Executable details
Select an executable and click the Actions button, or click an executable > click View details.
Overview
•Original file name—The executable or DLL’s name.
•Signature type—The signature type, if signed: Trusted, Valid, None, Invalid or Unknown. The executable is signed if the value is Present, but ESET PROTECT cannot identify the certificate's status. While uncommon for Windows, on MacOS, Endpoint does not verify signatures, and the only states are Present or None.
•Signer name
•First seen—When an executable was first seen on any computer in a monitored network.
•Last executed—When an executable was last executed on any computer in a monitored network.
•SHA-256—Available when the 256-bit hash is present.
•Indicators
•ESET LiveGrid® Reputation—A number from 1 to 9, indicating how safe the file is: 1–2 (red) is malicious, 3–7 (yellow) is suspicious, 8–9 (green) is safe.
•ESET LiveGrid® Popularity—How many computers reported an executable to ESET LiveGrid®.
•First seen by ESET LiveGrid®—When an executable was first seen on any computer connected to ESET LiveGrid®.
•ESET LiveGrid® State—The executable's present station in the analysis workflow.
•Status—The behavioral analysis result or the absence of a result (Unknown/Clean/Suspicious/Highly suspicious/Malicious).
•Detection type
•Detection threshold
•Last processed on—The time when the executable was last processed.
•Behavior—The link to the executable’s behavioral report.
Description
•Names—The executable or DLL’s names.
•SHA-1—The executable's hash.
•MD5—Available when the MD5 hash is present.
•Internal name—Internal filename, if assigned; for example, an executable name if the file is a dynamic-link library. If the file has no internal name, this string will be the original filename without the file extension.
•Company name—Company that produced the file, for example, Microsoft Corporation.
•Product name—The application’s name that distributed the file.
•File version—The file’s version number, for example, "3.10" or "5.00.RC2".
•Product version—The application’s version that distributed the file.
•File size—The file size on the disk.
Properties
•Packer name—The packer’s name, if applicable.
•SFX name—Self-extracting archive type on a packed executable.
•Marked as safe—Marked as safe by users of the Web Console. If the status is No, use the action button to change.
•Blocked—Blocked by users of the Web Console.
•Nearmiss report—If the detection is triggered by malware, but we cannot guarantee it is malware.
•Whitelist type—Information for whitelisted executables:
•Certificate—The executable is whitelisted because it is signed by the trusted certificate.
•ESET LiveGrid®—The executable is whitelisted because ESET confirmed the file's trustworthiness.
Statistics
Lists statistical information about a specific executable or executable with the same file checksum.
•Executions count—Total number of executions.
•Origin processes—The Executable or DLL responsible for creating this executable.
•Origin email—The executable that comes from an email attachment. Includes information From the sender's email address, To whom it was sent and the Subject.
•Origin websites—The downloaded HTTP website URL is shown here, if applicable. HTTPS is an encrypted connection and is not recorded. This information is unavailable if you disable SSL processing in your ESET Endpoint Security application:
•Dropped executables—Number of dropped executables.
•Events/24H—Number of events within 24 hours.
Seen on Computers
Computers where the executable (based on checksum) was seen. Right-click a computer name or click the Actions button to:
•Isolate from Network
•Connect Remotely via Terminal
•Mark Executable as Safe
•Submit Executable to ESET LiveGuard
•Download Executable
•Block Executable