdfDocFile	application/pdf	.pdf	PDF document
WordPerfectDocFile	application/wordperfect	.wpd	WordPerfect document
RtfDocFile	text/rtf	.rtf	RTF document
SwfDocFile	application/x-shockwave-flash	.swf	Macromedia Flash data
ExcelXmlDocFile	application/x-spreadsheetml	.xml	XML-based Microsoft Office Excel document, pre-Office2007
PowerpointXmlDocFile	application/x-presentationml	.xml	XML-based Microsoft Office Powerpoint presentation, pre-Office2007
WordXmlDocFile	application/x-wordprocessingml	.xml	XML-based Microsoft Office Word document, pre-Office2007
XdpXmlDocFile	application/vnd.adobe.xdp+xml	.xdp	Adobe XDP document
XslXmlDocFile	text/xsl	.xsl	eXtensible Stylesheet Language for XML file
ExcelMsDocxFile	application/msoffice-xlsx	.xlsx	Microsoft Office Excel document, Office Open XML format
MacroExcelMsDocxFile	application/msoffice-xlsm	.xlsm	Microsoft Office Excel document, Office Open XML format, with macros
BinaryMacroExcelMsDocxFile	application/msoffice-xlsb	.xlsb	Microsoft Office Excel document, Office Open XML format, with macros and binary storage
TemplateExcelMsDocxFile	application/msoffice-xltx	.xltx	Microsoft Office Excel template document, Office Open XML format
MacroTemplateExcelMsDocxFile	application/msoffice-xltm	.xltm	Microsoft Office Excel spreadsheet template, Office Open XML format, with macros
PowerpointMsDocxFile	application/msoffice-pptx	.pptx, .ppsx	Microsoft Office Powerpoint document, Office Open XML format
MacroAddInPowerpointMsDocxFile	application/msoffice-ppam	.ppam	Microsoft Office Powerpoint AddIn document, Office Open XML format, with macros
MacroPowerpointMsDocxFile	application/msoffice-pptm	.pptm	Microsoft Office Powerpoint document, Office Open XML format, with macros
SlideshowPowerpointMsDocxFile	application/msoffice-ppsx	.ppsx	Microsoft Office Powerpoint Slideshow, Office Open XML format
MacroSlideshowPowerpointMsDocxFile	application/msoffice-ppsm	.ppsm	Microsoft Office Powerpoint Slideshow, Office Open XML format, with macros
TemplatePowerpointMsDocxFile	application/msoffice-potx	.potx	Microsoft Office Powerpoint template document, Office Open XML format
MacroTemplatePowerpointMsDocxFile	application/msoffice-potm	.potm	Microsoft Office Powerpoint presentation template, Office Open XML format, with macros
WordMsDocxFile	application/msoffice-docx	.docx	Microsoft Office Word document, Office Open XML format
MacroWordMsDocxFile	application/msoffice-docm	.docm	Microsoft Office Word document, Office Open XML format, with macros
TemplateWordMsDocxFile	application/msoffice-dotx	.dotx	Microsoft Office Word template document, Office Open XML format
MacroTemplateWordMsDocxFile	application/msoffice-dotm	.dotm	Microsoft Office Word document template, Office Open XML format, with macros
MsXpsMsDocxFile	application/vnd.ms-xpsdocument	.xps	Microsoft XPS document
