Malware Sandbox Analysis: How to Detonate a Sample and Read What Comes Back
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
When a suspicious file lands in your environment — a questionable email attachment, a file flagged by EDR, a download from a suspicious link — the fastest path to understanding what it does is detonating it in a sandbox. Malware sandboxes execute the sample in an isolated virtual environment and record everything: process creation, file system changes, network connections, registry modifications, and API calls.
Sandbox analysis is not a replacement for reverse engineering — a skilled malware analyst extracting code-level behavior from a disassembler gets deeper visibility. It is a rapid triage tool that takes a suspicious binary from 'unknown' to 'here is what it does, here are its network indicators, and here is how it achieves persistence' in under five minutes. This guide covers the submission workflow, how to read the output, and the limits of sandbox analysis.
Sandbox options and when to use each
Several sandboxes are available for different use cases, each with trade-offs in cost, privacy, and depth.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Pre-submission decisions
Before submitting a sample, make these decisions to ensure the analysis is accurate and does not expose sensitive data.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Reading a sandbox report: what matters
Sandbox reports contain extensive output. For triage purposes, focus on these sections first.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Sandbox evasion: what sandboxes miss
Modern malware increasingly detects sandbox environments and modifies behavior — or terminates — when it believes it is being analyzed. Understanding evasion techniques helps interpret sandbox reports where detonation appears incomplete.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
The bottom line
Malware sandbox analysis converts a suspicious file from an unknown threat to a characterized threat in under five minutes. For SOC analysts and incident responders, knowing which sandbox to use, what to submit and what not to, and which sections of the report contain actionable intelligence is a foundational skill. The free tiers of Any.Run, Hybrid Analysis, and Joe Sandbox provide production-quality analysis at no cost — the only investment is the time to learn how to read the output.
Frequently asked questions
Is it safe to submit malware samples to public sandboxes?
Submitting the malware binary itself to a public sandbox is generally safe — the binary executes in an isolated environment. The privacy concern is whether the submission reveals organizational information: the filename (rename samples before submission), metadata in the file, or content in the case of weaponized documents containing internal data. Do not submit internal documents, even if they are suspected of containing malware — submit only the binary payload extracted from the document, or use a private/self-hosted sandbox for document analysis.
What is the difference between static and dynamic malware analysis?
Static analysis examines the file without executing it: inspecting strings, import tables, code disassembly, and packer signatures. Dynamic analysis (sandbox analysis) executes the file and observes behavior. Static analysis is useful when the sample evades dynamic analysis, for understanding code-level behavior, and for unpacking obfuscated samples. Dynamic analysis is faster, requires less expertise, and produces behavioral IOCs (network indicators, persistence mechanisms) directly observable without reverse engineering. Both are complementary — start with dynamic analysis for triage; use static analysis for deep investigation.
How do I extract IOCs from a sandbox report for use in my SIEM?
Most sandboxes offer JSON/XML export of the full report, which includes structured IOC data: IP addresses, domains, file hashes, registry keys, and YARA matches. The Any.Run API, Hybrid Analysis API, and Joe Sandbox API all support programmatic IOC extraction for integration into SOAR playbooks. For manual extraction: network section for IP/domain IOCs, dropped files section for file hash IOCs, and the registry/persistence section for endpoint detection IOCs. Add confirmed IOCs to your threat intelligence platform and SIEM blocklists within 2 hours of analysis.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.