Basic Features

Step #1 - Open /home/sandbox/sandbox/transform.cfg in a text editor

Step #2 - Modify the configuration by adding or modifying the properties on this page

Step #3 - Save the file and restart the sandbox service

Second Stage Malware Detection

Enable file downloads to detect 2nd stage malware downloaded from the Internet

runFileDownloaders=true runFileDownloaderDistributedTimeoutMs=60000 fileDownloaderMaxFileDownloads=10

Property name	Default value	Description
runFileDownloaders	true	Main switch to enable file downloads
runFileDownloaderDistributedTimeoutMs	1 minute	Execution timeout
fileDownloaderMaxFileDownloads	10	Download limit, '0' means no limit.

malwareConfigExtractionEnabled=true malwareConfigExtractionMaxInputFileSize=100

Property name	Default value	Description
malwareConfigExtractionEnabled	true	Switch to enable / disable malware config extraction
malwareConfigExtractionMaxInputFileSize	100 MB	File size limit

Enable certificate extraction for executable files and PDF documents

extractCertificates=true osslExecutionTimeout=30

Property name	Default value	Description
extractCertificates	true	Switch do enable / disable certificate extraction
osslExecutionTimeout	30 seconds	Execution timeout

Enable YARA rule matching

runYaraRulesOnInputFile=true runYaraRulesOnExtractedFiles=true yaraExecutionTimeout=30 runYaraRulesOnInputFileMaxFileSizeInMb=100

Property name	Default value	Description
runYaraRulesOnInputFile	true	Switch to enable / disable YARA rule matching
runYaraRulesOnExtractedFiles	true	Execute YARA also on extracted files
yaraExecutionTimeout	30 seconds	Execution timeout
runYaraRulesOnInputFileMaxFileSizeInMb	100 MB	File size limit, '0' means no limit

Enable text extraction from images

runTesseractOCRForImages=true tesseractExecutionTimeout=10 tesseractLimitPerTransform=5

Property name	Default value	Description
runTesseractOCRForImages	true	Switch to enable / disable OCR
tesseractExecutionTimeout	10 seconds	Execution timeout
tesseractLimitPerTransform	5	Limit: number of images to process

Enable QR code scan for images

runQRCodeScanForImages=true qrCodeScanLimitPerTransform=20

Property name	Default value	Description
runQRCodeScanForImages	true	Switch to enable / disable QR code scanning
qrCodeScanLimitPerTransform	20	Limit: number of images to process

generateTextMetrics=true generateTextMetricsNGramSize=5 generateTextMetricsIncludeTopNGrams=20

Enable text metrics generation like entropy, average word size, etc.

Property name	Default value	Description
generateTextMetrics	true	Enable / disable text metrics generation
generateTextMetricsNGramSize	5	Size of collected ngrams
generateTextMetricsIncludeTopNGrams	20	Number of considered ngrams

Enable image rendering of input file (file preview pages)

runFileVisualizer=true runFileVisualizerDistributedTimeoutMs=10000

Property name	Default value	Description
runFileVisualizer	true	Switch to enable / disable visualization
runFileVisualizerDistributedTimeoutMs	10 seconds	Execution timeout

Last updated on

Was this page helpful?