OpenXpsMsDocxFile	application/oxps	.oxps	OpenXPS document
JavaClassExeFile *	application/x-java-class	.class	compiled Java class data
ComExeFile	application/x-com	.com	COM executable for DOS
EicarComExeFile	application/x-eicar	.com	EICAR test virus
DosExeFile	application/x-dosexec	.exe	MS-DOS executable
ElfExeFile	application/x-elf	.elf	ELF executable
MsInstallerExeFile *	application/x-msi	.msi	Microsoft Installer file
LnkExeFile	application/x-ms-shortcut	.url, .lnk	Microsoft Windows shortcut
MachOExeFile	application/x-mach-o-binary	.o, .bundle, .dylib	Mach-O executable
BundleMachOExeFile	application/x-mach-o-binary-bundle	.bundle	Mach-O executable bundle
ExecutableMachOExeFile	application/x-mach-o-binary- executable	.o	Mach-O executable program
LibraryMachOExeFile	application/x-mach-o-binary-library	.o, .dylib	Mach-O executable library
PeExeFile	application/x-pe	.cpl, .cmd, .pif, .scr, .com, .bat, .exe	PE executable
RarSfxPeExeFile	application/x-rar-sfx-pe	.exe	RAR SFX PE executable
ZipSfxPeExeFile	application/x-zip-sfx-pe	.exe	Zip SFX PE executable
SevenZipSfxPeExeFile	application/x-7zip-sfx-pe	.exe	7zip SFX PE executable
LastlineTestPeExeFile	application/x-lastline-test	.dll, .sys, .exe	Lastline PE test file
MachOFatUniversalExeFile	application/x-mach-o-fat-binary	.o, .bundle, .dylib	Mach-O fat file
TiffImageFile	image/tiff	.tif, .tiff	TIFF image data
SvgXmlImageFile *	image/svg	.svg	SVG image data
AmsiJavascriptLogFile	text/javascript-amsi-log	.amsi_js	JavaScript amsi COM log
AmsiVBSLogFile	text/vbscript-amsi-log	.amsi_vbs	VBScript amsi COM log
OneNoteFile	application/onenote	.one	OneNote Document
HTAScriptFile	text/hta	.hta	HTA Script File text
VBAVisualBasicScriptFile	text/vba	.vba	Visual Basic for Applications text
VBSVisualBasicScriptFile	text/vbscript	.vbs	VBScript text
AmsiVBSVisualBasicScriptFile	text/vbscript-amsi	.amsi_vbs	VBScript amsi text
EncodedVBSVisualBasicScriptFile	application/encodedvbscript	.vbe	VBScript encoded script
BatchScriptFile	text/x-msdos-batch	.cmd, .bat	Batch script text
JavascriptScriptFile	application/javascript	.js	JavaScript text
AmsiJavascriptScriptFile	text/javascript-amsi	.amsi_js	JavaScript amsi text
EncodedJavascriptScriptFile	application/encodedjscript	.jse	JScript encoded script
PerlScriptFile	text/x-perl	.pm, .pl	Perl script text
PowershellScriptFile	text/x-powershell	.psd1, .ps1, .psm1	PowerShell text
AmsiPowershellScriptFile	text/x-powershell-amsi	.amsi_ps1	PowerShell amsi text
PythonScriptFile	text/x-python	.py	Python script text
RubyScriptFile	text/x-ruby	.rb	Ruby script text
ShellScriptFile	text/x-shellscript	.sh, .command	Shell script text
WindowsScriptFile	text/x-wsf	.wsf	Windows Script File text
InternetShortcutFile	text/x-internetshortcut	.url, .website	Internet Shortcut file
HtmlTextFile	text/html	.html, .htm	HTML document

