--- id: "malware_detection_name" kind: "datatype" status: "draft" is_pii: false categories: ["software"] langs: ["common"] quality: 50 url: "https://registry.apicrafter.io/datatype/malware_detection_name" --- # Antivirus detection name (`malware_detection_name`) > **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions. Name that an antivirus or anti-malware engine gives to the threat it detects in a file, URL or process, as shown in scan results, quarantine logs and the per-engine results of VirusTotal (last_analysis_results.result). Every vendor has its own scheme: most build on the CARO naming convention of type, platform, family and variant, but the order, separators and suffixes differ, and generic or machine-learning detections carry no family. The same file therefore gets different names from different engines; VirusTotal counts the tokens of these names to suggest one threat label (popular_threat_classification). The format is not fixed, so there is no regexp. - Personal data (PII): no - Categories: Software development (software) - Countries: global - Languages: Common to most languages (common) - Classification: categorical ## Examples - `Gen:Variant.Marsilia.217465` — BitDefender detection of a .NET trojan sample in VirusTotal - `MSIL/Agent.YUF Trojan` — ESET-NOD32 detection of the same sample - `Backdoor.Win32.Xkcp.eas` — Kaspersky detection of the same sample - `Trojan:Win32/Wacatac.B!ml` — Microsoft detection of the same sample (microsoft_malware_name) ## Sources - other: - doc: ## Quality Score 50/100. Missing: regexp, negative example, mapping (Wikidata, Schema.org, ...), translation, detector coverage. JSON: · Edit: