The VMRay Platform is your starting point for comprehensive malware analysis and threat detection. Unlike traditional sandboxes, VMRay's agentless, hypervisor-based approach delivers deep visibility into file behavior across 30+ target environments. This fast-track guide walks you through the essential features you need to know—from uploading your first sample to interpreting detailed analysis reports.
Whether you're analyzing suspicious PDFs, executables, macOS binaries, or office documents, VMRay's dashboard provides an intuitive entry point to powerful threat detection. By combining reputation analysis, static scanning, and dynamic detonation in multiple environments, the platform gives you the comprehensive threat intelligence needed to make informed security decisions in minutes.
Getting Started: VMRay Dashboard Overview
The VMRay Dashboard is your starting point for using all VMRay platform products. It serves as a command center where you can launch analyses, track results, and access detailed threat reports. The dashboard's clean, intuitive interface makes it easy to navigate between products and quickly submit samples for analysis.
Your first step is simple: upload a file. The Analyzer product—VMRay's core malware analysis engine—begins with a straightforward file upload mechanism. Once you're familiar with the dashboard, you'll understand how to leverage the full power of the platform's advanced analysis capabilities.
File Upload & Sample Submission Process
Submitting a sample to VMRay is as simple as dragging and dropping a file into the upload sample box on the dashboard. The platform automatically recognizes the file type—whether it's a PDF, executable, email, or office document—and displays it on the sample submission page.
Once you've uploaded a file, you'll see the sample type field, which VMRay automatically populates based on the file's characteristics. If needed, you can manually adjust this by clicking the sample type drop-down. This flexibility ensures that VMRay correctly interprets your file, even if its extension doesn't match its actual format—a common occurrence with malware that disguises itself.
Key insight: VMRay's automatic file type detection saves time and reduces analysis errors. The platform recognizes dozens of file formats out of the box, so your samples are analyzed with the correct settings from the start.
Supported File Types & Coverage: What VMRay Can Analyze
One of VMRay's key strengths is its broad support for file types. The platform doesn't just handle common threats like Windows executables—it supports a vast range of formats that malware authors use to evade detection.
Email & Archive Formats
Emails, PST files, and compressed archives are automatically extracted and analyzed. VMRay unpacks nested archives and scans each component, exposing hidden malware layers.
Executables & Scripts
Windows PEs, ELF binaries, scripts, and macOS Mach-O files are all supported. VMRay detonates these in appropriate environments to observe real-world malware behavior.
Office Documents
Word, Excel, PowerPoint, and other office formats are analyzed for macro-based threats, embedded objects, and exploit attempts targeting vulnerable applications.
Specialized Formats
PDFs, mobile APKs, Docker images, and other specialized formats receive comprehensive analysis tailored to their unique threat vectors.
Dynamic Analysis & Target Environments: 30+ Testing Platforms
Dynamic analysis is the key to VMRay's power. Unlike static analysis alone, which examines file structure without execution, dynamic analysis actually detonates files in isolated target environments and observes their behavior in real-time. This reveals what malware does—and attempts to do—in a safe, controlled setting.
For a single PDF file, VMRay offers over 30 target environments, including Windows 10 and Windows 7 in both 64-bit and 32-bit versions. For PDFs specifically, the platform includes multiple versions of Adobe Acrobat Reader and Acrobat Pro, ensuring your files are tested against the applications they're likely to target.
When you submit a sample, you can select all target environments or manually choose which ones to test. This flexibility lets you focus analysis on the platforms most relevant to your threat model—or run comprehensive testing across all supported environments for maximum confidence.
Why multiple environments matter: Malware behavior varies across OS versions, application versions, and system configurations. VMRay's 30+ environments ensure you catch threats that target specific platform combinations, not just the most common configurations.
Three-Step Analysis Framework: Reputation, Static, Dynamic
VMRay performs three complementary types of analysis on every file. Understanding this framework is essential to interpreting results and recognizing when a file requires deeper investigation.
Step 1: Reputation Analysis
VMRay performs a rapid reputation check against threat intelligence feeds and known malware databases. If a file is already known to be malicious, suspicious, or benign, the reputation verdict surfaces immediately—no need to wait for dynamic analysis.
Step 2: Static Analysis
Static analysis examines file structure, embedded code, and metadata without executing the file. YARA rules, antivirus signatures, and heuristic checks identify known malware patterns, exploit indicators, and behavioral anomalies.
Step 3: Dynamic Analysis
Dynamic analysis detonates the file in target environments using VMRay's agentless, hypervisor-based sandbox. This reveals actual malware behavior: process execution, network communication, file system modifications, and registry changes.
