Supported File Types

Info

MetaDefender Sandbox accepts files below the size limit for analysis. The table below lists the most prevalent file types officially supported. Unlisted file types may yield less accurate analysis results.

File Type	Static Analysis	Dynamic Analysis	OS	Comment
A3X	Yes	No	Windows
APK	Yes	No	Android
ASF	Yes	No	Windows	Windows Media Video
AU3	Yes	No	Windows
BAT	Yes	Yes	Windows
CPL	Yes	No	Windows
DOC	Yes	Yes	Windows	Microsoft Word 97-2003 Document (.doc)
DOC95	Yes	No	Windows	Microsoft Word 95 Document (.doc)
DOCM	Yes	Yes	Windows	Microsoft Word Macro-Enabled Document (.docm)
DOCX	Yes	Yes	Windows	Microsoft Word Document (.docx)
DOT	Yes	Yes	Windows	Microsoft Word 97-2003 Template (.dot)
DOT95	Yes	No	Windows	Microsoft Word 95 Template (.dot)
DOTM	Yes	Yes	Windows	Microsoft Word Macro-Enabled Template (.dotm)
DOTX	Yes	Yes	Windows	Microsoft Word Template (.dotx)
DWG	Yes	No	Windows	VBA macro extraction
ELF	Yes	No	Unix
EML	Yes	Yes, limited*	Windows
HTA	Yes	Yes	Windows
HTML	Yes	Yes, limited*	Windows
HWP	Yes	Yes	Windows	Hangul Word Processor
Java	Yes	No	Multi-OS	Java Decompilation & re-analysis
JScript	Yes	Yes	Windows
JSE	Yes	Yes	Windows
LNK	Yes	Yes	Windows
MBOX	Yes	Yes	Windows
MSC	Yes	Yes	Windows
MSG	Yes	No	Windows
MSI	Yes	No	Windows
ODF	Yes	No	Multi-OS
ODS	Yes	No	Windows
ODT	Yes	No	Windows
OLE	Yes	Yes	Windows
ONE	Yes	Yes, limited*	Windows	Microsoft OneNote exported section
PDF	Yes	Yes, limited*	Multi-OS
PE (EXE/DLL)	Yes	Yes, limited**	Windows	PE unpacking & re-analysis
PE (dotnet_pe)	Yes	Yes, limited**	Windows	PE.NET decompilation & re-analysis
PE (other)	Yes	Yes, limited**	Windows	Other specific PE types (SFX, Golang, Rust, etc.)
Pickle	Yes	No	Multi-OS
POT	Yes	Yes	Windows
POTM	Yes	Yes	Windows
POTX	Yes	Yes	Windows
PowerShell	Yes	Yes	Windows
PPAM	Yes	Yes	Windows
PPSX	Yes	Yes	Windows	Microsoft PowerPoint Slide Show (.ppsx)
PPT	Yes	Yes	Windows	Microsoft PowerPoint 97-2003 Presentation (.ppt)
PPT95	Yes	No	Windows	Microsoft PowerPoint 95 Presentation (.ppt)
PPTM	Yes	Yes	Windows	Microsoft PowerPoint Macro-Enabled Presentation (.pptm)
PPTX	Yes	Yes	Windows	Microsoft PowerPoint Presentation (.pptx)
PUB	Yes	Yes	Windows
RFC822	Yes	No	Windows
RTF	Yes	Yes	Windows
SCT	Yes	Yes	Windows
SVG	Yes	Yes, limited*	Windows
TXT	Yes	Yes	Windows
VBScript	Yes	Yes	Windows
WSF	Yes	Yes	Windows
XLS	Yes	Yes	Windows	Microsoft Excel 97-2003 Workbook (.xls)
XLS95	Yes	No	Windows	Microsoft Excel 95 Workbook (.xls)
XLSM	Yes	Yes	Windows	Microsoft Excel Macro-Enabled Workbook (.xlsm)
XLSX	Yes	Yes	Windows	Microsoft Excel Workbook (.xlsx)
XLTM	Yes	Yes	Windows	Microsoft Excel Macro-Enabled Template (.xltm)
XLTX	Yes	Yes	Windows	Microsoft Excel Macro-Enabled Template (.xltm)

Note: The MIME type is detected automatically regardless of the provided file suffix.

* if the file contains objects that have dedicated dynamic analysis support (e.g. JavaScript in PDF)

** Read more about supported unpackers and full overview of executable capabilities available here

Archive Files

Supported Archive Types	Archives extraction	Type-specific analysis	Comment
7Z	Yes	N/A
ACE	Yes	N/A
BZIP2/BZ2	Yes	N/A
CAB	No	Yes	Requires version 1.6.1 or later
CHM	No	Yes
DEB	Yes*	Yes
GTAR	Yes	N/A
GZIP	Yes	N/A
LZIP	Yes	N/A
ISO	Yes	No
PKG (NodeJS)	Yes	No
RAR	Yes	N/A
SFX (PEEXE)	Yes	Yes
TBZ2	Yes	N/A
TAR	Yes	N/A
TGZ	Yes	N/A
TXZ	Yes	N/A
MSU	Yes	No
VHD	Yes	N/A	Requires 1.6.3 or later
WHL	Yes	No
XPI	Yes	No
ZIP	Yes	N/A
ZIPX	Yes	N/A

* The most relevant files are identified and extracted, along with the file list. But not all of the contained files.

Maximum File Size:

The maximum file size is 2000 MB.

Note: All file size limits can be configured.

Maximum parallel uploads

Maximum parallel uploads - as part of an archive - from v2..:

1000 executables,
10 documents,
10 other

Last updated on

Was this page helpful?