CWSandbox is an automated malware analysis sandbox. It works by running suspected malware samples in a simulated Windows OS. So as opposed to trying to break into the malware code to see what it does, we simply run it in a live environment. That way we can monitor all the network traffic that the malware generates. All of the processes that are created, the DLLs that are loaded, any changes to the Windows registry and even what itís doing to the file system.

This is achieved by using a technique called API hooking. That basically means that when the malware calls the Windows application programmersí interface to say something like "connect to this IP address" or "modify this file" itís actually going to CWSandboxís monitoring software, which logs the action and goes ahead and makes the change.

Itís kind of like an operating system man-in-the-middle. For malware. So once a suspected malware sample is run through the tool you get a computer generated report of what the executable is actually doing. And this can be fed into anti-virus and intrusion detection systems to monitor for similar behavior.