This section provides CLI examples to demonstrate their usage in Sandbox and Live analysis modes.
Parameter summary
Parameter | Description |
|---|---|
| Submission mode: Use sandbox for prefetch based analysis, live for VM internet connected analysis. |
| URL to be analyzed. Should be pointed to web or direct file download server. |
| OS environment (for example, win10x64m,win7-sp1m) |
| Specify application, only works with single guest OS. |
| Duration(in seconds) to run the sample. |
| Force analysis even for duplicate samples. |
| (Live only) URL to be fetched inside VM. not valid in Sandbox mode. |
| Password for ZIP if submitting a protected archive. |
CLI usage in Sandbox mode
Different scenarios where you can use CLI in Sandbox mode.
Simple URL submission in sandbox: Submit URL for sandbox analysis with multiple OS profiles and timeout.
malware analyze sandbox url https://www.google.com guestos win10x64m,win7-sp1m timeout 150 force
Embedded file URL submission: Submit direct download URL for malware analysis.
malware analyze sandbox url https://56561234.com/passwork23.exe guestos win10x64m,win7-sp1m timeout 150 force
Invalid - no-prefetch in sandbox: no-prefetch is not supported in sandbox mode.
malware analyze sandbox url https://www.google.com no-prefetch guestos win10x64m timeout 150 force % Invalid option (no-prefetch) in Sandbox mode
Single guest OS with Application: Application parameter works only with single guest OS.
malware analyze sandbox url https://www.google.com guestos win10x64m application MS-Excel-2019 timeout 150 force
Invalid - Application with multiple guest OS: Application parameter allowed only for single guest OS.
malware analyze sandbox url https://www.google.com guestos win7-sp1m,win10x64m application MS-Excel-2019 % Invalid application name
Password protected file submission: Submit archive file with password.
malware analyze sandbox url http://10.128.51.27/test5/putty_mal.zip guestos win10x64m password infected force timeout 150
Invalid URL submission: If URL is down or domain does not exist, in web UI you will see “Submit timeout”.
malware analyze sandbox url http://194.180.48.211/nini/info.pdf guestos win10x64m force timeout 150
CLI usage in Live mode
Different scenarios where you can use CLI in Live mode.
Simple URL submission in Live: Submit URL for analysis in a controlled internet-connected VM.
malware analyze live url https://www.google.com guestos win10x64m,win7-sp1m timeout 150 force
Embedded file URL: Submit direct download URL for malware analysis in Live mode.
malware analyze live url https://56561234.com/passwork23.exe guestos win10x64m,win7-sp1m timeout 150 force
Use of no-prefetch : URL fetched inside VM directly (Valid in Live mode only).
malware analyze live url https://www.google.com no-prefetch guestos win10x64m timeout 150 force
Single guest OS with Application: Application parameter works only with single guest OS.
malware analyze live url https://www.google.com guestos win10x64m application MS-Excel-2019 timeout 150 force
Invalid - Application with multiple guest OS: Application parameter allowed only for single guest OS.
malware analyze live url https://www.google.com guestos win7-sp1m,win10x64m application MS-Excel-2019 % Invalid application name
Password protected file submission: Submit archive file with password.
malware analyze live url http://10.128.51.27/test5/putty_mal.zip guestos win10x64m password infected force timeout 150
Invalid URL submission: If URL is down or domain does not exist, in web UI you will see “Submit timeout”.
malware analyze live url http://194.180.48.211/nini/info.pdf guestos win10x64m force timeout 150