Intelligent Sandbox produces detailed analysis for each submitted sample. All the available reports for an analyzed sample are available in a .zip file, which you can download from the Intelligent Sandbox web interface.
Log on to the Intelligent Sandbox web interface.
Click → .
Click
.png "GUID-B5B4CEAC-0E1F-4067-9ABA-8A273A2EFCFF-low.png")
and select Complete Results .Download the <sample_name>.zip file to the location you want. This .zip file contains the reports for each analysis. The files in this .zip file are created and stored with a standard naming convention. Consider that the sample submitted is vtest32.exe. Then the .zip file contains the following results:
vtest32_summary.html (.json, .txt, .xml) — This is the same as the Analysis Summary report. There are four file formats for the same summary report in the .zip file. The html and txt files are mainly for end users to review the analysis report. The .json and .xml files provide well-known malware behavior tags for high-level programming script to extract key information.
If the malware severity is 3 and above, then it contains .ioc, and .stix.xml formats of the Analysis Summary report for the sample.
vtest32.log — This file captures the Windows user-level DLL API calling activities during dynamic analysis. You must thoroughly examine this file to understand the complete API calling sequence as well as the input and output parameters. This is the same as the User API Log report.
vtest32ntv.txt — This file captures the Windows native services API calling activities during dynamic analysis.
vtest32.txt — This file shows the PE header information of the submitted sample.
vtest32_detail.asm — This is the same as the Disassembly Results report. This file contains reverse-engineering disassembly listing of the sample after it has been unpacked or decrypted.
vtest32_logicpath.gml — This file is the graphical representation of cross-reference of function calls discovered during dynamic analysis. This is the same as the Logic Path Graph report.
log.zip —This file contains all the run-time log files for all processes affected by the sample during the dynamic analysis. If the sample generates any console output text, the output text message is captured in the ConsoleOutput.log file zipped up in the log.zip file. Use any regular unzip utility to see the content of all files inside this log.zip file.
dump.zip — This file contains the memory dump (dump.bin) of binary code of the sample during dynamic analysis. This file is password protected. The password is virus.
dropfiles.zip — This is the same as the Dropped Files report in the Analysis Reports page. The dropfiles.zip file contains all files created or touched by the sample during the dynamic analysis. It is also password protected. The password is virus.
extract_static.log : This file contains the following:
Filetypes of all dropped files extracted during sample execution.
Characteristics of Portable Execution (PE) sample (in order):
Packer/Compiler Signature Detection
Overlay Detection, shows offset if present
Compilation Timestamp
TLS Callback Information
Raw vs. Virtual Size Comparison
Sectional Characteristics (name, entropy, section headers)
extract_url.log: This file contains all the URLs extracted from memory dump log.
extractallstring_dump.log: This file contains all the strings from memory dump of the processes.