Supported File Types

MetaDefender Sandbox accepts files below the size limit for analysis. The table below lists the most prevalent file types officially supported, organized by category. Unlisted file types may yield less accurate analysis results.

Application Files

File Type	Static Analysis	Dynamic Analysis	OS	Comment
A3X	Yes	No	Windows	AutoIt v3 Script
AU3	Yes	No	Windows	AutoIt v3 Script

Office Documents

File Type	Static Analysis	Dynamic Analysis	OS	Comment
DOC	Yes	Yes	Windows	Microsoft Word 97-2003 Document (.doc)
DOC95	Yes	No	Windows	Microsoft Word 95 Document (.doc)
DOCM	Yes	Yes	Windows	Microsoft Word Macro-Enabled Document (.docm)
DOCX	Yes	Yes	Windows	Microsoft Word Document (.docx)
DOT	Yes	Yes	Windows	Microsoft Word 97-2003 Template (.dot)
DOT95	Yes	No	Windows	Microsoft Word 95 Template (.dot)
DOTM	Yes	Yes	Windows	Microsoft Word Macro-Enabled Template (.dotm)
DOTX	Yes	Yes	Windows	Microsoft Word Template (.dotx)
HWP	Yes	Yes	Windows	Hangul Word Processor
ODC	Yes	No	Multi-OS	Office Data Connection
ODF	Yes	No	Multi-OS	OpenDocument Formula
ODG	Yes	No	Multi-OS	OpenDocument Graphics
ODI	Yes	No	Multi-OS	OpenDocument Image
ODP	Yes	No	Multi-OS	OpenDocument Presentation
ODS	Yes	No	Multi-OS	OpenDocument Spreadsheet
ODT	Yes	No	Multi-OS	OpenDocument Text
ONE	Yes	Yes, limited *	Windows	Microsoft OneNote exported section
POT	Yes	Yes	Windows	Microsoft PowerPoint 97-2003 Template
POTM	Yes	Yes	Windows	Microsoft PowerPoint Macro-Enabled Template
POTX	Yes	Yes	Windows	Microsoft PowerPoint Template
PPAM	Yes	Yes	Windows	Microsoft PowerPoint Add-in
PPSX	Yes	Yes	Windows	Microsoft PowerPoint Slide Show (.ppsx)
PPT	Yes	Yes	Windows	Microsoft PowerPoint 97-2003 Presentation (.ppt)
PPT95	Yes	No	Windows	Microsoft PowerPoint 95 Presentation (.ppt)
PPTM	Yes	Yes	Windows	Microsoft PowerPoint Macro-Enabled Presentation (.pptm)
PPTX	Yes	Yes	Windows	Microsoft PowerPoint Presentation (.pptx)
PUB	Yes	Yes	Windows	Microsoft Publisher
RTF	Yes	Yes	Windows	Rich Text Format
XLM	Yes	Yes	Windows	Microsoft Excel 4.0 Macro sheet
XLS	Yes	Yes	Windows	Microsoft Excel 97-2003 Workbook (.xls)
XLS95	Yes	No	Windows	Microsoft Excel 95 Workbook (.xls)
XLSB	Yes	Yes	Windows	Microsoft Excel Binary Workbook
XLSM	Yes	Yes	Windows	Microsoft Excel Macro-Enabled Workbook (.xlsm)
XLSX	Yes	Yes	Windows	Microsoft Excel Workbook (.xlsx)
XLT	Yes	Yes	Windows	Microsoft Excel Template
XLTM	Yes	Yes	Windows	Microsoft Excel Macro-Enabled Template (.xltm)
XLTX	Yes	Yes	Windows	Microsoft Excel Template (.xltx)

Encrypted Documents

Encrypted documents are handled with special processing to extract and analyze content while maintaining security protocols.

Executable Files

File Type	Static Analysis	Dynamic Analysis	OS	Comment
APK	Yes	No	Android	Android Application Package
CPL	Yes	No	Windows	Control Panel Extension
ELF	Yes	No	Unix	Executable and Linkable Format
LNK	Yes	Yes	Windows	Windows Shortcut
MSI	Yes	No	Windows	Windows Installer Package
PE (EXE/DLL)	Yes	Yes, limited **	Windows	PE unpacking & re-analysis
PE (dotnet_pe)	Yes	Yes, limited **	Windows	PE.NET decompilation & re-analysis
PE (other)	Yes	Yes, limited **	Windows	Other specific PE types (SFX, Golang, Rust, etc.)

