{"id":5988,"date":"2023-10-17T09:25:13","date_gmt":"2023-10-17T09:25:13","guid":{"rendered":"\/cybersecurity-blog\/?p=5988"},"modified":"2026-07-15T14:00:05","modified_gmt":"2026-07-15T14:00:05","slug":"malware-analysis-in-a-sandbox","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/","title":{"rendered":"Malware Analysis in ANY.RUN: <br>The Ultimate Guide\u00a0"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Welcome to <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newguide&amp;utm_content=landing\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>! This crash course will walk you through the basics of using our interactive sandbox to help you achieve your malware analysis goals.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s get started!&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN&#8217;s Interactive Sandbox<\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-1024x576.png\" alt=\"\" class=\"wp-image-14790\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-1024x576.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-300x169.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-768x432.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-1536x864.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-370x208.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-270x152.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1-740x416.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/07\/2-1.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Enterprise Suite provides tangible results across every SOC tier<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newguide&amp;utm_content=landing\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN\u2019s Interactive Sandbox<\/a> enables security teams to rapidly analyze suspicious files and URLs to detect evasive malware and phishing threats early. The solution delivers measurable results that impact the speed and quality of SOC and MSSP operations, on average providing: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>21-minute MTTR reduction<\/strong> thanks to real-time analysis and reporting that fuel fast response.<\/li>\n\n\n\n<li><strong>36% detection rate boost<\/strong> from live interactions with the malware that ensure full detonation of attacks missed by other solutions.<\/li>\n\n\n\n<li><strong>90% of threats revealed within 60<\/strong> <strong>seconds <\/strong>of analysis thanks to advanced detection capabilities.<\/li>\n\n\n\n<li><strong>20% Tier 1 workload reduction<\/strong> via automation, streamlining routine tasks.<\/li>\n\n\n\n<li><strong>30% fewer Tier 1 to Tier 2 escalations<\/strong> by equipping junior staff with actionable insights that let them make decisions on their own with more confidence.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Now, let\u2019s dive into the sandbox\u2019s interface.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Setting up your account<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Sign up&nbsp;<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"565\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-1024x565.png\" alt=\"\" class=\"wp-image-22096\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-1024x565.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-300x166.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-768x424.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-1536x848.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-2048x1131.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-370x204.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-270x149.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Screenshot-2026-07-15-at-13.30.38-740x409.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Creating your account on ANY.RUN<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">For non-business email users, use the #verification channel on <a href=\"https:\/\/discord.gg\/anyrun\" target=\"_blank\" rel=\"noreferrer noopener\">our Discord server<\/a> to request a free ANY.RUN account.<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nAccelerate investigations and enrich security workflows\n<br>With <span class=\"highlight\">ANY.RUN Sandbox<\/span> for SOC analysts\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/app.any.run\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=malwareguide&#038;utm_content=linktoservice\"rel=\"noopener\" target=\"_blank\">\nStart here\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Choose your subscription plan&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After logging in to your account, you will be greeted by the dashboard page. From there, you can go to your Profile settings to choose your subscription plan. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We offer a free plan that provides you with a basic set of tools for investigations. For an advanced level of malware analysis and privacy, individual researchers can utilize the <a href=\"https:\/\/any.run\/cybersecurity-blog\/subscriptions-hunter-plan\/\" target=\"_blank\" rel=\"noreferrer noopener\">Hunter plan<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For use in a real SOC setting, we offer <a href=\"https:\/\/any.run\/cybersecurity-blog\/anyrun-enterprise-plan\/\" target=\"_blank\" rel=\"noreferrer noopener\">Enterprise Suite<\/a> plan that delivers maximum capabilities of the sandbox, including teamwork features, for boosting business security.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more about <a href=\"https:\/\/app.any.run\/plans\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newguide&amp;utm_content=plans\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN&#8217;s plans<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With your account all set-up and firing on all cylinders, it is time you get started with your first analysis.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Setting up a virtual machine for malware analysis<\/strong>&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In order to set up a virtual machine (VM) for malware analysis in ANY.RUN, you need to create a new analysis session.