* These file types are only supported if the Windows sandbox is configured for the requesting license. NOTE: In some cases, the Lastline mime types shown in the above list represent a unified, generalized version of standard mime types. This allows mapping different, semantically equivalent types into a single type.

The API supports the most common container formats. When submitting an container (archive or ISO, for example) file, the API will automatically attempt to extract and analyze the contained files. More precisely, the API will create a child analysis (for details, see Child Tasks) for files extracted from the container that have a supported file type. Additionally, for multi-file containers containing executables (such as programs or scripts) that should be analyzed as whole, the API attempts to generate program bundles (see Handling of Containers). For encrypted containers (such as encrypted archives), submit_file() allows you to specify a decryption password or list of potential passwords - if none is specified, the API attempts decryption using common industry-standard passwords (such as “infected”).

The API supports the following container types:

Lastline File Type	Lastline Mime Type	Typical Extensions	Description
AceArchiveFile	application/x-ace	.ace	ACE archive data
BzipArchiveFile	application/x-bzip	.bz2, .bz, .tbz, .tbz2	bzip2 compressed data
CabArchiveFile	application/vnd.ms-cab-compressed	.cab	Microsoft Cabinet archive data
DiagCabArchiveFile	application/vnd.ms-diagcab- compressed	.diagcab	Microsoft Diagnostic Cabinet archive data
OneNotePkgCabArchiveFile	application/vnd.ms-onepkg- compressed	.onepkg	Microsoft OneNote Package
GzipArchiveFile	application/x-gzip	.tgz, .gz	gzip compressed data
LhaArchiveFile	application/x-lha	.lzh, .lha	LHa archive data
LzmaArchiveFile	application/x-lzma	.lzma	LZMA compressed data
NugetArchiveFile	application/x-nuget	.nupkg	NuGet package archive
UDFISOArchiveFile	application/x-udf-image	.iso, .udf	UDF filesystem data
ISO9660ISOArchiveFile	application/x-iso9660-image	.iso	ISO 9660 CD-ROM filesystem data
RarArchiveFile	application/x-rar	.rar	RAR archive data
Rar5ArchiveFile	application/x-rar5	.rar	RAR archive data, version 5
TarArchiveFile	application/tar	.tar	POSIX tar archive data
XzArchiveFile	application/x-xz	.xz, .txz	XZ compressed data
ZipArchiveFile	application/zip	.zip	Zip archive data
SevenZipArchiveFile	application/x-7z-compressed	.7z	7-zip archive data
RarSfxPeExeFile	application/x-rar-sfx-pe	.exe	RAR SFX PE executable
ZipSfxPeExeFile	application/x-zip-sfx-pe	.exe	Zip SFX PE executable
SevenZipSfxPeExeFile	application/x-7zip-sfx-pe	.exe	7zip SFX PE executable

NOTE: In some cases, the Lastline mime types shown in the above list represent a unified, generalized version of standard mime types. This allows mapping different, semantically equivalent types into a single type.

Getting Started

The Analyst API is a web-based API. To get started using it, you will need to request an API key and API token from Lastline. These will act as your credentials for accessing the API.

For clients accessing the API hosted in a Lastline datacenter, the API is reachable at https://analysis.lastline.com. For clients using an On-Premises deployment, the API is reachable using the URL https://log.<fqdn>/analysis on Lastline Enterprise Manager or Pinbox appliances, and the URL https://<fqdn>/analysis for Lastline Analyst appliances.

In addition to the full API Reference, this documentation also provides two Sample API Clients for accessing this API. These are written in Python. One of them is also available as a self-contained Microsoft Windows executable.

API Concepts

The Lastline Analyst API is an asynchronous API, in the sense that, when a resource (a file or a URL) is submitted for analysis, the analysis results are typically not returned immediately in the response. Instead, a unique identifier (UUID) for the submitted analysis task is returned. This UUID can later be used in a separate request to get the analysis results for this task.

The reason for this approach is that analyzing a resource can take some time. For instance, analyzing an executable requires running it for several minutes in an analysis sandbox.

However, in some cases the submitted resource may have been already analyzed by the analysis platform. In these cases, the API is able to immediately return an analysis result.

Workflow

The expected usage of this API is to follow these steps:

1. Call submit_file() or submit_url() several times to submit a number of artifacts, and store the returned task UUIDs.
2. Call get_completed() to get the UUIDs of tasks completed since the last time get_completed() was called.
3. Call get_result() on returned UUIDs to obtain results.
4. Repeat steps 2 and 3 until results are available for all UUIDs.

Using the get_completed() function avoids polling for results for each submission individually by repeatedly calling the get_result() function until results are available, which is very inefficient and may be enforced by the API: if a client makes too many calls to get_result() on incomplete tasks, it may be blocked from making further calls due to violations of this protocol.

Note that the submit_file() and submit_url() functions may immediately return an analysis result, in which case the call to get_result() is not necessary (the UUID will still be returned by get_completed()). If a client does not require the detailed analysis results at time of the submission, specify the full_report_score parameter. Further, the API allows submitting a file by-hash if the file is already available in the analysis system, avoiding an unnecessary upload of the file-content; see submit_file() for details.

Handling of Containers

The API analyzes submissions of archives or other containers by treating these types of files as closely as possible to how a real user would: the system tries to understand how a real victim would behave when receiving the file.

For example, when the system finds a document inside an archive, this document is sent for deeper analysis “by itself”, as documents typically are self-contained elements.

A different example is when the API handles archives with multiple programs, or when a program is shipped with additional files (such as configuration files or program libraries). In this case, it is often not meaningful to analyze each program individually, as one would expect the first program to call the other, read the configuration file embedded in the archive, or load the program library. Thus, the program would most likely fail to run successfully if analyzed “by itself” (otherwise one would not expect these files to be distributed together in the same archive).

Thus, the API may analyze this type of container containing multiple files via program bundles: all files in the container are copied into the analysis system, and metadata embedded in the bundle describes how to launch these files. If more than one program is found and the system cannot identify which program to launch as “main” subject of the analysis, multiple bundle analysis runs are triggered.

For details on program bundles, see Application Bundle Module.