A deep malware analysis platform that automates static, dynamic, hybrid, and AI-driven analysis of files and URLs across Windows, macOS, Linux, and Android. It produces detailed behavioral reports and can run on physical machines to defeat VM-evasive threats.
.avif)
What is Joe Sandbox?
Joe Sandbox is a professional-grade malware analysis platform that combines static, dynamic, hybrid, and AI-driven analysis techniques to produce comprehensive behavioral reports on suspicious files and URLs. It supports analysis across Windows, macOS, Linux, Android, and iOS environments, and uniquely offers the ability to run samples on physical hardware rather than virtual machines, defeating malware that detects and evades sandbox environments. Its analysis captures the full execution chain: process injection, persistence mechanisms, network callbacks, encryption routines, and anti-analysis techniques. Joe Sandbox also includes automated MITRE ATT&CK mapping, signature detection, and IOC extraction, making the output immediately actionable for SOC analysts and threat hunters. The platform can be deployed on-premise for organizations with strict data handling requirements.
How does Joe Sandbox work with Qevlar?
Qevlar uses Joe Sandbox to analyze suspicious files and URLs encountered during automated investigations. When an alert involves an attachment, a downloaded file, or a suspicious URL, Qevlar can submit it to Joe Sandbox and wait for the behavioral verdict before proceeding with the investigation, ensuring that the analysis is grounded in actual execution behavior rather than assumptions.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What does Joe Sandbox do?
Joe Sandbox is a deep malware analysis platform that combines static, dynamic, hybrid and AI-driven analysis of files and URLs across Windows, macOS, Linux, Android and iOS — and can run samples on physical machines to defeat VM-evasive threats.
What can you do with Joe Sandbox in Qevlar?
Qevlar can submit suspicious files and URLs to Joe Sandbox during an investigation and wait for the behavioral verdict before proceeding, so analysis is grounded in real execution behavior rather than assumptions.
Does Qevlar detonate samples automatically?
Yes. When an alert involves an attachment, a downloaded file or a suspicious URL, Qevlar handles the submission and uses the resulting verdict and extracted IOCs in the investigation.
Can Joe Sandbox results drive the rest of the investigation?
Yes. IOCs and ATT&CK mappings from a detonation are pivoted across your connected tools to find related activity and establish the scope of the threat.
Other integrations
