Malware sandbox: run malware somewhere it cannot hurt you
Samples execute on real guest operating systems under instrumentation, not in an emulator pretending to be one. The sandbox records what the sample did, and when a run captures nothing the report says so rather than reporting silence as safety.
How the sandbox works
- Full-system guests. Windows and Linux samples run on real guest images with in-guest monitoring, so packers, loaders and injected code behave as they would on a workstation. Documents and PDFs are opened in real reader applications.
- Controlled network egress. Samples reach the internet through a gated path that blocks internal ranges, cloud metadata endpoints and mail ports, and rate-limits connections. Simulated and no-network modes are selectable per submission.
- What gets captured. The process tree with command lines, API calls, files written, registry activity, screenshots, a packet capture, and memory images analysed for injection and hollowing artefacts.
- Interactive control. Some payloads need a click, a password or a specific window. Take the keyboard in a live desktop session and drive the sample while the run is still recording.
Sandbox fleet
- Windows (CAPE tier): 11 busy of 11
- QEMU/KVM (Windows + Linux): 0 busy of 20
Common questions
- Which guests can you detonate on?
- Windows and Linux run as full-system guests. Android packages are analysed statically and detonated when the Android tier is attached. There is no macOS sandbox, so Mach-O samples get static analysis and lightweight emulation only.
- Does the malware get real internet access?
- By default a sample reaches the internet through a controlled path, because most modern malware does nothing observable without its command and control server. That path blocks internal and cloud-metadata destinations, blocks mail ports, and caps connection rates.
- Why did my sample produce no behaviour?
- Usually one of three things: it is genuinely inert, it detected the analysis environment and exited, or it could not launch because the file is corrupt. The report distinguishes these rather than showing an empty section without explanation.