analysis_time
|
integer
|
Sample run time in seconds, from 30 to 300 . By default, analysis_time=60.
|
No
|
format_name
|
string
|
File format.
|
Yes if the format is not identified automatically
|
platforms
|
array [string]/null
|
Platforms to run the sample.
|
No
|
custom_cmd
|
string/null
|
Command to run the sample.
|
No
|
net
|
string
|
Command to redirect virtual machine network traffic according to specified settings.
•VPN = vpn:// (used by default if the net parameter is not specified) •TOR = tor:// •Socks4 = socks4://host:port •Socks5 = socks5://[login:password@]host:port?parameters •Shadowsocks = shadowsocks://[login:password@]host:port?parameters Possible values for parameters:
udp—UDP protocol behavior (udp=on redirects all UDP traffic, udp=off does not redirect traffic);
login:password—proxy server authorization parameters (optional for Socks5, required for Shadowsocks).
|
No
|
dump_size_limit
|
integer
|
Maximum size of collectable drops.
|
No
|
copylog
|
boolean
|
Copy full raw hypervisor log.
|
No
|
crypto_api_limit
|
integer
|
Crypto API buffers limit in MB.
|
No
|
drop_size_limit
|
integer
|
Total size limit for created files.
|
No
|
flex_time
|
boolean
|
Sample flex time.
|
No
|
forwards
|
string/null
|
Forward the specified ports from guest VM.
|
No
|
get_lib
|
boolean
|
Get *.lib files and raw dumps.
|
No
|
injects_limit
|
integer
|
Injects count limit.
|
No
|
monkey_clicker
|
boolean
|
Enable auto clicker.
|
No
|
dump_browsers
|
string
|
Dump browser modules.
|
No
|
dump_mapped
|
boolean
|
Dump memory-mapped files (only after execution).
|
No
|
dump_ssdt
|
boolean
|
Dump SSDT.
|
No
|
dump_processes
|
boolean
|
Dump processes (only after execution).
|
No
|
no_clean
|
boolean
|
Get all allocs and drops.
|
No
|
optional_count
|
integer/null
|
Maximum number of triggered breakpoints.
|
No
|
proc_lifetime
|
string/null
|
Lifetime of processes in seconds.
Example:
'notepad.exe,35,winword.exe,20
|
No
|
set_date
|
string
|
Set system date (format: 17.03.2022).
|
No
|
write_file_limit
|
integer
|
WriteFile buffers limit in MB.
|
No
|