The auto-start methods this platform can detect, grouped by family. This scan had no dynamic layer, so none of them were watched - the rows below say what CAN be detected, not what was.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis indicates that the sandbox environment did not execute the sample, as evidenced by the `run_integrity.failed` being true and `run_integrity.reached_sample` being false. This means that the analysis agent never started, and therefore, no behavior or capabilities could be observed from the file. As a result, there is no evidence to support any conclusions regarding the file's potential malicious activity or its characteristics. The verdict is that the run is not evidence about the file.

No evasive checkpoints detected.

rule auto_file_2366_yara
{
    meta:
        description = "Auto-generated from scan 2366"
        author = "sandbox auto-generator"
        anchors = "3 independent regions"
    strings:
        $s0 = "prove that a submission, a poll and a report retrieval work end to end." ascii fullword
        $s1 = "This file is a benign integration test artifact for Malwagon." ascii fullword
        $s2 = "It contains no code and performs no action. Its only purpose is to" ascii fullword
    condition:
        filesize < 65536 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).