Sandbox Evasion: Malware Environment Check

Environment presets

Sandbox indicators

⏱ System uptime

🖱 User activity history

🖥 Virtualization artifacts

⏩ Analysis timing

The sample checks every indicator itself. Any one sandbox-like reading is enough to keep it dormant — it only unleashes its payload once all four look like a genuine victim machine.

How it works

Automated malware sandboxes execute a suspicious sample in an isolated, instrumented VM to observe its behavior safely. Sophisticated malware fights back with anti-analysis logic: before doing anything malicious, it fingerprints its own environment and compares it against what a real, long-used victim PC should look like.

sandboxLike = uptimeShort OR noMouseHistory
              OR vmArtifactsPresent OR timingAccelerated
verdict = sandboxLike ? "stay dormant" : "unleash payload"

Uptime — sandboxes are usually booted fresh for each sample, so an uptime of minutes is suspicious; a victim machine has usually been running for days.
Mouse / document history — automated sandboxes rarely simulate a real user's cursor trail or a folder of recently opened files.
Virtualization artifacts — hypervisor-only device names, MAC prefixes and driver signatures betray a VM even when everything else looks convincing.
Analysis timing — some sandboxes accelerate simulated time to finish analysis faster; the malware can detect the mismatch between wall-clock and system ticks.

This is an OR-of-suspicions rule, not an AND: one leftover artificial signal is enough to keep the sample looking harmless in the analyst's report, while a genuinely clean profile across all four lets it strike.

Malware's live verdict

— awaiting environment check —

Sandbox signals

0 / 4

Runs

Files encrypted

Stayed dormant

Payload fired

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.