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Access an interactive tutorial by visiting <a href=\"https:\/\/app.any.run\/docs\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newguide&amp;utm_content=faq\" target=\"_blank\" rel=\"noreferrer noopener\">the FAQ page<\/a>&#8216;s <strong>Tutorials tab <\/strong>and clicking the <strong>&#8220;How to analyze threats&#8221;<\/strong> button.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In case you prefer written instructions, continue reading this article and follow these steps:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Open the new analysis window&nbsp;<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"575\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-1024x575.png\" alt=\"\" class=\"wp-image-15883\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-1024x575.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-300x169.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-768x432.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-1536x863.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-370x208.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-270x152.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1-740x416.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-1-1.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Launch your analysis in two clicks<\/em>&nbsp;<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Click the <em>New analysis<\/em> button on the left sidebar to open the analysis window.&nbsp;&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Choose an analysis mode<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"636\" height=\"646\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-2-1.png\" alt=\"\" class=\"wp-image-15882\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-2-1.png 636w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-2-1-295x300.png 295w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-2-1-70x70.png 70w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-2-1-370x376.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-2-1-270x274.png 270w\" sizes=\"auto, (max-width: 636px) 100vw, 636px\" \/><figcaption class=\"wp-element-caption\"><em>Switch to the Pro mode to customize your VM environment<\/em>&nbsp;<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The newly opened analysis window will be set to the User Mode by default, which lets you quickly analyze your file or link but limits your VM settings to only choosing an OS version:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Windows from 7 through 11 \u2014 32-bit or 64-bit versions.<\/li>\n\n\n\n<li>Linux \u2014 <a href=\"https:\/\/any.run\/cybersecurity-blog\/linux-in-anyrun\/\" target=\"_blank\" rel=\"noreferrer noopener\">Ubuntu<\/a> 22.04.2 &amp; <a href=\"https:\/\/any.run\/cybersecurity-blog\/arm-linux-malware-sandbox\/\" target=\"_blank\" rel=\"noreferrer noopener\">Debian<\/a> 12.2 (ARM, 64-bit).<\/li>\n\n\n\n<li><a href=\"https:\/\/any.run\/cybersecurity-blog\/android-malware-analysis\/\" target=\"_blank\" rel=\"noreferrer noopener\">Android 14 <\/a>(ARM, 64-bit).<\/li>\n\n\n\n<li><a href=\"https:\/\/any.run\/cybersecurity-blog\/anyrun-macos-sandbox\/\">macOS<\/a> (Sequoia, ARM 64-bit).<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To open the rest of the VM customization features, enable the <em>Pro mode<\/em> by pressing the respective button on top of the analysis window.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Configure the VM<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"798\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-1024x798.png\" alt=\"\" class=\"wp-image-15880\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-1024x798.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-300x234.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-768x598.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-370x288.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-270x210.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-385x300.png 385w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1-740x577.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-3-1.png 1041w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Open tooltips to explore every VM setting available to you<\/em>&nbsp;<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">In the Pro mode, you can fine-tune your analysis environment. Click on the question mark icon in the top right corner to access tooltips with detailed explanations of each setting.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After completing the VM setup, begin your analysis by pressing the <em>Run a private\/public analysis <\/em>button.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/how-to-create-a-task\/\" target=\"_blank\" rel=\"noreferrer noopener\">Guide to Creating a new analysis in ANY.RUN<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Analyzing malware<\/strong>&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once your analysis is launched, you will be taken to a page where you will be able to analyze your sample in real time and, once it is done, review the findings of the investigation.<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nReduce MTTR, solve alert fatigue, and boost detection rates<br>Try <span class=\"highlight\">ANY.RUN Sandbox<\/span> for your SOC&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=malware-analysis-guide&#038;utm_content=linktoenterprise#contact-sales\" rel=\"noopener\" target=\"_blank\">\nContact us&nbsp;\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p class=\"wp-block-paragraph\">Here are the things you can perform as part of your analysis:&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Interact with the sample&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN enables you to manually interact with your sample in a VM environment like you would on a normal computer.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can run programs, open tabs in a browser, and even restart the system without delay.