Dynamic Analysis

Adaptive Sandbox dynamic analysis features

Step #1 - Open /home/sandbox/sandbox/transform.cfg in a text editor

Step #2 - Modify the configuration by adding or modifying the properties on this page

Step #3 - Save the file and restart the sandbox service

Phishing Detection

runAnesidoraWebForURLToFileSubmissions=true

runAnesidoraWebLookupTimeoutMs=60000

Property Name	Default Value	Description
runAnesidoraWebForURLToFileSubmissions	true	Switch to enable / disable phishing detection
runAnesidoraWebLookupTimeoutMs	1 minute	Execution timeout

Enable JScript, VBScript, HTA/MSHTA and Powershell script emulation

runVBADecoderForOfficeFiles=true

runVBADecoderForPdfFiles=true

runVBADecoderForScriptFiles=true

runVBADecoderForHtmlFiles=true

runVBADecoderForExtractedFiles=true

runVBADecoderForDownloadedFiles=true

anesidoraVBAPerformDeepStaticAnalysisForExtractedFiles=true

anesidoraVBAPerformDeepStaticAnalysisForExtractedFilesMax=10

anesidoraVBAPerformDeepStaticAnalysisForExtractedFilesMaxSizeInKb=1024

anesidoraVBAExecutionTimeout=90

Property Name	Default Value	Description
runVBADecoderForOfficeFiles	true	Switch to enable / disable Office file emulation
runVBADecoderForPdfFiles	true	Switch to enable / disable PDF file emulation
runVBADecoderForScriptFiles	true	Switch to enable / disable script file emulation
runVBADecoderForHtmlFiles	true	Switch to enable / disable HTML file emulation
runVBADecoderForExtractedFiles	true	Emulate extracted files
runVBADecoderForDownloadedFiles	true	Emulate downloaded files
anesidoraVBAExecutionTimeout	90 seconds	Execution timeout
anesidoraVBAPerformDeepStaticAnalysisForExtractedFiles	true	Execute static analysis on extracted files detected during emulation
anesidoraVBAPerformDeepStaticAnalysisForExtractedFilesMax	10	Limit: the max number of files execute static analysis on
anesidoraVBAPerformDeepStaticAnalysisForExtractedFilesMaxSizeInKb	1 MB	Limit: the max size of files execute static analysis on

Enable Portable Executable emulation

Warning

This is an experimental feature

runPEEmulator=false

peEmuEmulatePEFiles=true

peEmuEmulateRawShellcode=true

pEEmuExecutionTimeout=90

pEEmuPerformDeepStaticAnalysisForExtractedFiles=true

pEEmuPerformDeepStaticAnalysisForExtractedFilesMax=10

pEEmuIgnoreClueTypes=SessionStarted,EmulationEnd,Exception,UnhandledAPI

pEEmuConfigFile.Unix=

Property Name	Default Value	Description
runPEEmulator	true	Main switch to enable / disable PE emulation
peEmuEmulatePEFiles	true	Switch to enable / disable PE emulation for PE files
peEmuEmulateRawShellcode	true	Switch to enable / disable PE emulation for raw shellcode
pEEmuExecutionTimeout	90 seconds	Execution timeout
pEEmuPerformDeepStaticAnalysisForExtractedFiles	true	Execute emulation on extracted files
pEEmuPerformDeepStaticAnalysisForExtractedFilesMax	10	Limit: max number of extracted files to emulate
pEEmuIgnoreClueTypes	SessionStarted, EmulationEnd, Exception, UnhandledAPI	Emulation events to be ignored by the sandbox
pEEmuConfigFile.Unix		Use the specific config file to modify API tracing filter and other PE emulator parameters

Last updated on

Was this page helpful?