{
  "$id": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/sdos/malware-analysis.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "malware-analysis",
  "description": "Malware Analysis captures the metadata and results of a particular analysis performed (static or dynamic) on the malware instance or family.",
  "type": "object",
  "allOf": [
    {
      "$ref": "../common/core.json"
    },
    {
      "properties": {
        "type": {
          "type": "string",
          "description": "The type of this object, which MUST be the literal `malware-analysis`.",
          "enum": [
            "malware-analysis"
          ]
        },
        "id": {
          "title": "id",
          "pattern": "^malware-analysis--"
        },
        "product": {
          "type": "string",
          "description": "The name of the analysis engine or product that was used for this analysis."
        },
        "version": {
          "type": "string",
          "description": "The version of the analysis product that was used to perform this analysis."
        },
        "configuration_version": {
          "type": "string",
          "description": "The version of the analysis product configuration that was used to perform this analysis."
        },
        "modules": {
          "type" : "array",
          "items": {
            "type": "string"
          },
          "description": "The particular analysis product modules that were used to perform the analysis.",
          "minItems": 1
        },
        "analysis_engine_version": {
          "type": "string",
          "description": "The version of the analysis engine or product that was used to perform this analysis."
        },
        "analysis_definition_version": {
          "type": "string",
          "description": "The version of the analysis definitions used by the analysis tool."
        },
        "submitted": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that this malware was first submitted for scanning or analysis."
        },
        "analysis_started": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that the malware analysis was initiated."
        },
        "analysis_ended": {
          "$ref": "../common/timestamp.json",
          "description": "The date and time that the malware analysis ended."
        },
        "result_name": {
          "type": "string",
          "description": "The classification result or name assigned to the malware instance by the scanner tool."
        },
        "result": {
          "type": "string",
          "description": "The classification result as determined by the scanner or tool analysis process."
        },
        "host_vm_ref": {
          "description": "A description of the virtual machine environment used to host the guest operating system (if applicable) that was used for the dynamic analysis of the malware instance or family.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "pattern": "^software--"
            }
          ]
        },
        "operating_system_ref": {
          "description": "The operating system that was used to perform the dynamic analysis.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "pattern": "^software--"
            }
          ]
        },
        "installed_software_refs": {
          "type": "array",
          "description": "Any non-standard software installed on the operating system used for the dynamic analysis of the malware instance or family.",
          "items": {
            "allOf": [
              {
                "$ref": "../common/identifier.json"
              },
              {
                "pattern": "^software--"
              }
            ]
          },
          "minItems": 1
        },
        "analysis_sco_refs": {
          "type": "array",
          "description": "The list of STIX objects that were captured during the analysis process.",
          "items": {
            "$ref": "../common/identifier.json"
          },
          "minItems": 1
        },
        "sample_ref": {
          "description": "Refers to the object this analysis was performed against.",
          "allOf": [
            {
              "$ref": "../common/identifier.json"
            },
            {
              "oneOf": [
                {
                  "pattern": "^artifact--"
                },
                {
                  "pattern": "^file--"
                },
                {
                  "pattern": "^network-traffic--"
                }
              ]
            }
          ]
        }
      }
    }
  ],
  "required": [
    "product"
  ],
  "anyOf": [
    {"required": ["result"]},
    {"required": ["analysis_sco_refs"]}
  ],
  "definitions": {
    "malware-av-result-ov": {
      "type": "string",
      "enum": [
        "malicious",
        "suspicious",
        "benign",
        "unknown"
      ]
    }
  }
}