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/interactive-malware-analysis\/\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Malware Analysis<\/a><\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Laplas Clipper research\" width=\"770\" height=\"433\" src=\"https:\/\/www.youtube.com\/embed\/Wf797sOfJS8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\"><em>The interactive VM lets you copy and paste any content via the Clipboard tool<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><em><a href=\"https:\/\/youtu.be\/Wf797sOfJS8\" target=\"_blank\" rel=\"noreferrer noopener\">Watch the video \u2192<\/a><\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Track network activity<\/h3>\n\n\n\n<figure class=\"wp-block-embed aligncenter is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Track network activity\" width=\"770\" height=\"433\" src=\"https:\/\/www.youtube.com\/embed\/ey2kkBbnhME?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\"><em>You can view malware\u2019s connections and traffic<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><em><a href=\"https:\/\/youtu.be\/ey2kkBbnhME?si=KhONwb4TRN04zSr9\" target=\"_blank\" rel=\"noreferrer noopener\">Watch the video \u2192<\/a><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Network section monitors and records network activity as it is occurring and provides the following information:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>HTTP Requests:<\/strong> Displays details of connection requests, including URL connection response and content&nbsp;<\/li>\n\n\n\n<li><strong>Connections: <\/strong>Shows other protocols that were not mentioned in HTTP Requests&nbsp;<\/li>\n\n\n\n<li><strong>DNS Requests:<\/strong> Indicates the correlation between a domain name and IP address&nbsp;<\/li>\n\n\n\n<li><strong>Threats: <\/strong>Detects intrusion using Suricata rules (<a href=\"https:\/\/any.run\/cybersecurity-blog\/detection-with-suricata-ids\/\" target=\"_blank\" rel=\"noreferrer noopener\">Detection with Suricata IDS<\/a>)<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"875\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream-1024x875.webp\" alt=\"\" class=\"wp-image-5995\" style=\"width:650px;height:555px\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream-1024x875.webp 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream-300x256.webp 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream-768x657.webp 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream-370x316.webp 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream-270x231.webp 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream-740x633.webp 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/networkstream.webp 1109w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Use network stream analysis to expose evasive malware<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can examine traffic packet by packet using the Network stream feature, enabling you to identify unusual patterns or connections, stolen data, C2 addresses, proxies, and downloaded files.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/analyzing-the-network-stream\/\" target=\"_blank\" rel=\"noreferrer noopener\">Analyzing the Network Stream<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Review modified files<\/h3>\n\n\n\n<figure class=\"wp-block-embed aligncenter is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Review modified files\" width=\"770\" height=\"433\" src=\"https:\/\/www.youtube.com\/embed\/_v84JYxquwI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\"><em>Easily switch between the Network and Files sections<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><em><a href=\"https:\/\/youtu.be\/_v84JYxquwI?si=t2F6MSNZrYTiCbM0\" target=\"_blank\" rel=\"noreferrer noopener\">Watch the video \u2192<\/a><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Files Modification section lists all files used during the analysis. Click on each file\u2019s content to access downloadable Static discovering data.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"628\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc-1024x628.webp\" alt=\"\" class=\"wp-image-5997\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc-1024x628.webp 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc-300x184.webp 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc-768x471.webp 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc-370x227.webp 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc-270x166.webp 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc-740x454.webp 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/staticdisc.webp 1045w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Static discovering enables you to gain insight into any file<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN\u2019s Static discovering feature is modular, letting you analyze a wide range of file types including PDF, LNK, ZIP, RAR, Office documents, and others.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/static-discovery-update\/\" target=\"_blank\" rel=\"noreferrer noopener\">Static Analysis for Various File Types<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Utilize in-browser data inspection<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"831\" height=\"1024\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-831x1024.jpeg\" alt=\"\" class=\"wp-image-22128\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-831x1024.jpeg 831w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-243x300.jpeg 243w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-768x946.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-1247x1536.jpeg 1247w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-370x456.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-270x333.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1-740x912.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/unfo1-1662x2048-1.jpeg 1662w\" sizes=\"auto, (max-width: 831px) 100vw, 831px\" \/><figcaption class=\"wp-element-caption\">In-browser data benefits<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In-browser data inspection solves investigation bottlenecks by giving\u00a0you the full\u00a0static and dynamic\u00a0URL context\u00a0in just one click. The page executes in a real browser, and everything that matters, redirects, scripts, DOM changes, user-facing content, is captured and presented to you in a single view.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is an instant view of the attack in one place.