Analyze files

Published on Sep 8, 2026

2 minute(s) read

Article summary

Intelligent Sandbox performs static and dynamic analysis on the files you submit.

File guidelines

Guideline	Definition
File submission methods	You can submit files using the following methods: Log on to the Intelligent Sandbox web interface and manually upload the files. Post the files on the FTP server, which is hosted on the Intelligent Sandbox Appliance. Use the Intelligent Sandboxweb interface RESTful APIs. For more information, see the API Reference Guide. Note The maximum file size supported is 128 MB if you use the Intelligent Sandbox web interface, RESTful APIs, or McAfee Web Gateway . Integrate Intelligent Sandbox with Trellix IPS andMcAfee Web Gateway which automatically submit samples to Intelligent Sandbox.
Maximum file size	The Intelligent Sandbox web interface, RESTful APIs, and Web Gateway support a maximum of 128 MB in file size.
File name requirements	Intelligent Sandbox supports unicode. File names can be up to 200 bytes long File names can contain non-English and special characters. When you use the following characters, file names are displayed as the file MD5 hash value: " ' ` < > \| ; * ? # $ * For example, you submit vtest;32.exe. Intelligent Sandbox displays the file name as e2cfe1c89703352c42763e4b458fc356.exe. If you use the \ character, Intelligent Sandbox is unable to display the character and any following characters. If you use a space in the file name, Intelligent Sandbox displays it as _.
Static analysis	Static analysis of Visual Basic for Applications scripts (VBA scripts) embedded inside a Microsoft Office application takes place inside the virtual machine. The analysis enhances the ability to identify threats that are disguised as VBA scripts.
Dynamic analysis	Dynamic analysis of Flash files occurs after you install the Internet Explorer-based Flash plug-in or Flash player on the virtual machine. The Flash plug-in is supported only for Internet Explorer on the virtual machine. When you install the Flash player and Flash plug-in, the Flash plug-in takes precedence.
Pre-filtering	Intelligent Sandbox supports file sample pre-filtering for these software: Adobe Reader Adobe Flash Microsoft Office Ichitaro word processor The pre-filtering functionality ascertains classified Microsoft Office samples as clean, even before these samples are submitted for dynamic analysis. This reduces load on the virtual machines.

Supported file types

File Types	Static Analysis	Dynamic Analysis	Email Connector
32-bit Portable Executables (PE) files; 64-bit PE+ files	.exe .dll .scr .sys .com .cpl	.exe .dll .scr .cpl	.exe .dll .cpl
Microsoft Office Suite documents	.doc .docx .xls .xlsx .xlsb .xlsm .ppt .pptx .rtf .xltm .xltx .xlam .docm .dotm .dotx .one .ppam .pps .ppsx .ppsm .ppt .pptm .shs .sldm .sldx .thmx	.doc .docx .xls .xlsx .xlsb .xlsm .ppt .pptx .rtf .xltm .xltx .xlam .docm .dotm .dotx .one .ppam .pps .ppsx .ppsm .ppt .pptm .shs .sldm .sldx .thmx .xar	.doc .docx .xls .xlsx .xlsb .xlsm .xltm .docm .dotx .dotm .ppt .pptx .ppsx .ppsm .pptm .rtf
JustSystems Ichitaro documents	.jtd .jtdc	.jtd .jtdc
Adobe	.pdf .swf	.pdf .swf	.pdf .swf
Compressed files	.gz .tgz .zip .cab .7z .msi .lzh .lzma .iso .xar .xz .bz2 .tar .ar	.gz .tgz .zip .cab .7z .msi .lzh .rar .iso .xar .xz .bz2 .tar .ar	.gz .cab .rar .zip .7z
Android application package	.apk	.apk
Java	.jar .class .js Java bin files	.jar .class .js Java bin files	.class
Image files	.jpeg .png .gif	Not supported	.jpeg .jpgite .png .gif
Other file types	.cmd .bat .cgi .vbs .xml .url .htm .html .eml .mht .msg .vb .vba .vbe .vbs .ace .arj .chm .lnk .mof .ocx .potm .potx .ps1 .reg .wsc .wsf .wsh .mime .wim	.cmd .bat .cgi .vbs .xml .url .htm .html .eml .mht .msg .vbe .vbs .ace .arj .chm .ins .lnk .ocx .potm .potx .ps1 .reg .wsc .wsf .wsh .mime .wim	.ace .potm .potx .ocx

:

Was this article helpful?