Configuration
3.0.0
Search this version
Configuration
Configuration
Architectural Overview
FRONTEND CONFIGURATION
Title
Message
Create new category
What is the title of your new category?
Edit page index title
What is the title of the page index?
Edit category
What is the new title of your category?
Edit link
What is the new title and URL of your link?
Static Analysis
Copy Markdown
Open in ChatGPT
Open in Claude
Step #1 - Open /home/sandbox/sandbox/transform.cfg in a text editor
Step #2 - Modify the configuration by adding or modifying the properties on this page
Step #3 - Save the file and restart the sandbox service
URLs
Enable domain resolver, IP stack Geolocation and Hexillion WHOIS domain lookups
IP Geolocation lookup will be executed on resolved domains
transform.cfg
runDomainResolver=truedomainResolveMaxResolves=20runDomainResolveDistributedTimeoutMs=60000| Property name | Default value | Description |
|---|---|---|
| runDomainResolver | true | Switch to enable / disable domain resolving |
| domainResolveMaxResolves | 20 | Domain resolver limit, '0' means no limit |
| runDomainResolveDistributedTimeoutMs | 1 minute | Execution timeout |
transform.cfg
runWhoisRecordLookups=truerunHexillionLookupTimeoutMs=30000runHexillionLookupMaxLookups=30hexillionUrl=https://hexillion.com/rf/xml/1.0/whois/?query=$domainhexillionUsername=hexillionPassword=| Property Name | Default Value | Description |
|---|---|---|
| runWhoisRecordLookups | true | Switch to enable / disable WHOIS lookups |
| runHexillionLookupTimeoutMs | 30 seconds | Execution timeout |
| runHexillionLookupMaxLookups | 30 | Lookup limit, '0' means no limit |
| hexillionUrl | https://hexillion.com/rf/xml/1.0/whois/?query=$domain | API URL |
| hexillionUsername | API username | |
| hexillionPassword | API password |
Office Documents
Enable static analysis for Microsoft Office documents
transform.cfg
runContentParser=truerunContentParserDirectTimeoutMs=10000| Property name | Default value | Description |
|---|---|---|
| runContentParser | true | Switch to enable / disable Office document static analysis |
| runContentParserDirectTimeoutMs | 10 seconds | Execution timeout |
OLE Files
Enable parsing OLE files
transform.cfg
runOledumpOnOLEFiles=truerunOledumpBiffOnXLSFiles=trueoledumpExecutionTimeout=30oledumpMaxFileSizeInKb=1024| Property name | Default value | Description |
|---|---|---|
| runOledumpOnOLEFiles | true | Switch to enable / disable OLE parsing |
| runOledumpBiffOnXLSFiles | true | Enable or disable parsing of BIFF records |
| oledumpExecutionTimeout | 30 seconds | Execution timeout |
| oledumpMaxFileSizeInKb | 1 MB | File size limit |
PE Files
Enable executable file parsing, unpacking and disassembly
transform.cfg
x
# UPX unpackingrunUpxUnpacker=true# UnipackerrunUnipackerOnPEFiles=trueunipackerExecutionTimeout=50unipackerIgnorePackers=delphi,nullsoftunipackerMaxFileSizeInKb=2048# AutoIt unpackingrunAutoItRipper=true# Python unpackingrunPythonUnpacker=truepythonUnpackerTimeout=30# DisassemblyextractDisassemblySections=trueextractDisassemblySectionsLimit=200extractDisassemblySectionsInstructionLimit=10000# .NET unpackingrunDe4DotForNetFiles=truede4dotExecutionTimeout=30# Detect it easyenableDetectItEasy=trueenableDetectItEasyForExtractedFiles=truedetectItEasyTimeout=3| Property name | Default value | Description |
|---|---|---|
| runUpxUnpacker | true | Switch to enable / disable UPX unpacking |
| Property name | Default value | Description |
|---|---|---|
| runUnipackerOnPEFiles | true | Switch to enable / disable unpacking |
| unipackerExecutionTimeout | 50 seconds | Execution timeout |
| unipackerIgnorePackers | delphi,nullsoft | Comma separated list of ignored unpackers |
| unipackerMaxFileSizeInKb | 2 MB | File size limit |
| Property name | Default value | Description |
|---|---|---|
| runAutoItRipper | true | Switch to enable / disable AutoItRipper, extraction of compiled AutoIt scripts |
| Property name | Default value | Description |
|---|---|---|
| runPythonUnpacker | true | Switch to enable / disable Python unpacking |
| pythonUnpackerTimeout | 30 seconds | Switch to enable / disable Python unpacking, extraction of compiled Python scripts |
| Property name | Default value | Description |
|---|---|---|
| extractDisassemblySections | true | Switch to enable / disable disassembly |
| extractDisassemblySectionsLimit | 200 | Limit: the number of disassembled sections |
| extractDisassemblySectionsInstructionLimit | 10000 | Limit: the number of disassembled instructions |
| Property name | Default value | Description |
|---|---|---|
| runDe4DotForNetFiles | true | Switch to enable / disable .NET unpacking |
| de4dotExecutionTimeout | 30 seconds | Execution timeout |
| Property name | Default value | Description |
|---|---|---|
| enableDetectItEasy | true | Switch to enable / disable DetectItEasy, file type and attribute detection |
| enableDetectItEasyForExtractedFiles | true | Enable DetectItEasy on extracted files |
| detectItEasyTimeout | 3 seconds | Execution timeout |
Android Files
Enable Android APK parsing
transform.cfg
runAPKToolForAndroidFiles=trueapkToolExecutionTimeout=60apkToolParseMaxFolderDepth=10apkToolCheckMaxFiles=10000apkToolParseMaxFiles=1000| Property name | Default value | Description |
|---|---|---|
| runAPKToolForAndroidFiles | true | Switch to enable / disable APK parsing |
| apkToolExecutionTimeout | 60 seconds | Execution timeout |
| apkToolParseMaxFolderDepth | 10 | Limit: APK archive folder dept |
| apkToolCheckMaxFiles | 10000 | Limit: APK archive file count |
| apkToolParseMaxFiles | 1000 | Limit: Smali file count |
Java Files
Enable Java decompilation
transform.cfg
runCFRForJavaFiles=truecfrExecutionTimeout=30| Property name | Default value | Description |
|---|---|---|
| runCFRForJavaFiles | true | Switch to enable / disable Java decompilation |
| cfrExecutionTimeout | 30 seconds | Execution timeout |
Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
Last updated on
Was this page helpful?
Next to read:
Dynamic AnalysisSee the "Technical Datasheet" for a complete list of features: https://docs.opswat.com/filescan/datasheet/technical-datasheet
Discard Changes
Do you want to discard your current changes and overwrite with the template?
Archive Synced Block
Message
Create new Template
What is this template's title?
Delete Template
Message
