When you submit a file manually or automatically for analysis, the file uses the corresponding analyzer profile to determine how the file is analyzed and reported.
Log on to the Intelligent Sandbox web interface.
Make sure the users assigned to the analyzer profile are logged off of Intelligent Sandbox.
Click → → .
Type a name for the analyzer profile, and choose one or more VM profiles that Intelligent Sandbox must use for dynamically analyzing a file.
Note
If you want to submit a file to multiple VMs for analysis, you can select up to five VM profiles in one Analyzer Profile.
In the Automatically Select OS section, do the following:
Select Enable if you want Intelligent Sandbox to automatically select the VM profile for Windows 32-bit and Windows 64-bit.
Select the VM profiles from the Windows 32-bit VM Profile and Windows 64-bit VM Profile.
In the Runtime Parameters section, do the following:
In Archive Password, enter the password for Intelligent Sandbox to unzip a password-protected malware sample, then confirm it by entering the same password again.
Note
If Archive Password is blank, Intelligent Sandbox will use the password
infectedto unzip the password protected archive file.Specify the maximum time duration for which Intelligent Sandbox should dynamically analyze the sample.
Note
The default value is 180 seconds. The maximum value allowed is 32767 seconds. If the file does not stop execution before this time period expires, the dynamic analysis is stopped.
In Runtime Argument, type command-line parameter for the submitted file on execution.
This allows you to review the actual payload of malware.
In Reports, Logs, and Artifacts section, choose from the following:
Analysis Summary – Select to include the Analysis Summary report in the analysis results.
Packet captures – Select to capture the network packets if the file tries to communicate during dynamic analysis. The pcap file is provided in the complete results .zip file.
Dropped Files – Select to generate the Files Created in Sandbox report.
Disassembly Results – Select if you want Intelligent Sandbox to generate the disassembly code of PE files.
Logic Path Graph – Select to generate Logic Path Graph report.
User API Log – This report provides Windows user-level DLL API calls made directly by the malware sample during dynamic analysis.
Memory Dump — Select to generate the memory dump strings of PE files.
In the Static Analysis section, select the engines that you would want to use for the scanning.
In the Dynamic Analysis section, select the method that you would want to use for the scanning.
In the Analyzer Flow Controls section, choose from the following:
Continue to run all engines even after file is found malicious – Select if you want Intelligent Sandbox to analyze the file using all selected Analyze Options, regardless of the result from any specific method.
Note
When selected, Intelligent Sandbox skips the pre-filter scan process and submits the sample to all selected engines.
Skip files if previously analyzed – Select if you want Intelligent Sandbox to skip analysis of a file if the same has been previously analyzed.
It verifies the md5sum hash value of a sample if it was analyzed in 3 days and the severity level was more than informational.
Analyze archive contents individually – Intelligent Sandbox extracts and sends the content of .zip and .7zip archive files individually to a sandbox for analysis. If an archive file is nested, it is extracted up to three levels before it's analyzed by Intelligent Sandbox.
Uncheck this option if you want Intelligent Sandbox to send the archive files for analysis without extracting its content.
In the Internet options section, select Enable Malware Internet Access to provide Internet access to samples so they have access to resources on the Internet.
Note
To enable this option, the Sandbox option under Analyzer Options must be enabled. Also, you must have admin role permission to select or deselect Enable Malware Internet Access.
Because the sample being analyzed could potentially be a malware, selecting the Enable Malware Internet Access option involves the risk of malicious traffic propagating out of your network. A disclaimer message is displayed when you select this option, and you must click OK to continue. Also, the administrator can configure proxy setting for malware in case there is a proxy server in their network.
Click Save to create the analyzer profile.
Associate the analyzer profile to a user.
Click → .
Select the administrator, then click Edit.
From the Default Analyzer Profile list, select the analyzer profile.
Click Save.