thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Sandbox Evasion

Techniques malware uses to detect analysis environments and alter or delay its behavior to avoid detection.

Definition

Malware checks for virtual machine artifacts, debuggers, low uptime, lack of user activity or small disk sizes, and may sleep for long periods to outlast sandbox timeouts. If it detects analysis, it behaves benignly. Analysts counter with realistic sandboxes, time acceleration and bare-metal analysis.

Example

A sample that exits immediately if it finds VMware Tools processes or fewer than two CPU cores.

Exam tip

A sample that behaves benignly in the sandbox does not prove it is safe.

Related terms