2/19/2019 30 Online Malware Analysis Sandboxes / Static Analyzers:

30 Online Malware Analysis Sandboxes

/ Static Analyzers:
Süleyman ÖZARSLAN Follow
May 14, 2016 · 2 min read

Update (June 28, 2018):

I compare results of sandboxes with a new TrickBot sample
(SHA256:dd89e57513612ebcd917d6644b97a92fb074d5dab7da6bd7
e5ac4bd93ba20219/, rst submission: 2018–06–26 14:56:28)

Sandboxes that can detect the malware (ordered by name):

• Anlyz https://sandbox.anlyz.io
Result: Malicious

• Any.run https://app.any.run
Result: Malicious Activity

• Comodo Valkyrie (https://valkyrie.comodo.com)

Result: Malware

• Hybrid Analysis (Falcon Sandbox) (http://www.hybrid-

analysis.com/)
Result: Malicious (100/100)

https://medium.com/@su13ym4n/15-online-sandboxes-for-malware-analysis-f8885ecb8a35 1/5
2/19/2019 30 Online Malware Analysis Sandboxes / Static Analyzers:

• Intezer Analyze https://www.intezer.com

Result: Malicious

• SecondWrite Malware Deepview https://www.secondwrite.com

Result: Malicious

• ViCheck https://vicheck.ca/ (static analysis)

Result: Infected

Sandboxes that cannot detect the malware (ordered by name):

• Jevereg (Amnpardaz Sandbox) http://jevereg.amnpardaz.com/

Result: File could not be analyzed

• IObit Cloud http://cloud.iobit.com

Result: Safe

Discontinued / Down sandboxes:

• Anubis http://anubis.iseclab.org/ (discontinued)

• BinaryGuard (TBM Cloud Sandbox)

http://www.binaryguard.com
Tried to register, but its website does not work.

• BitBlaze http://bitblaze.cs.berkeley.edu/(discontinued)

• Comodo Instant Malware Analysis http://camas.comodo.com/

(discontinued)

• Deepviz (https://sandbox.deepviz.com/) (services cannot be

subscribed anymore)

• Eureka http://eureka.cyber-ta.org/(discontinued)

• Malwr (Cuckoo Sandbox) (http://malwr.com/) (down)

• ThreatExpert Automated Threat Analysis (redirects to

symantec.com) (http://www.threatexpert.com/)

• Viper https://viper.malwarecon g.com/ (down)

Trial requested:

• ThreatTrack ThreatAnalyzer 
https://www.threattrack.com/malware-analysis.aspx

https://medium.com/@su13ym4n/15-online-sandboxes-for-malware-analysis-f8885ecb8a35 2/5
2/19/2019 30 Online Malware Analysis Sandboxes / Static Analyzers:

• VMRay Analyzer https://www.vmray.com

. . .

Static File Analyzers:

I tested following static le analyzers with an RTF document that
exploits an Adobe Flash vulnerability CVE-2016–4117

• Malware Tacker Cryptam Document Scanner

(http://www.malwaretracker.com/doc.php)
Supported le types: O ce les.
Result: Malware

• ViCheck https://vicheck.ca/
Result: It detect the le as an O ce malware, but identi ed with
wrong CVE.

• XecScan (http://scan.xecure-lab.com/)
Supported le types: PDF and O ce les.
Result: It cannot analyse the malware with the following
message: “Sorry, Invalid le size!”

• MASTIFF Online (https://masti -online.korelogic.com)

Result: It cannot detect the malware.

• Malware Tracker PDF Examiner

(http://www.malwaretracker.com/pdf.php)
Supported le types: PDF les.

Android Sandboxes / Analyzers:

• Akana http://akana.mobiseclab.org

• AndroTotal https://andrototal.org

• SandDroid http://sanddroid.xjtu.edu.cn

• Nviso https://apkscan.nviso.be/

Linux Sandboxes:

• Detux Multiplatform Linux Sandbox http://detux.org/

https://medium.com/@su13ym4n/15-online-sandboxes-for-malware-analysis-f8885ecb8a35 3/5
2/19/2019 30 Online Malware Analysis Sandboxes / Static Analyzers:

Süleyman Özarslan(Picus Security http://picussecurity.com)

Twitter: su13ym4n E-mail: suleyman at picussecurity com

https://medium.com/@su13ym4n/15-online-sandboxes-for-malware-analysis-f8885ecb8a35 4/5
2/19/2019 30 Online Malware Analysis Sandboxes / Static Analyzers:

https://medium.com/@su13ym4n/15-online-sandboxes-for-malware-analysis-f8885ecb8a35 5/5