Analyzing Almost Any File Type with VMRay: Complete File Format Support Guide

One of VMRay's core strengths is its ability to analyze almost any file type. Unlike sandboxes limited to Windows executables, VMRay handles a comprehensive range of formats: Office documents with embedded macros, email files with attachments, installer packages, scripts, archives, Mac OS binaries, and many more. This guide covers the advanced features that make multi-format analysis possible—including smart link detonation, recursive analysis, and the sophisticated file type detection that automatically recognizes each sample.

Whether you're analyzing a suspicious Word document, an email with unknown attachments, or a Mac OS PKG installer, VMRay automatically identifies the file type and applies the appropriate analysis methodology. This comprehensive support eliminates the need to use multiple specialized tools.

Smart Link Detonation: Analyzing Embedded URLs in Documents

Documents and emails frequently contain embedded URLs. A Word document might have a suspicious hyperlink. An email might contain multiple links, some legitimate and some malicious. Manually analyzing each link would be time-consuming and error-prone. VMRay solves this with smart link detonation.

How Smart Link Detonation Works: When enabled, VMRay automatically extracts all URLs from documents and emails. The system then evaluates each URL: if it appears suspicious (based on reputation checks and URL structure), it's detonated for web analysis. If it appears benign (known legitimate domain, no malicious indicators), it's skipped to save analysis quota.

Disabled by Default: Smart link detonation is disabled by default to prevent unintended consequences. If you enable it without understanding the implications, you might accidentally visit malicious URLs during analysis. Once enabled, it should only be used after careful configuration.

Real-World Example: A suspicious Word document contains three hyperlinks: one to a known malicious phishing site, and two to legitimate domains (Microsoft, Google). With smart link detonation enabled:

• Malicious link: VMRay's reputation check flags it as suspicious. The URL is automatically detonated for web analysis. Result: Malicious verdict.

• Legitimate links: Reputation check identifies them as known safe. No detonation occurs. Resources are conserved.

• Document verdict: Malicious (based on the embedded malicious link and static analysis indicators).

Recursive Analysis: Understanding Parent & Child Samples

When smart link detonation (or other recursive analysis features) trigger additional analysis, the platform creates a parent-child relationship between samples. Understanding these relationships is essential to interpreting analysis results.

Parent Sample: The original submitted file (the Word document, email, or archive).

Child Sample: Any file or URL discovered within the parent during analysis (an embedded URL, an attachment, a file extracted from an archive).

The Relations Tab: After analysis completes, the Relations tab shows all discovered child samples. Each child has its own sample verdict. This allows you to see the complete threat profile: not just whether the parent is malicious, but what specific threats were found within it.

Navigating Parent-Child Relationships: You can click on any child sample to view its individual analysis page. Each child's analysis shows how that specific threat was evaluated. For example, if a Word document contains a malicious link, clicking on that child sample shows you the web analysis results for that specific URL.

Attack Chain Visibility: This parent-child structure reveals entire attack chains. An email might contain an archive, which contains an executable, which downloads additional malware. Each stage is visible in the relations tab, giving you complete visibility into the threat.

Automatic File Type Recognition & Classification

VMRay doesn't rely on file extensions to determine file type. A file named "document.pdf" might actually be an executable. An attacker might rename a malware binary with a document extension to evade detection. VMRay solves this by analyzing the file's structure to determine its true type.

Magic Number Detection: Every file format has identifying bytes at the beginning (called a "magic number" or "file signature"). A PDF file always starts with "%PDF". A ZIP archive starts with "PK". A Windows executable starts with "MZ". VMRay reads these magic numbers to determine the true file type, regardless of the filename extension.

Automatic Format Matching: Once the file type is identified, VMRay automatically selects the appropriate analysis method. A recognized executable is sent to dynamic analysis in a Windows environment. A recognized Mac OS binary is sent to dynamic analysis in a macOS environment. A recognized document is submitted for static analysis and smart link evaluation.

Comprehensive Type Support: VMRay recognizes over 100 different file types, organized into categories:

• Office Documents: Word, Excel, PowerPoint, Publisher, Visio, OneNote. All with full macro analysis and embedded object detection.

• Windows Executables: EXE, DLL, SYS, COM, and other Windows binary formats. Analyzed in multiple Windows environments (XP, 7, 10, 11).

• Mac OS Files: Mach-O binaries, PKG installer packages, DMG disk images, app bundles. Analyzed in macOS environments.

