Open folder
Launch ParcelType and open the folder with your exported logs.
Workflows
malware traffic analysis in your isolated lab
03
Review traffic logs from your sandbox
You export connection logs from your isolated virtual machine and place them in the working folder. ParcelType reads the text files, extracts key indicators, and drafts a clear summary of the observed network behavior for your records, noting how seo poisoning leading to malware might appear in the traffic.
Read logs
The agent reads the text files and lists the first few lines.
Extract IOCs
The agent searches for domains and IP addresses in the text.
Check result
Review the extracted list and verify the findings in your notes.
Example lab run report
Draft a report for this run using the log data.
- read_file
traffic.log240 lines - grep
domain3 matches - write_file
report.txtsaved - edit_file
report.txtdiff
waiting for your OK before the next stepRejectAccept
run-report.txt
# Lab Run Report
Run number: 1
Snapshot name: clean_base
Network type: host-only
File name: sample.exe
SHA-256: placeholder
Observations: DNS lookup for update server.
Connection to 192.168.1.100 on port 443.
No file writes detected in system dir.
Traffic captured for 60 seconds.
End of log summary.This plain-text report shows a single run with placeholder data. It lists the snapshot, network type, and key observations for your records.
Walkthroughs for traffic analysis
Read exported logs
ParcelType uses read_file to open your exported connection logs from the isolated lab and uses grep to search for specific domains or IP addresses that appeared during the run. You see the matches. This helps you identify which external services the sample contacted. You review the matches and decide if they look suspicious. The agent does not change your log files, so your original data stays safe. You can ask the agent to summarize findings or extract indicators of compromise for your report. This process supports malware traffic analysis by revealing the network behavior observed in the isolated environment. You might wonder why malware utilities ignore scheduled tasks when they prioritize immediate execution hooks over persistence mechanisms.
Draft analysis report
The agent uses write_file to create a new report file in your working folder and adds the SHA-256 hash of the sample using certutil -hashfile <file> SHA256. Ask first. This draft includes the run number, snapshot name, and network type. It lists the observed domains and IP addresses from your traffic logs. People who search for 'free malware sandbox' expect a service, but ParcelType is a local desktop app. It is not a sandbox and not offered as a free tool. You can then edit the file or append more notes as needed. Have you been hit by malware if the logs show strange activity?
