Performing malware analysis

The following topics explain how to perform malware analysis using the CLI:

Submitting malware to the virtual machine for analysis

Use these commands in this topic to perform the following functions:

Download the malware to the specified URL.
Analyze the malware on the virtual machine of the appliance.
Show the results of the analysis.

After you submit a malware sample to the Intelligent Virtual Execution - Server appliance, it is assigned a system-generated UUID. You can use this identifier to check the status of the submission.

Prerequisites

Before submitting malware to the virtual machine for analysis, verify that you have configured the settings for the correct type of analysis.

To submit a single URL for analysis:

Enable the CLI configuration mode.

hostname > enable
hostname # configure terminal

Enter one of the following commands.

For sandbox:

hostname (config) # malware analyze sandbox

For live:

hostname (config) # malware analyze live

Assign a URL for analysis.
```
hostname (config) # malware analyze sandbox url <malicious URL>
```
where <malicious URL> is the URL or file that is associated with the malware.
For example: http://1.2.3.4/1.exe
(Optional) Specify the interval after which the malware analysis times out if the analysis is not complete.
```
hostname (config) # malware analyze sandbox url <malicious URL> timeout <timeout>
```
where <timeout> is the value in seconds. The range is 30–3600 seconds. The default value is 500 seconds.
(Optional) Specify the priority for this analysis. The default value is the normal setting.
To set a normal setting:
```
malware analyze sandbox url <malicious URL> priority normal
```
To set an urgent setting:
```
malware analyze sandbox url <malicious URL> priority urgent
```
(Optional) Specify the guest operating system against which the malware is analyzed.
```
hostname (config) # malware analysis sandbox url <malicious URL> guestos <guestos name>
```
where <guestos name> is the available guest image profile. The default is the winxp-sp3m guest image.
The following example shows how to submit a sandbox malware analysis with normal priority on the URL http://1.2.3.4/1.exe for the win7-sp1m guest image:
```
hostname (config) # malware analyze sandbox url http://1.2.3.4/1.exe timeout 200 priority normal guestos win7-sp1m

uuid = 93b08e94-1835-4f74-9a57-908d4e8b2c53
```

Viewing malware submissions

Use the show submission command to view detailed statistics about the number of malware submissions that were analyzed and the number submitted per minute during the past 24 hours.

Use the show submission malicious command to view detailed statistics about the malware submissions that are marked as malicious.

The results of both types of analysis are displayed on the Malware Analysis page in the Web UI. For details about each show submission command, refer to the CLI Command Reference.

To view statistics of malware submissions:

Enable the CLI enable mode.
```
hostname > enable
```

View the summary of malware submission jobs.

hostname # show submission
Runtime Submission Stats:
  Total queued submission                           : 0
  Total running submissions                         : 12
  Total DA running submissions                      : 2
Cumulative Stats in timespan 2025-05-05 05:55:58 to 2025-05-06 05:55:58
                                                   : Total      : Rate/minute
 Submissions                                       : 1019       : 0.708
 Completed submissions                             : 1007       : 0.699
 Malicious submission count                        : 932        : 0.647

To view statistics of the malware submissions that are marked as malicious:

Enable the CLI enable mode.
```
hostname > enable
```

View the summary of the malware submissions that are marked as malicious.

hostname # show submission malicious

Submission ID: 118146
  Malware ID: 83818
   UUID :d8af0e25-2b18-4b11-9d3c-064d78df542d
   Submission name       : https://56561234.com/passwork23.exe
   Submission time       : 2025-05-05 07:28:35.453447
   Analysis start time   : 2025-05-05 07:28:39.262465
   Time for analysis     : 83 sec
   Total files analyzed  : 2
   Final weight          : 200
   md5sum                : 192f4469c979cc220a2b91b49d652cff
   sha256                : eea52244350c7bd27c46fbc33330edb6eec19854106f8c61deebd6c6dd2586ae
   File type             : url
   Status                : Success
   Result                : Malicious

   Analysis Object ID      : 325152
   Analysis Object Name    : passwork23.exe
   Analysis File Type      : exe
   md5sum                  : 1f37d8b59c185ca1673a91f80cb703d6
   sha256                  : 829c03affa1e4736d29e18d79071d93f11174325c104cc54c4a86e86cf637183
   Static Analysis weight  : 100
   Dynamic Analysis weight : 200
   Dynamic Analysis jobs   : 2
   Static Analysis jobs    : 4

  SA engine weight       : 100
  SA job ID              : 21055
     SA sub-engine name         : malware_guard
     SA sub-engine signature    : fe_ml_heuristic
     SA sub-engine weight       : 100

  Job ID                 : 158478
  OS name                : win7-sp1m
  Application name       : Windows Explorer
  OS Changes weight      : 200
  CNC Match weight       : 100
  Assigned time          : 2025-05-05 07:28:39.674528
  Complete time          : 2025-05-05 07:29:59.928825
  Job runtime            : 00:01:20.254297
  Signature              : Trojan.Downloader