Cuckoo submit

cuckoo submit <sample>

Submits a sample to the Cuckoo sandbox for dynamic analysis: what the binary does when executed, what it communicates with, and what it touches.

Run it when static analysis isn't enough and you need the real behavior: cuckoo submit delivers the sample to the sandbox (the analysis VMs), which executes it and logs everything — the processes created, files written, registry keys touched, network connections, and downloaded files. The resulting report is the movie of the execution: the C2 contacted, the payload dropped, the persistence installed. In IR, the sandbox is the step that confirms what static suggested: the sample runs in a controlled way and the behavior is documented.

Don't use it with samples that detect the sandbox: malware with anti-sandbox (VM check, analysis tool check, delay check) won't show its real behavior in the sandbox — advanced samples require manual analysis or an evasive sandbox. Dynamic analysis is time-limited (payloads with delays or conditions won't trigger). And watch out for infrastructure: Cuckoo needs the analysis VMs configured and isolated — without the environment, cuckoo submit fails; and running malware (even in a VM) is an activity done in the isolated lab environment, not on the work host. For quick triage, cloud sandboxes (Any.Run, Joe) are an alternative without infrastructure.