{
  "id": "malware_detection_name",
  "name": "Antivirus detection name",
  "status": "draft",
  "doc": "Name that an antivirus or anti-malware engine gives to the threat it detects in a file, URL or process, as shown in scan results, quarantine logs and the per-engine results of VirusTotal (last_analysis_results.result). Every vendor has its own scheme: most build on the CARO naming convention of type, platform, family and variant, but the order, separators and suffixes differ, and generic or machine-learning detections carry no family. The same file therefore gets different names from different engines; VirusTotal counts the tokens of these names to suggest one threat label (popular_threat_classification). The format is not fixed, so there is no regexp.",
  "categories": [
    {
      "id": "software",
      "name": "Software development"
    }
  ],
  "langs": [
    {
      "id": "common",
      "name": "Common to most languages"
    }
  ],
  "is_pii": false,
  "classification": "categorical",
  "examples": [
    {
      "value": "Gen:Variant.Marsilia.217465",
      "description": "BitDefender detection of a .NET trojan sample in VirusTotal"
    },
    {
      "value": "MSIL/Agent.YUF Trojan",
      "description": "ESET-NOD32 detection of the same sample"
    },
    {
      "value": "Backdoor.Win32.Xkcp.eas",
      "description": "Kaspersky detection of the same sample"
    },
    {
      "value": "Trojan:Win32/Wacatac.B!ml",
      "description": "Microsoft detection of the same sample (microsoft_malware_name)"
    }
  ],
  "links": [
    {
      "type": "other",
      "url": "https://virustotal.readme.io/reference/files"
    },
    {
      "type": "doc",
      "url": "https://learn.microsoft.com/en-us/defender-xdr/malware-naming"
    }
  ],
  "type": "datatype",
  "translations": {}
}