SandBox Technology
Norman has pioneered new advancements in reverse engineering technologies over the past decade and antivirus enhancements for over two decades. Years of real world testing and enhancements in Norman’s analysis labs have resulted in Norman’s proactive SandBox technology. SandBox is now one of the main components used to process the multitude of samples Norman and many other organizations receive each day. SandBox provides for a full simulation of potentially malicious executable code in a safe environment. The underlying SandBox technology simulates a Windows based computer system. SandBox emulates all hardware and software used in a real Windows environment, as well as necessary network services. The file to be analyzed is loaded into the simulated hard disk and started in the simulated Windows environment. Inside the simulated environment, the file will behave as it would in a real computer system. This behavior is observed by the SandBox as the SandBox emulator itself is responsible for processing all the file code. As a proprietary technology, Norman has full control to tailor the environment to current and future forensic needs and adapt to emerging threats.
Exploit Code
SandBox Analyzer products now have the ability to not only detect and analyze executable code, but also exploit code concealed in Microsoft Office as well as other popular exploitable file formats. Arbitrary code execution is becoming a greater problem every day, especially when they come in the form of a zero day exploit. The ability to quickly understand these exploits using Norman’s SandBox technology saves analysts a great deal of effort, not to mention the avoidance of impact this will have upon users and organizations.
Advanced Packer Support
Packers are increasing in use, with trends moving toward more complex protectors like Themida, Enigma, and Slovak Protector(SVKP). These technologies are readily available as both free and commercial applications, making it easy for any malware author not skilled enough to write self defending codes themselves, to build it into their malicious applications. In general, packers and protectors are not a problem for SandBox. As a fully emulated Windows system, the executable will simply run through the protection mechanisms as it would on real system.
Rootkits
Norman SandBox is able to detect rootkit activity when malicious code attempts to inject its own code or custom behavior into other applications, drivers, or the host SandBox operating system.