A collection groups different types of objects giving them some context (e.g. a phishing campaign, a malware family, etc.). Thus it usually contains various IOCs (files, URLs, domains, IP addresses), as well as references, and comments, providing even more context. ## Object attributes A Collection object contains the following attributes: - `alt_names`: \<_list of strings_> list of alternative names for the collection. Useful when describing malware families, which are usually known by several names. - `autogenerated_tags`: \<_list of strings_> relevant tags automatically generated from the aggregations. - `creation_date`: \<_integer_> creation date of the collection (UTC timestamp). - `description`: \<_string_> description of the collection. - `description_html`: \<_string_> HTML formatted description of the collection. - `domains_count`: \<_integer_> number of domains in the collection. - `files_count`: \<_integer_> number of files in the collection. - `ip_addresses_count`: \<_integer_> number of IP addresses in the collection. - `last_modification_date`: \<_integer_> date when any of the collection's attributes was last updated (UTC timestamp). - `link`: \<_string_> URL to the source's website. - `name`: \<_string_> name of the collection. - `recent_activity_relative_change`: \<_float_> ratio of change between the last two "recent activity" periods. Note: "recent activity" periods are comprised of 14 days. - `recent_activity_summary`: \<_list_of_integers_> time series representing the activity of the indicators of compromise contained in the collection (2 weeks). - `references_count`: \<_integer_> number of references in the collection. - `source_region`: \<_string_> Suspected source region of the activity described in the Collection. ISO 3166 Alpha2 - code. - `sponsor_region`: \<_string_> Suspected region sponsoring activity described in the Collection. ISO 3166 Alpha2 - code. - `status`: \<_string_> indicates if the collection has attributes pending to be computed again (e.g. top_icon_md5 after making changes). The possible values are `PENDING_RECOMPUTE` and `COMPUTED`. - `summary_stats`: \<_list of dictionaries_> stats associated with the collection. - `first_submission_date`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the first_submission_date of all the IoCs included on the collection. - `last_submission_date`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the last_submission_date of all the IoCs included on the collection. - `files_detections`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the files_detections of all the IoCs included on the collection. - `urls_detections`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the urls_detections of all the IoCs included on the collection. - `tags`: \<_list of strings_> collection's tags. - `targeted_industries`: \<_list of strings_> collection's targeted industries. - `targeted_regions`: \<_list of strings_> collection's targeted regions. ISO 3166 Alpha2 - code. - `tlp`: \<_string_> collection's traffic light protocol color. - `top_icon_md5`: \<_list of strings_> MD5 from the 3 most frequent icons among the collection (file's icons, URLs and domain's favicons). - `urls_count`: \<_integer_> number of URLs in the collection. ```json Collection object { "data": { "attributes": { "alt_names": [], "autogenerated_tags": [], "creation_date": , "description": , "description_html": , "domains_count": , "files_count": , "ip_addresses_count": , "last_modification_date": , "link": , "name": , "recent_activity_relative_change":, "recent_activity_summary":[], "references_count": , "source_region":, "sponsor_region":, "status": , "summary_stats": { "first_submission_date": { "min: , "max": , "avg": }, "last_submission_date": { "min: , "max": , "avg": }, "files_detections": { "min: , "max": , "avg": }, "urls_detections": { "min: , "max": , "avg": } } "tags": [], "targeted_industries": [], "targeted_regions": [], "tlp": , "top_icon_md5": [], "urls_count": , }, "id": , "links": { "self": "https://virustotal.com/api/v3/collections/" }, "type": "collection" } } ``` ```json Example { "data": { "attributes": { "alt_names": [ "Geodo", "Heodo" ], "autogenerated_tags": [ "cve-2018-20250", "cve-2017-11882", "upx", ], "creation_date": 1612569600, "description": "While [i]Emotet[/i] historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.\r\nIt is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.", "description_html": "While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.\r\nIt is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.", "domains_count": 0, "files_count": 3688, "ip_addresses_count": 0, "last_modification_date": 1613148085, "link": "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet", "name": "Emotet", "references_count": 129, "recent_activity_relative_change": 0.39, "recent_activity_summary": [ 30436, 26799, 27709, 29112, 26659, 29997, 18676, 35813, 28992, 33486, 24593, 25648, 26175, 29243 ], "source_region":"US", "sponsor_region":"US", "status": "COMPUTED", "tags": [ "upx" ], "targeted_industries": ["Finance"], "targeted_regions": ["US"], "tlp": "WHITE", "top_icon_md5": [ "647ca034cb6c763363b636269047a4c0", "da87510c3aabe7851c7c5d0493dbb14a", "d2d15e1e362ef2edda7238e165376112" ], "urls_count": 0 }, "id": "malpedia_win_emotet", "links": { "self": "https://virustotal.com/api/v3/collections/malpedia_win_emotet" }, "type": "collection" } } ``` ## Relationships The collection's relationships allows retrieving the objects contained in the collection as explained in the [Relationships](ref:relationships) section. The available relationships are described below. | Relationship | Return object type | | :------------------- | :------------------------------------------------ | | autogenerated_graphs | List of [Graphs](ref:graph-object) | | comments | List of [Comments](ref:comments) | | domains | List of [Domains](ref:domains-object) | | files | List of [Files](ref:files) | | ip_addresses | List of [IP addresses](ref:ip-object) | | owner | A single [User](ref:user-object) | | references | List of [References](ref:references) | | related_collections | List of [Collections](ref:collections) | | related_references | List of [References](ref:references) | | threat_actors | List of [Threat Actors](ref:threat-actors-object) | | urls | List of [URLs](ref:url-object) |