# Kesakode lookup

The Kesakode lookup view is accessed using the `F11` shortcut in Full & Pro versions of Malcat. It displays the scan results of several online scan services for the current file. Kesakode queries are performed on demand, either from the Summary view or using the shortcut ``Ctrl`+`K``.

It can be used to match known functions, strings and constant sets against a database of known clean, malware and library files. The Kesakode service can be used in various situation, such as:

- identify unpacked (e.g. a sandbox dump) malware samples

- show similarities shared between malware families

- assist in the creation of better Yara rules

- speed up reverse engineering by identifying know libraries / runtime code

During the whole process, only hashes are sent to our platform, your sample never leaves your computer. For more information on the technology, see Kesakode.

## Running Kesakode

There are three types of Kesakode lookups:

- Offline lookups, which use the malware-only database stored in `data/kesakode/`. This type of query is fast, disconnected, but is less precise and not very up-to-date (the database gets updated with every new Malcat release only). Additionally, results are limited to malware hits (i.e. no library/clean classification).

- Online lookups, which use our large online Kesakode database. You will get all classification labels (including clean/lib) and the most recent detection.

- Thrid-party lookups are using External Kesakode providers (e.g. Intezer) to perform the lookups

A Kesakode offline lookup is performed automatically with every analysis (unless deactivated in the Changing options).

In contrary, Kesakode online queries are performed on demand. You can initiate one either from the Summary view (using the ``Kesakode` `lookup`` button) or using the shortcut ``Ctrl`+`K`` from any view. This will consume one query of your monthly quota (see Kesakode frequently asked questions).

Note

You need a running license of Malcat, i.e you must be within the 1 year update period, to run online Kesakode queries.

Finally Thrid-party lookups are also performed on-demand, and only if the user actively changed the source using the dropdown button located in the toolbar of this view. How they work can vary depending on the selected provider.

Warning

While Malcat’s online Kesakode queries only submit hashes for identification, third-party providers may function differently. These providers have access to the whole analysis and file objects, they may upload the whole file for analysis. Keep it in minde if privacy is of value to you.

Once the query has finished (you can monitor the progress through the statusbar’s gauge control), Malcat will automatically open the Kesakode lookup view.

## Displaying results

On the top of the Kesakode view, you will find a global attribution graph, that shows you the best malware family candidates that your sample is likely to belong to. If you want to dive deeper into Kesakode results, you can explore the data three separate tabs:

- Function matches (shows which function hashes were found in out database)

- Strings matches (shows which string hashes were found in out database)

- Constant fuzzy match (shows a similarity score computed over the set of all constants)

Clicking on any result which is associated to one or more malware families will addionally display information (taken from Malpedia) about the matching families in the right panel:

Kesakode helping to identify your sample

In the functions and strings tabs, clicking on a result will display the corresponding string / function in the quickview tab. Double-clicking a row will jump to the corresponding string / function in either the Hexadecimal view or the Disassembly view. The function / string context menu is also available through right-clicking.

## Effects on other views

Once a Kesakode lookup has been performed, Kesakode information such has the danger level of functions and strings is also available to and displayed in other views. For instance, known malicious functions will be colored in red in the Hexadecimal view and the Structure/text view, libraries in blue, while known clean functions will be shown in green (this can be toggled on or off via the Highlighting menu).

In a similar manner, the Strings list will also display Kesakode danger levels using the same color scheme, alongside threat information from the Anomaly scanner and Yara signatures. This should help you selecter better string candidates for your Yara rule.

Kesakode results displayed in other views

The Disassembly view also displays Kesakode information at call sites using a similar color scheme. The interprocedural call graph can also display this information, to help you naviguate quicker to the interesting parts of the analyzed file:

Kesakode information in code views

This is particularly useful when dealing with statically linked programs (you can ignore known libraries) or around program entry points (you can ignore most runtime startup code).

## Submitting false positives/negatives

While Kesakode works fine, it is still in its early development stage and its database may have blind spots. By chance, Malcat makes it really easy for you to deal with missed malware (false negaives) or wrognly detected cleanware (false positives). If you encounter any of these, just click on the ``Upload` `FP/FN`` button:

How to submit a false postive / false negative

This will send your sample to our server where it will be stored, manually reviewed and eventually used in the next Kesakode indexation. This process can span over several days, so don’t be too impatient! But at the end, this will ensure that Kesakode’s detection rate keeps improving!

Warning

Since your sample will be sent to us, a third party, please make sure that you are allowed to share the sample. Also for malicious samples, don’t send packed malware, only dumped/unpacked ones, as the former can’t be used by Kesakode.