Skip to main content

Literally, for a first look on malware, you won't need anything special locally installed. There are enough online sandboxes you may use:

  • virustotal.com have their sandbox implemented using Cuckoo Sandbox. When you apply new sample, it automatically executed as part of analysis. After about 10-15 mins you can see the result in "Behavioural information"
  • anubis.iseclab.org is another place you may submit binary to see it behavior before executing it locally. Here you got report and pcap file of network activity, if any.

As a result - you may get basic idea of what a binary does and how to analyse it. But - please note, that sophisticated malware checks its environment for sandbox traces and VM presence. So there is a chance that the seemingly "harmless binary" turns out to be sophisticated malware under real conditions.

Denis Laskov
  • 2.4k
  • 17
  • 15