🧪 Sandbox Malware Analyzer

Disposable, automated malware-analysis lab built on Windows Sandbox. Detonate suspicious files (executables, Office docs, PDFs, scripts, .eml, URLs, hashes) in a throwaway VM, capture behavioral artifacts, extract IOCs, and generate an HTML/JSON report — with nothing persistent on the host.

---

✨ Highlights

• Multi-format triage — executables, Office documents, PDFs, scripts, emails (.eml), URLs/domains and file hashes.
• Behavioral capture — process, network, file-system and registry activity during detonation.
• IOC extraction & enrichment — hashes, URLs, IPs and embedded objects, with optional external threat-intel validation.
• Built-in YARA scanning for signature-based triage.
• Automated reporting — human-readable HTML + machine-readable JSON.
• Safe by design — a fresh Windows Sandbox per run, read-only sample share, tools fetched on the fly, zero host residue.

🧩 How it works

sample ──► deploy_master_complete.ps1 ──► fresh Windows Sandbox
                                            │
              read-only input  C:\Sandbox\Input
                                            ▼
        per-type analyzer (exe / doc / pdf / eml / url / yara)
          + behavioral monitor + IOC extractor + TI validator
                                            ▼
              HTML + JSON report  C:\Sandbox\Output   ──► sandbox discarded

🚀 Quick start

Prerequisites: Windows 10/11 Pro or Enterprise, Windows Sandbox enabled, PowerShell 5.1+, administrator rights.

# 1) Enable Windows Sandbox (one-time, elevated PowerShell)
Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -Online -All
# (reboot if prompted)

# 2) Provision the lab
.\deploy_master_complete.ps1

# 3) Analyze a sample (drop it in C:\Sandbox\Input first)
.\scripts\analyze_exe.ps1   -FilePath   C:\Sandbox\Input\suspicious.exe
.\scripts\analyze_doc.ps1   -FilePath   C:\Sandbox\Input\invoice.docm
.\scripts\analyze_pdf.ps1   -FilePath   C:\Sandbox\Input\statement.pdf
.\scripts\analyze_yara.ps1  -TargetFile C:\Sandbox\Input\sample.bin

Reports are written to C:\Sandbox\Output as HTML + JSON. See QUICK_START.md for the full flow and GUIDE_TESTS_VALIDATION.md for validation tests.

📂 Repository layout

Path	Purpose
deploy_master_complete.ps1	Entry point — provisions the sandbox and folders
scripts/analyze_*.ps1	Per-type analyzers: exe, doc, pdf, eml, url, yara
scripts/comprehensive_ioc_extractor.ps1	IOC extraction (hashes, URLs, IPs, embedded objects)
scripts/behavioral_monitor.ps1	Runtime process / network / file activity capture
scripts/external_threat_intel_validator.ps1	Optional threat-intel enrichment
SafeScope_MasterComplete.wsb, SandboxAnalyzer.wsb	Windows Sandbox configuration profiles
QUICK_START.md, GUIDE_TESTS_VALIDATION.md	Usage and validation guides
legacy/	Older deployment iterations (archived for reference)

🔐 Security notes

• The sample is mounted read-only, and the sandbox is destroyed after every run — no malware or tooling persists on the host.
• No credentials are stored in this repo. Supply any API keys (e.g. threat-intel) at runtime via the configurator; never commit them.

📄 License

Released under the MIT License.

⚠️ Disclaimer

For authorized, defensive malware analysis and research only. Detonate live malware exclusively in isolated environments, and in accordance with your organization's policies and applicable law.