Image Files

File Type	Static Analysis	Dynamic Analysis	OS	Comment
BMP	Yes	No	Multi-OS	Hidden data checks
DWG	Yes	No	Windows	VBA macro extraction
JPG	Yes	No	Multi-OS	Hidden data checks
PNG	Yes	No	Multi-OS	Hidden data checks
SVG	Yes	Yes, limited *	Windows	Scalable Vector Graphics

Disk Image Files

Disk image files are analyzed for contained file systems and embedded content.

Media Files

File Type	Static Analysis	Dynamic Analysis	OS	Comment
ASF	Yes	No	Windows	Windows Media Video
WMV	Yes	No	Multi-OS	Metadata analysis

Adobe Files

File Type	Static Analysis	Dynamic Analysis	OS	Comment
PDF	Yes	Yes, limited *	Multi-OS	Portable Document Format

Text Files

File Type	Static Analysis	Dynamic Analysis	OS	Comment
BAT	Yes	Yes	Windows	Batch Script
CSV	Yes	No	Multi-OS	Comma-Separated Values
HTA	Yes	Yes	Windows	HTML Application
HTML	Yes	Yes, limited *	Windows	Hypertext Markup Language
ICS	Yes	No	Multi-OS	iCalendar
JS	Yes	Yes	Multi-OS	JavaScript
JScript	Yes	Yes	Windows	Microsoft's implementation of JavaScript
JSON	Yes	No	Multi-OS	JavaScript Object Notation
JSE	Yes	Yes	Windows	JScript Encoded
PS1	Yes	Yes	Windows	PowerShell
PY	Yes	No	Multi-OS	Python
SH	Yes	No	Unix	Shell script
TXT	Yes	Yes	Windows	Plain Text
VBScript	Yes	Yes	Windows	Visual Basic Script
WSF	Yes	Yes	Windows	Windows Script File
XML	Yes	No	Multi-OS	Extensible Markup Language

Email Files

File Type	Static Analysis	Dynamic Analysis	OS	Comment
EML	Yes	Yes, limited *	Windows	Electronic Mail
MBOX	Yes	Yes	Windows	Mailbox Format
MSG	Yes	No	Windows	Outlook Message
RFC822	Yes	No	Windows	RFC822 Email Format

Other

File Type	Static Analysis	Dynamic Analysis	OS	Comment
CHM	Yes	Yes	Windows	Compiled HTML Help
CLASS (java-bytecode)	Yes	No	Multi-OS	Limited support. Yet just for a few specific malware config extraction
Java	Yes	No	Multi-OS	Java Decompilation & re-analysis
MHT, MHTML	Yes	No	Multi-OS	Web Archive
MSC	Yes	Yes	Windows	Microsoft Management Console
MSO	Yes	Yes	Multi-OS	Microsoft office active/macro object files
OLE	Yes	Yes	Windows	Object Linking and Embedding
Pickle	Yes	No	Multi-OS	Python Pickle
SCT	Yes	Yes	Windows	Windows Scriptlet

Archive Files

Supported Archive Types	Archives extraction	Type-specific analysis	Comment
7Z	Yes	N/A
ACE	Yes	N/A
BZIP2/BZ2	Yes	N/A
CAB	No	Yes	Requires version 1.6.1 or later
DEB	Yes *	Yes
GTAR	Yes	N/A
GZIP	Yes	N/A
LZIP	Yes	N/A
ISO	Yes	No
PKG (NodeJS)	Yes	No
RAR	Yes	N/A
SFX (PEEXE)	Yes	Yes
TBZ2	Yes	N/A
TAR	Yes	N/A
TGZ	Yes	N/A
TXZ	Yes	N/A
MSU	Yes	No
VHD	Yes	N/A	Requires 1.6.3 or later
WHL	Yes	No
XPI	Yes	No
ZIP	Yes	N/A
ZIPX	Yes	N/A

* The most relevant files are identified and extracted, along with the file list. But not all of the contained files.

Note: The MIME type is detected automatically regardless of the provided file suffix.

* if the file contains objects that have dedicated dynamic analysis support (e.g. JavaScript in PDF)

** Read more about supported unpackers and full overview of executable capabilities available here

Maximum File Size:

The maximum file size is 2000 MB.

Note: All file size limits can be configured.

Maximum parallel uploads

Maximum parallel uploads - as part of an archive - from v2..:

1000 executables,
10 documents,
10 other

Last updated on

Was this page helpful?