Run lab tools
The agent runs your own lab-control commands on the host, such as snapshot restores, and reads logs you copy out.
Product
sandboxing malware analysis agent
01
ParcelType assists with sandboxing malware by running lab-control commands on the host, reading exported logs with read_file, and drafting reports with extracted IOCs.
Read exported logs
It reads text files you copy out of the isolated virtual machine.
Draft reports
The agent summarizes behaviour logs and extracts indicators of compromise.
Core capabilities
- Filesread_file, write_file, edit_file, grep, and list_dir work inside the chat working folder.
- Shellruns terminal commands like snapshot restore scripts and hashing commands, reporting the real exit code to you.
- Webuses web_search and http_get to fetch official documentation pages from the internet.
- Screenshots and imagesgen_image saves real image files and ocr reads text from screenshots.
- Orchestrationuses task for parallel sub-agents, run_on_model for hard steps, and skills.
- Approval modesAuto-run acts at once, Ask first pauses before changes, Plan only writes a plan.
- Cronruns prompts on a schedule to automate your recurring lab analysis tasks.
- Modelsconnects to a cloud provider or a local model on your PC via a standard API.
Defensive analysis workflow
You stay in control while the agent handles the repetitive text processing and script writing.
Read the connection log and list every unique domain.
- read_file
connection_log.txtloaded - grep
domain3 matches - write_file
iocs.txtsaved - edit_file
iocs.txtchanged - Shell
certutil -hashfile sample.exe SHA256hash ok
waiting for your OK before the next stepRejectAccept
Practical analysis tasks
Summarize traffic logs
The agent reads the exported connection logs using read_file and uses grep to list domain matches, so you can verify duplicates in the card before accepting changes. This is sandboxing malware. The interface shows the real result of each tool action. You review the extracted domains in Ask first mode carefully. The agent writes the clean list to a new file using write_file. Every action appears in the chat as a card with its real result. You can verify the changes by viewing the file diff in the interface. This workflow helps you build a blocklist for your own network while you analyze first half of 2026 malware trends.
Draft a run report
You copy the process logs from your snapshot machine into the chat working folder and the agent uses read_file to parse them for indicators of compromise. This is the analysis. Digital forensics and malware analysis benefit from this clear workflow. The tool drafts a report template using write_file with fields for the run number and file hashes. You review the diff in Ask first mode and edit the observations before saving the final document. A clean baseline helps you spot the differences in the isolated environment. Each step shows its real result as a card in the chat. ParcelType is not an online sandbox, but it supports online virus sandbox workflows.
What ParcelType does not do
It is not a hosted service or plugin; it is meant only for your own files, PC and servers you are authorised to use. You keep the work within them, as the agent does not enforce scope and Shell, web and SSH are not folder-bound. There is no guarantee that code, scans or analysis are correct. If files keep reappearing, it is possible malware is present. For a PC you think is infected, disconnect it from the network and follow your organisation's procedure.
