Terminologies

Being familiar with the following terminologies facilitates malware analysis using Intelligent Sandbox.

Global Whitelist — This is the list of MD5/SHA-256 hash values of trusted files and VBA scripts embedded inside a Microsoft Office application, which need not be analyzed.
The whitelist feature is enabled by default.
In a load-balancing scenario, after the cluster creation, run the whitelistMerge cluster command on the Active node to manually copy the Global Whitelist database of Active node onto Secondary/Backup nodes. This is only a one-time activity, after which the Whitelist database of Secondary/Backup nodes is automatically overwritten by that of Active node at 0000 hours on a daily basis.
Static analysis — When Intelligent Sandbox receives a supported file for analysis, it first performs static analysis of the file. The objective is to check if it is a known malware in the shortest possible time, and also to preserve the Intelligent Sandbox resources for dynamic analysis. For static analysis, Intelligent Sandbox uses these resources in the following order.
- Local Blacklist — This is the list of MD5 hash values of known malware stored in the Intelligent Sandbox database. When Intelligent Sandbox detects a malware through its heuristic Gateway Anti-Malware engine or through dynamic analysis, it updates the local blacklist with the file MD5 hash value. A file is added to this list automatically only when its malware severity as determined by Intelligent Sandbox is medium, high, or very high. There are commands to manage the entries in the blacklist.
- Trellix GTI — This is a global threat correlation engine and intelligence base of global messaging and communication behavior, which enables the protection of the customers against both known and emerging electronic threats across all threat areas.
  Note
  DNS must be configured for Trellix GTI to run.
  Note
  For File Reputation queries to succeed, make sure Intelligent Sandbox is able to communicate with tunnel.message.trustedsource.org over HTTPS (TCP/443). Intelligent Sandbox retrieves the URL updates from List.smartfilter.com over HTTP (TCP/80).
- Gateway Anti-Malware — Gateway Anti-Malware Engine analyzes the behavior of web sites, web site code, and downloaded Web 2.0 content in real time to preemptively detect and block malicious web attacks. It protects businesses from modern blended attacks, including viruses, worms, adware, spyware, riskware, and other crimeware threats, without relying on virus signatures.
  Static analysis analyzes all the instructions and properties to identify the intended behaviors, which might not surface immediately. This also provides detailed malware classification information, widens the security cover, and can identify associated malware that leverages code re-use.
- Anti-Malware — The DAT is updated automatically or manually based on the network connectivity of Intelligent Sandbox.
- Yara scanner — Intelligent Sandbox utilizes this analysis engine to analyze the samples during static analysis. The scanner analyzes the samples based on the default Yara rules and custom Yara rules that you can set on your Intelligent Sandbox.
Note
By default, Intelligent Sandbox downloads the updates for Gateway Anti-Malware Engine and Anti-Malware Engine every 90 minutes.
Dynamic Analysis — Intelligent Sandbox executes the file in a secure virtual machine and monitors its behavior to check how malicious the file is. At the end of the analysis, it provides a detailed report as required by the user. By default, if static analysis identifies the malware, Intelligent Sandbox does not perform dynamic analysis. However, you can configure Intelligent Sandbox to perform dynamic analysis regardless of the results from static analysis. You can also configure only dynamic analysis without static analysis. Dynamic analysis includes the disassembly listing feature of Intelligent Sandbox as well. This feature can generate the disassembly code of PE files for you to analyze the sample further.

The sample analysis sequence uses these resources in the following order.

Global Whitelist
Local Blacklist
Trellix GTI , Trellix Gateway Anti-Malware Engine, and Trellix Anti-Malware Engine
YARA scanner
Dynamic Analysis