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/in-browser-data-inspection\/\" target=\"_blank\" rel=\"noreferrer noopener\">In-browser data inspection<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Inspect processes<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"537\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-1024x537.png\" alt=\"\" class=\"wp-image-22113\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-1024x537.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-300x157.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-768x403.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-1536x806.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-2048x1075.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-370x194.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-270x142.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.19.54-740x388.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>The process tree depicts processes taking place in real time<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Processes section lays out a hierarchical view of all processes, accompanied by corresponding indicators.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/indicators-tags\/\" target=\"_blank\" rel=\"noreferrer noopener\">Indicators and Tags Used in ANY.RUN<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To investigate a specific process, simply click on it. This will bring up the Process details window, from which you can navigate to the Advanced details by pressing the <em>More info<\/em> button.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"513\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo-1024x513.webp\" alt=\"\" class=\"wp-image-6000\" style=\"width:650px;height:325px\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo-1024x513.webp 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo-300x150.webp 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo-768x385.webp 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo-370x186.webp 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo-270x135.webp 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo-740x371.webp 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/moreinfo.webp 1057w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>By clicking on a process, you can discover more information on it<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Advanced details menu can help you track the timeline of any process.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1354\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-scaled.png\" alt=\"\" class=\"wp-image-22123\" style=\"width:650px;height:363px\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-scaled.png 2560w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-300x159.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-1024x542.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-768x406.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-1536x812.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-2048x1083.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-370x196.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-270x143.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.22.02-740x391.png 740w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><figcaption class=\"wp-element-caption\"><em>Advanced details let you discover extra information about processes<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, here you can download process dumps. The complete list of process details includes:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Modified files \/ Files in a raw view;&nbsp;<\/li>\n\n\n\n<li>Registry changes \/ Registry keys;&nbsp;<\/li>\n\n\n\n<li>Synchronization;&nbsp;<\/li>\n\n\n\n<li>HTTP Requests;&nbsp;<\/li>\n\n\n\n<li>Connections;&nbsp;<\/li>\n\n\n\n<li>Network threats;&nbsp;<\/li>\n\n\n\n<li>Modules;&nbsp;<\/li>\n\n\n\n<li>Debug.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/malware-details\/\" target=\"_blank\" rel=\"noreferrer noopener\">Fast and Simple Access to Malware Details<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Access malware analysis reports<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"838\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-1024x838.png\" alt=\"\" class=\"wp-image-22112\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-1024x838.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-300x246.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-768x629.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-1536x1258.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-370x303.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-270x221.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43-740x606.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.18.43.png 1722w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>This segment contains the malware analysis data that you can download<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In the top right corner, you can view the key threat information generated as part of the analysis, including:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Indicators of compromise (IOCs)<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"892\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1-1024x892.png\" alt=\"\" class=\"wp-image-22111\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1-1024x892.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1-300x261.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1-768x669.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1-370x322.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1-270x235.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1-740x644.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.15.32-1.png 1284w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>ANY.RUN helps you collect fresh IOCs of the latest threats<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Indicators of compromise are an essential piece of information that you can use for timely detection of malware.