Sandframe
Automated Malware Analysis & Detonation Sandbox
Enterprise-grade, self-hosted automated malware analysis and detonation sandbox platform built for SOC analysts, incident response teams, and security researchers.
The Threat Landscape & Sandbox Necessity
Modern SOC teams and incident response analysts handle an escalating torrent of suspicious binaries and malicious URLs every day. Commercial cloud detonation platforms pose critical privacy risks because uploading proprietary internal binaries to third-party multitenant clouds can leak sensitive company code and intellectual property.
Furthermore, many existing sandboxes rely on black-box heuristics or simulated guest telemetry that trigger anti-analysis evasion tactics or produce unexplainable risk scores without transparent mathematical grounding.
Sandframe was engineered from scratch as an enterprise-grade, 100% self-hosted detonation sandbox. It executes safe, isolated dynamic detonation of untrusted PE, DLL, ELF, and script payloads alongside deep multi-engine static analysis, authentic cryptographic validation, and automated MITRE ATT&CK matrix mapping in a cyber-glass interface.
Core Capabilities & Defensive Hardening
Dual Analysis Pathways with Detonation Gating
Strict magic-byte structural inspection inspects files prior to execution. Non-executable files (e.g., .txt, .md, .pdf) are safely processed via Static Analysis Only, preventing fabricated dynamic execution narratives.
Authentic Cryptographic & SSDEEP Hashing
Computes MD5, SHA-1, and SHA-256 digests alongside resilient Context Triggered Piecewise Hashing (CTPH) using native ssdeep C extensions with pure-Python rolling hash fallbacks.
Authenticode Chain Verification (Anti-Spoofing)
Prevents self-signed signature spoofing by verifying full cryptographic chain trust via OS-level APIs. Genuine chain-verified binaries from known trusted authorities receive calibrated score suppression (-40 pts).
Deterministic Structural Threat Scoring
Transparent scoring engine calculated from real evidence: YARA matches (15 pts, cap 40), section entropy > 7.2 (10 pts), MITRE techniques (3 to 12 pts, cap 50), malicious C2 IOCs (5 pts, cap 30), and Suricata IDS alerts (5 to 10 pts). Categorized into Benign (0 to 30), Suspicious (31 to 70), and Malicious (71 to 100).
Automated MITRE ATT&CK v14 Alignment
Normalized behavioral events automatically map to MITRE ATT&CK tactics (T1055 Process Injection, T1547.001 Registry Persistence, T1003.001 LSASS Credential Dumping) generating real-time ATT&CK heatmaps.
Cyber-Glass Forensic Dashboard & Export Suite
Interactive process trees, timeline visualizers, network PCAP inspection, and certified forensic reports exported in JSON, HTML, and PDF formats.
Detonation & Analysis Pipeline
Every incoming artifact traverses a strictly gated five-stage security pipeline guaranteeing full behavioral isolation and mathematically sound verdicts.
Ingestion & Magic Byte Gating
Files are ingested via REST API. Magic bytes and structural headers determine executability. Executables are queued for microVM isolation; non-executables route to static inspection.
Static Decomposition & YARA Matching
Extracts PE/ELF headers, section entropy, fuzzy SSDEEP hashes, imports, exports, and runs compiled YARA rule engines against binary byte streams.
Isolated Hypervisor Detonation
Executables run inside disposable guest virtual machines with active Sysmon ETW and Linux eBPF kernel hooks to record API hooks, file modifications, and network connections.
Normalization & MITRE Technique Tagging
Raw operating system telemetry is parsed and mapped directly to MITRE ATT&CK v14 techniques, matching behavior against known threat actor playbooks.
Verdict Generation & Forensic Report Export
The deterministic scoring engine tallies evidence points, computes corpus distributions using the Hare-Niemeyer method, and compiles complete forensic reports.
Artifact Analysis & Screenshots
Click any image to inspect forensic details, telemetry graphs, and terminal outputs at high resolution.
Sandframe Cyber-Glass Detonation Console
Main Telemetry Dashboard & Active Detonation QueueThe central Sandframe operator dashboard displaying system health metrics, real-time worker queue, verdict distribution breakdown, and the recent detonated samples feed.
Malicious Sample Detonation Report
84/100 Malicious Threat Score & MITRE Technique BreakdownForensic report view of an evasive trojan binary showing the exact points tally (+15 YARA match, +12 T1055 Process Injection, +10 high entropy), detected network IOCs, and full process execution tree.
Benign Sample Verification & Authenticode Audit
Cryptographic Chain Validation & Authenticode SuppressionAnalysis view of a verified benign binary displaying genuine code-signing certificate verification, score suppression (-40 pts), and green Benign verdict badge.
MicroVM Guest Isolation
Zero live malware escapes; ephemeral guest snapshots restore instantaneously.
Hare-Niemeyer Distribution
Distribution calculations guarantee corpus percentages sum to exactly 100%.
Dual-Theme Cyber-Glass UI
Dark Slate (#111a26) and Pastel Sky Blue (#B4CDDD) with circuit trace graphics.
Network PCAP Inspection
Live Suricata IDS rules and packet capture analysis for malicious C2 domains.