[Jaxryley]

In order to use Buster Sandbox Analyser you will need my favourite security app in being Sandboxie!
http://www.sandboxie.com/index.php?DownloadSandboxie

[__Genius__]

Are HBGary Fastdump & Flypaper free to use!?

[Meriadoc]

free for non-commercial use - HBGary

[wealllbe20]

Their are many crypters out their that block online and local sandboxes.

hxxp://www.level-23.com/foro/showthread.php?t=13153


many many more crypters out their.

These crypters do work.

If you try to run this anything crypted by these crypters inside a virtual machine or you are using sandboxie they will just simply not execute.

It makes it hard to do a full analysis on these specific types of malware.

[NOP]

They are kiddie crypters that generally crypt kiddie trojans, nothing interesting there for a malware researcher.

[wealllbe20]

They may be used by kiddies, but when these crypters/packers have things that include bypassing windows uac, blocking sand-boxing and anti-disassembler attributes associated with them.

It's makes some of these malware testing websites and labs useless and people who examine malware on a higher level should know about such things.

[EP_X0FF]

Most so called anti* tricks based on analyzing hardware components of system (driver/process names of VmWare/VPC/VBox) or searching for specific dll's (as in case of sandboxie).

[NOP]

When I find a sample that PEiD recognizes as Microsoft Visual Basic 5.0 / 6.0 or Borland Delphi 6.0 - 7.0, after a quick look to check whether it is actually a kiddie crypter I just bin it. They're all based off the same loading code and usually other open source code.

If the average user tests one of these files in a sandbox, and it comes up with absolutely nothing, they should be suspicous.

Most so called anti* tricks based on analyzing hardware components of system (driver/process names of VmWare/VPC/VBox) or searching for specific dll's (as in case of sandboxie).

Some just check things like the username, like CurrentUser to detect Norman sandbox. :lol:

[EP_X0FF]

Hello,

All discussions about sandboxes moved to separate thread.
If you have more links to online link checkers or online sandboxes feel free to post it here, sticky topic Sandboxes / Online Link checkers will be updated.

Thank you.

[wealllbe20]

had no idea, these techniques were so "kiddie"

Thanks guys for the clarification