This page contains a list of freely accessible online malware sandboxes and analytical platforms that I currently find most useful, along with a short overview of their capabilities. The list is (and it is meant to be) non-exhaustive, but if you know of any sandbox which is not mentioned but offers interesting features, feel free to let me know about it.
If you’d like to use the table in a presentation or share it on some other site, there is a PNG version bellow to make it easier.
Current version: 1.8 (12/2021)
| Name | Interactive | OS | Max. runtime duration | Max input size | File number limits | URL submission | API access | Requires registration | Note |
|---|---|---|---|---|---|---|---|---|---|
| Amnpardaz SandBox | ✘ | XP SP2 | Not specified | 20 MB | Not specified | ✘ | ✘ | Requires an e-mail address for each analysis | |
| Any.Run | ✔ | W7 32bit | 300 seconds | 16 MB | ✘ | ✔ | ✘ | ✔ | |
| CAPEv2 Sandbox | ✘ | W7 32bit W7 64bit |
Not specified | 30 MB | Limits for API use | ✘ | ✔ | ✘ | * Offers PCAP analysis as well |
| Hatching Triage | ✔ | W7 64bit W10 64 bit W11 64 bit macOS 10.15 64 bit Linux 64 bit Linux ARM Linux MIPS Android 9 32 bit Android 10-11 64 bit |
1800 seconds | No limit | ✘ | ✔ | ✔ | ✔ | * 1 GB+ file sizes supported * Offers direct analysis of copy-pasted VBS, JS and PS code as well |
| Hybrid Analysis | ✘ | W7 32bit W7 64bit Linux Android (static analysis only) |
360 seconds | 100 MB | Limits for API use | ✔ | ✔ | Registration required for API use | |
| Intezer Analyze | ✘ | N/A | N/A | 16 MB | 50 files per month | ✘ | ✔ | ✔ | * Analysis of binaries and applications (PE, ELF and APK) * Performs very complex static analysis |
| IRIS-H Digital Forensics | ✘ | N/A | N/A | 10 MB | Not specified | ✘ | ✘ | ✘ | * Analysis of malicious documents (Office formats, PDFs and LNKs) * Not a "true" sandbox - only static analysis, but worth mentioning |
| OPSWAT MetaDefender | ✘ | W7 64bit W10 64bit |
300 seconds | 140 MB | Limits for API use | ✔ | ✔ | ✘ | |
| Pikker | ✘ | W7 64bit Linux Android |
600 seconds | Not specified | Not specified | ✔ | ✘ | ✘ | * A free-to-use Cuckoo sandbox |
| VirusTotal | ✘ | Unspecified | N/A | Not specified | Limits for API use | ✔ | ✔ | ✘ | * Automated multisandbox analysis of submitted samples |
Direct URL: https://untrustednetwork.net/images/misc/free-malware-analysis-sandboxes-overview-current.png
