Skip to content
AntinomieAntinomie0.8.0 docs

Triage properties

The Properties section of Triage describes the executable that the selected run launched, using the copy Antinomie retained. This page describes Antinomie 0.8.0, which is in development; the current release is 0.7.1. The section is the same in both.

Triage Properties: Executable Verified, 129736 bytes (126.7 KB), Refresh properties and Open result directory; File identification with File type Elf Dynamic X86_64, Magic ELF 64-bit LSB shared object, x86-64, dynamically linked, stripped, and File size; Exact hashes SHA-256, SHA-1 and MD5; Similarity & classifiers with a refresh button, an ssdeep value, and TLSH and Magika Unavailable.
Antinomie 0.8.0, synthetic data.

Where it comes from

Section titled “Where it comes from”

The retained executable exists when Static Analysis was on for the launch. Without it the section says This run has no executable capture record. Enable static analysis before starting a new run. The Executable status line shows one of:

Status Meaning
Verified Captured and its digest checked
Captured Captured, not yet verified
Capture incomplete, Capture cancelled The copy is partial or was cancelled
Not recorded, Unavailable Nothing usable; the reason is shown

Properties are computed in an offline, mandatory sandbox, off the interface thread. Results are saved as properties.json beside the saved executable, so a saved result stays readable when reverification is not possible and is then marked not reverified.

What it lists

Section titled “What it lists”
Group Fields
File identification File type, Magic, File size (as 129736 bytes (126.7 KB))
Exact hashes SHA-256, SHA-1, MD5
Similarity & classifiers ssdeep, TLSH, Magika

ssdeep and TLSH are computed by Antinomie itself, so they need no tool. TLSH cannot hash a file under 50 bytes or one that is too uniform, and says so. Magika appears when it is installed (Library → Analysis tools) or on the system; otherwise it says it is not installed. A field that could not be computed reads Unavailable, and a field not tried yet reads Not computed.

Controls

Section titled “Controls”
  • Refresh properties recomputes. A section with missing values also has its own refresh control. Values already computed stay visible during a retry and survive a failed one.
  • Copy value copies one field. Copy properties as JSON copies them all.
  • Open result directory shows the saved result.

Properties never look a hash up online. They describe the file; they do not say whether it is malicious. To check the hashes against the abuse.ch datasets offline, see the IOC section’s Files tab in Network. The sample window also uses TLSH: its Similar samples lists library samples by TLSH distance.

Properties describe the copy Antinomie retained on the host. Separately, a base that offers it (one built for 0.7.0 or later) has the guest hash the image of the launched program as the kernel starts it; that SHA-256 is the Hashes field of the run’s own process_creation event in the Sigma event journal.