You can view the Disassembly Results report in the Intelligent Sandbox web interface or download it as a file to your client computer. The contents of the report are the same in both the methods.
To view the Disassembly Results report in the Intelligent Sandbox web interface, select → In the Analysis Reports page, click
.png "GUID-B5B4CEAC-0E1F-4067-9ABA-8A273A2EFCFF-low.png")
and select Disassembly Results. To use this option, you must have enabled the Disassembly Results option in the corresponding analyzer profile.To download the report as a file, click
in the Analysis Reports page and select Complete Results. Download the <sample_name>.zip file. This .zip file contains a file named as <file name>_detail.asm in the AnalysisLog folder. The Zip Report contains this .asm file regardless of whether you have enabled Disassembly Results option in the corresponding analyzer profile.
The Disassembly Results report provides the assembler instructions along with any static standard library call names like printf and Windows system DLL API call names embedded in the listing. If the global variables such as string text are referenced in the code, these string texts are also listed.
Column 1 | Column 2 | Column 3 |
|---|---|---|
:00401010 | e8 1f2c0000 | call 00403c34 ;;call URLDownloadToFileA |
The virtual address of the instruction is shown in column 1, the binary instruction in column 2, and the assembly instruction with comments is in column 3. In the preceding example the call 00403c34 instruction at memory location of 00401010 is making a functional call at 0x403c34 memory location, which is determined to be system DLL API function call determined to be URLDownloadToFileA(). The comment shown with the ;; in this listing provides the library function name.