Toolsmith: Buster Sandbox Anayzer

Introduction On April 10th, 2012 a new version of Sandboxie was released, and on April 16th so too was a new version of the Buster Sandbox Analyzer which uses Sandboxie at its core. Voila! Instant toolsmith fodder. It’s been a few months since we’ve covered a malware analysis-specific tool so the timing was excellent. Buster Sandbox Analyzer is intended for use in analysis of process behavior and system changes (file system, registry, ports) during runtime for evaluation as suspicious. You’ll find it listed among the Sandbox Tools for Malware Analysis on one of my favorite Internet resources, Grand Stream Dreams. As always, I pinged the developer and Pedro Lopez (pseudonym) provided me with a number of insightful details. He releases new versions of Buster Sandbox Analyzer on a fairly regular basis, version 1.59 is current as I write this. There’s an update mechanism built right into BSA; just click Updates then Check for Updates. Pedro has recently improved static analysis and he’s always trying to improve dynamic analysis as he considers it the most important aspect of the tool. For future releases the TO-DO list is short given over two years of constant development. The following features are planned for: • A feature to analyze URLs in automatic mode. • Utilizing the information stored in the SQL database, a feature to generate statistics including used compressors, detected samples, and others.

Read more
http://holisticinfosec.blogspot.co.uk/2012/05/toolsmith-buster-sandbox-anayzer.html
Buster Sandbox Analyzer
http://bsa.isoftware.nl/
Sandboxie
http://www.sandboxie.com/