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/indicators-of-compromise\/\" target=\"_blank\" rel=\"noreferrer noopener\">Indicators of Compromise<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Malware\u2019s configuration<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"688\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-1024x688.png\" alt=\"\" class=\"wp-image-22109\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-1024x688.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-300x202.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-768x516.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-1536x1032.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-370x249.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-270x181.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53-740x497.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.14.53.png 1962w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>ANY.RUN offers configurations for dozens of malware families<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Malware configurations can include a variety of information, such as IP addresses and ports of C2 servers, malware family name, type, and version, encryption keys, anti-debugging, anti-sandbox, and other evasion methods, and much more.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/malware-configuration\/\" target=\"_blank\" rel=\"noreferrer noopener\">Dive into Analysis with Malware Configuration<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>MITRE ATT&amp;CK Matrix<\/strong><\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"567\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-1024x567.png\" alt=\"\" class=\"wp-image-22108\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-1024x567.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-300x166.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-768x425.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-1536x850.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-2048x1133.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-370x205.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-270x149.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.12.48-740x409.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Analyze malware and see which tactics it employs<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The built-in MITRE ATT&amp;CK Matrix allows you to view the techniques utilized by the malware with action mapping and explore each of them.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/mitre-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">MITRE ATT&amp;CK Matrix<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Private AI Assistant for Malware Analysis in ANY.RUN Sandbox<\/strong><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"634\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-1024x634.png\" alt=\"\" class=\"wp-image-22107\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-1024x634.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-300x186.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-768x476.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-1536x951.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-2048x1268.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-370x229.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-270x167.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.09.48-740x458.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>AI reviews inside ANY.RUN\u2019s sandbox analysis session<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">AI summaries provide you with a deeper understanding of malware\u2019s behavior by sharing AI-powered explanations of important elements, such as processes, rules, and connections. They&#8217;re available separately or as part of reports that contain all analysis findings.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/private-ai-for-malware-analysis\/\" target=\"_blank\" rel=\"noreferrer noopener\">Private AI assistant for malware analysis<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong><strong>SOC-ready reporting<\/strong><\/strong><\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"679\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-1024x679.png\" alt=\"\" class=\"wp-image-22106\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-1024x679.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-300x199.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-768x510.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-1536x1019.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-2048x1359.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-370x245.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-270x179.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.08.14-740x491.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Each analysis provides a report on the sample which includes IOCs and TTPs <\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Enhanced SOC-ready <a href=\"https:\/\/any.run\/cybersecurity-blog\/soc-ready-reporting\/\" target=\"_blank\" rel=\"noreferrer noopener\">Tier 1 reports <\/a>turn\u00a0complex sandboxing\u00a0analysis into\u00a0structured, decision-ready\u00a0intelligence\u00a0for\u00a0faster, efficient\u00a0triage, escalation, and response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN\u2019s new reports&nbsp;and&nbsp;AI Summary convert sandbox analysis outputs into structured, operationally ready documents that support every stage of the incident&nbsp;lifecycle. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The report can be exported in your preferred format, including JSON and HTML.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/soc-ready-reporting\/\" target=\"_blank\" rel=\"noreferrer noopener\">SOC-ready reporting<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Restart the analysis<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can always restart any analysis with different VM settings to test a sample in a new environment.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Working with public malware samples<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"524\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-1024x524.png\" alt=\"\" class=\"wp-image-22104\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-1024x524.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-300x154.