• Linux Files: ELF executables and scripts. Analyzed in Linux environments.

• Archives & Compression: ZIP, RAR, 7Z, GZ, TAR, and other archive formats. Automatically extracted and nested files analyzed recursively.

• Email Formats: EML, MSG, PST mailbox files. Parsed to extract attachments and embedded URLs.

• PDFs: With full support for embedded content, JavaScript execution, and form analysis.

• Scripts & Code: JavaScript, VBScript, PowerShell, Python, Bash, and other scripting languages.

Triage Feature: Stopping Analysis Early When Verdict is Clear

Analysis takes time and consumes quota. If a file is already known to be malicious (via reputation databases), there's no reason to run expensive dynamic analysis. The triage feature stops analysis early when the verdict is already determined.

How Triage Works: When you enable triage during submission, the analysis workflow changes:

Without triage: Reputation → Static → Dynamic (full workflow)

With triage enabled: Reputation check. If malicious or clean, stop. If unknown, continue with Static. If static determines verdict, stop. If still unknown, continue with Dynamic.

Real Example - MSI Installer File: An MSI setup file is submitted with triage enabled. Reputation analysis immediately identifies it as a known-clean file (millions of users have analyzed it; it's safe). The triage setting stops the workflow right there. Static and dynamic analysis are skipped entirely, saving time and resources.

Quota Savings: For high-volume submissions (security teams analyzing threat feeds, email gateways screening messages), triage dramatically reduces quota consumption. Files already known to be malicious or benign complete analysis in seconds instead of minutes.

Platform-Specific Analysis: Windows, Mac OS, Linux Support

Different file formats require different analysis environments. A Windows executable needs to run in Windows. A macOS PKG needs to run in macOS. VMRay handles this automatically by selecting the appropriate target environment during submission.

Mac OS PKG Files: When you submit a Mac OS package (PKG file), VMRay automatically recognizes the format and defaults to analyzing it in a macOS environment (for example, High Sierra). The file is decompressed, its contents examined, and if dynamic analysis is needed, it runs in macOS with full behavioral visibility.

Windows Executables: Windows binaries are analyzed in appropriate Windows environments (XP for legacy malware, Windows 7, 10, or 11 depending on the target environment you select).

Linux Binaries: ELF executables are analyzed in Linux environments. VMRay supports various Linux distributions and kernel versions.

This platform-specific approach ensures accurate analysis—malware behaves differently on different OSes, so the sandbox environment must match the actual deployment target.

External Tool Integration: VirusTotal, Connectors & Third-Party Analysis

While VMRay's analysis is comprehensive, some organizations want additional perspectives on samples. VMRay integrates with external security tools to augment analysis results.

VirusTotal Integration: VirusTotal is a free service that scans files with 70+ antivirus engines. VMRay can automatically submit samples to VirusTotal and incorporate the results into your verdict. To enable this, you need a VirusTotal API key (obtained from your VirusTotal account).

Configuration: Go to Analysis Settings, find the VirusTotal section, and enter your API key. Once configured, VMRay will include VirusTotal antivirus verdicts in your analysis results.

Other Connectors: Beyond VirusTotal, VMRay supports connectors to many other security products. These are described in detail in the Knowledge Center documentation. Connectors allow you to integrate threat intelligence feeds, sandboxes, and detection tools seamlessly into your VMRay workflow.

Hybrid Analysis Approach: By combining VMRay's behavioral analysis with external tools' signature-based detection and threat intelligence, you get the best of both worlds: behavioral depth plus signature coverage.

Verdict Generation: How VMRay Determines Malicious vs Clean

After analyzing a file (including all child samples discovered during recursive analysis), VMRay generates a final verdict: Malicious, Suspicious, or Clean.

Malicious: The file exhibits clear malicious behavior. This could be: a known malicious hash (from reputation), static analysis detection (suspicious code patterns, malicious signatures), or dynamic analysis observation (malware-like behavior during execution).

Suspicious: The file exhibits some suspicious characteristics but isn't definitively malicious. This requires manual investigation to determine true threat level.

Clean (or NA - Not Available): The file appears benign. Reputation check returned "not known," static analysis found no suspicious code, and dynamic analysis observed normal behavior.

Multi-Step Analysis Integration: If a Word document contains a malicious URL discovered during smart link detonation, the child sample (the URL) has its own verdict. The parent document's verdict depends on both the document itself and its discovered children. Malicious children typically result in a malicious parent verdict.

Frequently Asked Questions