skip to navigation
skip to content

sandboxapi 1.1.0

A minimal, consistent API for building integrations with malware sandboxes

A minimal, consistent API for building integrations with malware sandboxes.

This library currently supports the following sandbox systems:

It provides at least the following methods for each sandbox:

  • is_available(): Check if the sandbox is operable and reachable; returns a boolean
  • analyze(handle, filename): Submit a file for analysis; returns an item_id
  • check(item_id): Check if analysis has completed for a file; returns a boolean
  • report(item_id, report_format='json'): Retrieve the report for a submitted file
  • score(report): Parse out and return an integer score from the report object

Some sandbox classes may have additional methods implemented. See inline documentation for more details.

Note that the value returned from the score method may be on the range 0-10, or 0-100, depending on the sandbox in question, so you should refer to the specific sandbox’s documentation when interpreting this value.


Install through pip:

pip install sandboxapi

Supports Python 2.6+.


Basic usage is as follows:

import sys
import time
import pprint

from sandboxapi import cuckoo

# connect to the sandbox
sandbox = cuckoo.CuckooAPI('')

# verify connectivity
if not sandbox.is_available():
    print("sandbox is down, exiting")

# submit a file
with open('myfile.exe', "rb") as handle:
    file_id = sandbox.analyze(handle, 'myfile.exe')
    print("file {f} submitted for analysis, id {i}".format(f=filename, i=file_id))

# wait for the analysis to complete
while not sandbox.check(file_id):
    print("not done yet, sleeping 10 seconds...")

# print the report
print("analysis complete. fetching report...")
report =
print("Score: {score}".format(score=sandbox.score(report)))


Constructor signature:

CuckooAPI(host, port=8090, api_path='/', verify_ssl=False)



There is an unofficial Cuckoo library written by @keithjjones with much more functionality. For more information on the Cuckoo API, see the Cuckoo API documentation.


Constructor signature:

FireEyeAPI(username, password, url, profile)


FireEyeAPI('myusername', 'mypassword', '', 'winxp-sp3')

There is some limited FireEye API documentation on their blog. For more information on FireEye’s sandbox systems, see the AX Series product page.


Constructor signature:

JoeAPI(apikey, apiurl, accept_tac, timeout=None, verify_ssl=True, retries=3)


JoeAPI('mykey', '', True)

There is an official Joe Sandbox library with much more functionality. This library is installed as a dependency of sandboxapi, and wrapped by the sandboxapi.joe.JoeSandbox class.


Constructor signature:

VMRayAPI(api_key, url='')



VMRay customers have access to a Python library with much more functionality. Check your VMRay documentation for more details.


Constructor signature:

FalconAPI(key, secret, url='', env=100)


FalconAPI('mykey', 'mysecret')

There is an official Falcon library with much more functionality, that only supports Python 3.4+.


You may also be interested in malsub, a similar project with support for a number of online analysis services.

File Type Py Version Uploaded on Size
sandboxapi-1.1.0-py2.7.egg (md5, pgp) Python Egg 2.7 2018-01-30 32KB
sandboxapi-1.1.0.tar.gz (md5, pgp) Source 2018-01-30 18KB