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-768x393.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-1536x787.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-2048x1049.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-370x189.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-270x138.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-585x300.png 585w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.03.25-740x379.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Use the database to stay up-to-date on the latest threats.<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In addition to analyzing your own samples, you can access ANY.RUN\u2019s database of over 6 million malware samples submitted by users from around the world.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/free-malware-samples-reports\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Get Free Malware Samples and Reports<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Managing a team<\/strong>&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">All Enterprise Suite users can take advantage of the Teamwork feature that allows analysts to work together on different samples in real time. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It makes it easy to monitor your team&#8217;s activities and train junior analysts. It is also a great way to track productivity and manage large, dynamic teams.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are some of its benefits:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Real-time collaboration: <\/strong>Analysts can join their forces, saving time and improving accuracy.&nbsp;<\/li>\n\n\n\n<li><strong>Common analysis history: <\/strong>Team history can be configured to show all analyses, only the leader&#8217;s analyses, or only links to the leader&#8217;s analyses.&nbsp;<\/li>\n\n\n\n<li><strong>Employee activity tracking: <\/strong>Team leaders can view employee activity, which can help them identify areas where training or extra resources are needed.&nbsp;<\/li>\n\n\n\n<li><strong>Subscription management: <\/strong>Team leaders can manage subscriptions and assign licenses to team members.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/teamwork\/\" target=\"_blank\" rel=\"noreferrer noopener\">Teamwork<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Using Live Attack Data from 15K SOCs in Threat Intelligence Lookup<\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"558\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-1024x558.png\" alt=\"\" class=\"wp-image-22103\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-1024x558.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-300x164.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-768x419.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-1536x837.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-2048x1116.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-370x202.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-270x147.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-15-at-15.02.05-740x403.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup provides access to an extensive database of the latest IOCs, IOBs, and IOAs<\/em>&nbsp;<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newguide&amp;utm_content=linktolookup\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a>&nbsp;is ANY.RUN\u2019s key solution for working with threat intelligence. It simplifies and accelerates different stages of malware investigations, from proactive monitoring to gaining insights for incident response. As a result, you get to ensure a better defense against cyber threats for your company.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, this means that TI Lookup provides you with Indicators of&nbsp;<a href=\"https:\/\/any.run\/cybersecurity-blog\/iocs-iobs-ioas-explained\/\" target=\"_blank\" rel=\"noreferrer noopener\">Compromise (IOCs), Attack (IOAs), and Behavior (IOBs)<\/a>. It not only links each indicator to an attack or sample but also showcases its behavior inside the sandbox.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The source of indicators is unique: all data comes from millions of malware analysis sessions done in ANY.RUN\u2019s Interactive Sandbox. TI Lookup allows you to tap into it to gain invaluable insights into real threats targeting&nbsp;<a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-from-organizations\/\" target=\"_blank\" rel=\"noreferrer noopener\">15,000 companies<\/a>&nbsp;in finance, manufacturing, transportation, government, and other industries right now.<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nEquip you SOC with <span class=\"highlight\">ANY.RUN<\/span> <br> Streamline processes from triage to response  \n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/#contact-sales?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newguide&amp;utm_content=linktolookup\" target=\"_blank\" rel=\"noopener\">\nPower your SOC\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong>&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN&#8217;s Interactive Sandbox is your best solution for both static and dynamic malware analysis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run an unlimited number of analyses, explore millions of reports and malware samples, and collect valuable data by studying the ins and outs of malicious programs and links. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With our cloud-based sandbox, your threat investigations will become a walk in the park.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN, a leading provider of interactive malware analysis and&nbsp;threat&nbsp;intelligence solutions, helps organizations investigate&nbsp;threats&nbsp;faster&nbsp;and make&nbsp;response decisions based on clear&nbsp;behavioral evidence.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its solutions include the&nbsp;<a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=ultimate-malware-analysis-guide&amp;utm_term=150726&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive&nbsp;Sandbox<\/a>&nbsp;for enterprise-scale malware and phishing analysis, along with&nbsp;<a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=ultimate-malware-analysis-guide&amp;utm_term=150726&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence<\/a>&nbsp;products built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active&nbsp;threats earlier, and add relevant context to detection, investigation, and&nbsp;response workflows.