Run it, read it, automate it
An interactive sandbox to run the sample, a report that shows its work, and an API to do both at scale.
Interactive sandbox
A disposable machine you can actually use
Every run starts on a clean Windows 11, Windows 10, Linux or Android machine. You get the live screen, the mouse and the keyboard for as long as the session lasts.
- Click past prompts, finish installers and type into fake sign-in pages
- Pick the session length and whether the machine gets internet
- Add a minute, hand control back or stop the run early
- Files up to 100 MiB, plus URLs
Document Viewer
This document is protected. Click Enable to view it.
CancelEnable
Reports
A verdict that shows its work
Each indicator links back to the events that triggered it, and coverage sits next to the score, so an empty report is never mistaken for a clean file.
- Indicators mapped to MITRE ATT&CK
- Process tree, file and registry activity, network flows with decrypted TLS
- Static analysis: sections, entropy, imports, signatures and YARA matches
- Raw artifacts: PCAP, TLS keys, process memory, desktop frames and the event log
8
High threat
Mapped to MITRE ATT&CK
8Starts itself at every sign-in
7Writes code into another process
6Runs PowerShell with a hidden window
Coverage
Native callsCaptured
Packet captureCaptured
TLS decryption2 of 3
Process memoryCaptured
API
Scriptable end to end
Submit with an API key, follow events over a WebSocket while the session runs, and download the report and artifacts when it ends.
- REST endpoints for tasks, analysis and artifacts
- Live events over a WebSocket while the session runs
- The same machines and options as the web app
$ curl https://sample.watch/api/v1/tasks \ -H "Authorization: Bearer $SW_KEY" \ -F 'options={"profile":"win11-x64","session_seconds":120}' \ -F file=@invoice_0918.exe # follow it live wss://sample.watch/api/v1/tasks/7f3a9c21/events/ws # then fetch the evidence GET /api/v1/tasks/7f3a9c21/analysis GET /api/v1/tasks/7f3a9c21/artifacts
4Machines: Windows 11, Windows 10, Linux and Android
LiveMouse and keyboard control during every run
TLS 1.3Encrypted traffic decrypted in the report
100 MiBLargest sample, plus URLs