Read Fingerprint and At a glance#

The Overview tab opens with two cards side by side: Fingerprint on the left, At a glance on the right. They are the first read on any file, before you dig into a specialist tab.

Fingerprint#

The Fingerprint card is the file's identity in three rows: MD5, SHA-1, and SHA-256. Click any row to copy the hash to your clipboard.

These three are the universal handles you use to share the sample with another tool or a teammate. The full hash set, including SSDEEP, IMPHASH, and TLSH, lives in the Report panel on the right.

At a glance#

The At a glance card collects the facts that drive triage.

• Entropy appears as a numeric value and as a meter from 0 to 8.0. The meter has no colour: the value is the fact. The bucket label (low, normal, high, packed) is on the entropy profile in the Static tab.
• Signed is yes for an Authenticode-signed binary, no for a PE without a signature, or a dash for a non-PE file.
• Packer names the packer, if the analyser detected one.
• Imports counts PE imports. The parenthesised count gives the imports flagged as anomalous.
• Strings counts the strings of interest extracted from the file.
• Family names the first YARA rule that matched.

The card hides rows that do not apply to this file. A plain text file with no YARA matches shows only the entropy row.

When the analyser fails#

If the analyser hit an error before it produced results, a banner reading Analysis Error appears above these cards. The hint reads The analyzer didn't complete. Some sections may be empty or stale. Use Re-analyze in the queue to retry.