Default Configuration
By default, all three analysis types are enabled. You can customize this in the Advanced settings if you prefer to skip reputation or static checks—though running all three provides the most comprehensive threat detection.
This three-step approach means faster threat detection (reputation may resolve in seconds) combined with deeper analysis (dynamic testing takes minutes but reveals true malware intent).
Tracking & Interactive Analysis: Observing Malware Behavior in Real-Time
Once you've submitted a sample, you can track its progress on the dashboard. The overall sample verdict appears once analysis is complete, and you can click any row to access detailed results on the sample overview page.
The sample overview shows the status of each analysis type: reputation verdict, static analysis result, and the progress of dynamic analysis jobs across your selected target environments. You'll see which analyses are queued, in progress, or complete—and verdicts for each.
For the most insight into malware behavior, select Interactive Analysis from the action menu. This lets you observe the file's detonation in real-time as it executes in the target environment. You'll watch process execution, network calls, and file system activity unfold—giving you a firsthand look at what the malware actually does.
Interactive analysis is powerful for: Understanding attack chains, verifying threat severity, reverse engineering malware techniques, and creating detection rules based on observed behavior.
Understanding Sample Verdicts & Threat Determination
A sample verdict is VMRay's summary judgment of a file: is it malicious, suspicious, or benign? Each analysis type contributes a verdict, and the platform synthesizes these into an overall assessment.
Verdict categories include Clean (benign file with no threat indicators), Malicious (confirmed threats), Suspicious (behavior patterns consistent with malware but not definitively identified), and N/A (no existing information found—common for new or obscure files). Understanding these categories helps you make informed decisions about which samples require deeper investigation or incident response.
When all three analysis types are complete, their verdicts determine the overall sample verdict. In the walkthrough example, reputation returned N/A (no prior threat intelligence), static returned Clean (no suspicious signatures), and dynamic returned Clean across all six target environments. The result: an overall verdict of Clean, indicating low threat risk.
This multi-step approach provides confidence in your threat judgments. If reputation flags a file as malicious but static and dynamic return clean, you have clear evidence to investigate further. Conversely, agreement across all three types gives you high confidence in your verdict.
Frequently Asked Questions
How long does dynamic analysis take?
⋮Dynamic analysis typically completes within minutes, depending on file complexity and the number of target environments selected. Reputation and static analysis complete within seconds. You can use interactive analysis to observe progress in real-time.
Do I need to manually select target environments?
⋮No—VMRay defaults to analyzing your file across all available target environments. You can manually deselect environments if you want to focus on specific platforms or reduce analysis time. Most users benefit from comprehensive testing across all environments.
What does "N/A" verdict mean?
⋮N/A (Not Available) means VMRay's reputation analysis found no prior threat intelligence about the file. This is common for new files, custom malware, or benign files that haven't been analyzed before. Static and dynamic analysis still proceed to give you a complete threat assessment.
Can I analyze suspicious PDFs safely?
⋮Yes—VMRay's agentless sandbox is completely isolated. Malware executed during dynamic analysis cannot escape to your network or production systems. The platform includes multiple Acrobat versions specifically for PDF threat detection.
What file types does VMRay support?
⋮VMRay supports dozens of file types: Windows executables, macOS binaries, emails, archives, PDFs, office documents, scripts, APKs, Docker images, and many more. The platform automatically detects file type and applies appropriate analysis settings.
How does VMRay differ from antivirus scanning?
⋮Antivirus relies on signatures and static heuristics. VMRay adds dynamic detonation—actually running files in isolated environments to observe real-world behavior. This catches sophisticated malware, zero-days, and targeted threats that signature-based detection misses.
Can I export analysis results?
⋮Yes—VMRay provides detailed reports including screenshots, process maps, file involvement data, YARA rule matches, and indicators of compromise (IOCs). You can export these for integration into your security tools and documentation.
What's the difference between agentless and traditional sandboxes?
⋮Traditional sandboxes use agents (monitoring software) running inside the test environment, which malware can often detect and evade. VMRay's hypervisor-based approach monitors from outside the OS, making detection/evasion much harder. You get more accurate malware behavior insights.
How do I interpret detailed analysis reports?
⋮After analysis completes, click the sample row to see the overview page. Key tabs show screenshots (visual execution progression), process maps (execution flow), files involved, YARA rule matches, and indicators of compromise. Start with the verdict summary, then drill into specific tabs based on your investigation goals.
Start Analyzing Threats with VMRay Today
Get started with the VMRay Platform and discover comprehensive malware analysis across 30+ target environments. Reputation, static, and dynamic analysis work together to give you the threat intelligence you need—fast.
Start Your Free Trial Learn More