Supported File Types
Any file (below the size limit) can be submitted to MetaDefender Sandbox for analysis.
The following table shows the most prevalent file types that are officially supported. For unlisted file types, the analysis results may be less accurate.
| File Type | Static Analysis | Dynamic Analysis | OS | Comment |
|---|---|---|---|---|
| A3X | Windows | |||
| APK | Android | |||
| ASF | Windows | Windows Media Video | ||
| AU3 | Windows | |||
| BAT | Windows | |||
| CPL | Windows | |||
| DOC | Windows | |||
| DOCM | Windows | |||
| DOCX | Windows | |||
| DOT | Windows | |||
| DOTM | Windows | |||
| DOTX | Windows | |||
| DWG | Windows | VBA macro extraction | ||
| ELF | Unix | |||
| EML | Windows | |||
| HTA | Windows | |||
| HTML | Windows | |||
| HWP | Windows | Hangul Word Processor | ||
| Java | Multi-OS | Java Decompilation & re-analysis | ||
| JScript | Windows | |||
| JSE | Windows | |||
| LNK | Windows | |||
| MBOX | Windows | |||
| MSC | Windows | |||
| MSI | Windows | |||
| ODS | Windows | |||
| ODT | Windows | |||
| OLE | Windows | |||
| ONE | Windows | Microsoft OneNote exported section | ||
| Multi-OS | ||||
| PE (EXE/DLL) | Windows | PE unpacking & re-analysis | ||
| PE (dotnet_pe) | Windows | PE.NET decompilation & re-analysis | ||
| PE (other) | Windows | Other specific PE types (SFX, Golang, Rust, etc.) | ||
| POT | Windows | |||
| POTM | Windows | |||
| POTX | Windows | |||
| PowerShell | Windows | |||
| PPAM | Windows | |||
| PPSX | Windows | |||
| PPT | Windows | |||
| PPTM | Windows | |||
| PPTX | Windows | |||
| PUB | Windows | |||
| RFC822 | Windows | |||
| RTF | Windows | |||
| SCT | Windows | |||
| SVG | Windows | |||
| TXT | Windows | |||
| VBScript | Windows | |||
| WSF | Windows | |||
| XLS | Windows | |||
| XLSM | Windows | |||
| XLSX | Windows | |||
| XLTM | Windows | |||
| XLTX | Windows |
Note: The MIME type is detected automatically regardless of the provided file suffix.
* if the file contains objects that have dedicated dynamic analysis support (e.g. JavaScript in PDF)
** Read more about supported unpackers and full overview of executable capabilities available here
Archive Files
| Supported Archive Types | Archives extraction | Type-specific analysis | Comment |
|---|---|---|---|
| 7Z | |||
| ACE | |||
| BZIP2/BZ2 | |||
| CAB | Requires version 1.6.1 or later | ||
| CHM | |||
| DEB | |||
| GTAR | |||
| GZIP | |||
| LZIP | |||
| ISO | |||
| PKG (NodeJS) | |||
| RAR | |||
| SFX (PEEXE) | |||
| TBZ2 | |||
| TAR | |||
| TGZ | |||
| TXZ | |||
| MSU | |||
| VHD | Requires 1.6.3 or later | ||
| WHL | |||
| XPI | |||
| ZIP | |||
| ZIPX |
* The most relevant files are identified and extracted, along with the file list. But not all of the contained files.
Maximum File Size:
Starting with v1.7.0 the maximum file size is 2000 MB.
Note: All file size limits can be configured.
Maximum parallel uploads
Maximum parallel uploads - as part of an archive - from v1.7.0:
- 1000 executables,
- 10 documents,
- 10 other