http://sandbox.norman.no/live_4.html
Basically you can upload any file or files, toss in an email address, and in about 5 minutes or less you have an analysis like this one in your inbox:
QUOTE
Norman Scanner Engine 5.70. 24
Sandbox 05.70, dated 12/11-2004
Your message ID (for later reference): *edited*
Informations.txt .exe : Not detected by sandbox (Signature: Netsky.Z@mm)
[ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* File might be compressed.
* File length: 31491 bytes.
[ Changes to filesystem ]
* Creates file C:\WINDOWS\Jammer2nd.exe.
* Creates file C:\WINDOWS\pk_zip_alg.log.
* Creates file C:\WINDOWS\pk_zip1.log.
* Creates file C:\WINDOWS\pk_zip2.log.
[ Changes to registry ]
* Creates value "Jammer2nd"="C:\WINDOWS\Jammer2nd.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
[ Process/window information ]
* Will automatically restart after boot (I'll be back...).
* Creates a mutex (S)(k)(y)(N)(e)(t).
© 2004 Norman ASA. All Rights Reserved.
The material presented is distributed by Norman ASA as an information source only.
Sent by *edited*. Processed *edited* at *edited* POP3: sandbox
Sandbox 05.70, dated 12/11-2004
Your message ID (for later reference): *edited*
Informations.txt .exe : Not detected by sandbox (Signature: Netsky.Z@mm)
[ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* File might be compressed.
* File length: 31491 bytes.
[ Changes to filesystem ]
* Creates file C:\WINDOWS\Jammer2nd.exe.
* Creates file C:\WINDOWS\pk_zip_alg.log.
* Creates file C:\WINDOWS\pk_zip1.log.
* Creates file C:\WINDOWS\pk_zip2.log.
[ Changes to registry ]
* Creates value "Jammer2nd"="C:\WINDOWS\Jammer2nd.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
[ Process/window information ]
* Will automatically restart after boot (I'll be back...).
* Creates a mutex (S)(k)(y)(N)(e)(t).
© 2004 Norman ASA. All Rights Reserved.
The material presented is distributed by Norman ASA as an information source only.
Sent by *edited*. Processed *edited* at *edited* POP3: sandbox
Pretty freakin' cool...I have to really give props to Norman for making this available on the web to the general public...even if security geeks like myself are the only ones that end up using it!