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN is&nbsp;<a href=\"https:\/\/any.run\/compliance\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=ultimate-malware-analysis-guide&amp;utm_term=150726&amp;utm_content=linktocomliance\" target=\"_blank\" rel=\"noreferrer noopener\">SOC 2 Type II attested<\/a>,&nbsp;demonstrating&nbsp;its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn&nbsp;threat&nbsp;analysis into actionable findings.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=ultimate-malware-analysis-guide&amp;utm_term=150726&amp;utm_content=linktoenterprise#contact-sales\" target=\"_blank\" rel=\"noreferrer noopener\">See how you can boost your SOC workflows<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Welcome to ANY.RUN! This crash course will walk you through the basics of using our interactive sandbox to help you achieve your malware analysis goals.&nbsp; Let\u2019s get started!&nbsp; About ANY.RUN&#8217;s Interactive Sandbox ANY.RUN\u2019s Interactive Sandbox enables security teams to rapidly analyze suspicious files and URLs to detect evasive malware and phishing threats early. The solution [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":22089,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[6],"tags":[57,58,34],"class_list":["post-5988","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-instructions","tag-anyrun","tag-cybersecurity-training","tag-malware-analysis"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>A Guide to Malware Analysis with a Sandbox<\/title>\n<meta name=\"description\" content=\"Discover how you can analyze malware using the free ANY.RUN sandbox and collect indicators of compromise of the latest threats.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"headline\":\"Malware Analysis in ANY.RUN: The Ultimate Guide\u00a0\",\"datePublished\":\"2023-10-17T09:25:13+00:00\",\"dateModified\":\"2026-07-15T14:00:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/\"},\"wordCount\":2152,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Ultimate-Guide-scaled.png\",\"keywords\":[\"ANYRUN\",\"cybersecurity training\",\"malware analysis\"],\"articleSection\":[\"Instructions on ANY.RUN\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/\",\"name\":\"A Guide to Malware Analysis with a Sandbox\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Ultimate-Guide-scaled.png\",\"datePublished\":\"2023-10-17T09:25:13+00:00\",\"dateModified\":\"2026-07-15T14:00:05+00:00\",\"description\":\"Discover how you can analyze malware using the free ANY.RUN sandbox and collect indicators of compromise of the latest threats.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#primaryimage\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Ultimate-Guide-scaled.png\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/Ultimate-Guide-scaled.png\",\"width\":2560,\"height\":1243,\"caption\":\"Ultimate guide to Malware analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/malware-analysis-in-a-sandbox\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Instructions on ANY.RUN\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/category\\\/instructions\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Malware Analysis in ANY.RUN: The Ultimate Guide\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/any.run\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/www.any.run\\\/\",\"https:\\\/\\\/x.com\\\/anyrun_app\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/30692044\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/author\\\/a-bespalova\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A Guide to Malware Analysis with a Sandbox","description":"Discover how you can analyze malware using the free ANY.RUN sandbox and collect indicators of compromise of the latest threats.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"Malware Analysis in ANY.RUN: The Ultimate Guide\u00a0","datePublished":"2023-10-17T09:25:13+00:00","dateModified":"2026-07-15T14:00:05+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/"},"wordCount":2152,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Ultimate-Guide-scaled.png","keywords":["ANYRUN","cybersecurity training","malware analysis"],"articleSection":["Instructions on ANY.RUN"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/","url":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/","name":"A Guide to Malware Analysis with a Sandbox","isPartOf":{"@id":"https:\/\/any.run\/"},"primaryImageOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#primaryimage"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Ultimate-Guide-scaled.png","datePublished":"2023-10-17T09:25:13+00:00","dateModified":"2026-07-15T14:00:05+00:00","description":"Discover how you can analyze malware using the free ANY.RUN sandbox and collect indicators of compromise of the latest threats.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#primaryimage","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Ultimate-Guide-scaled.png","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/Ultimate-Guide-scaled.png","width":2560,"height":1243,"caption":"Ultimate guide to Malware analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Instructions on ANY.RUN","item":"https:\/\/any.run\/cybersecurity-blog\/category\/instructions\/"},{"@type":"ListItem","position":3,"name":"Malware Analysis in ANY.RUN: The Ultimate Guide\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/x.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=5988"}],"version-history":[{"count":59,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5988\/revisions"}],"predecessor-version":[{"id":22130,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5988\/revisions\/22130"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/22089"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=5988"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=5988"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=5988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}