Dr.Web vxCube is an interactive file-analysis service that examines suspicious objects by analyzing their behavior in an isolated virtual environment. The system identifies signs of computer system infections and stops attempted attacks, including advanced persistent threats. It monitors actions of launched files including file creation, Internet access attempts, local computer resource access, and system calls. The service provides automatic analysis to assess maliciousness, examine behavior, and identify traces left in the system. Dr.Web vxCube decrypts TLS traffic by intercepting session keys and represents it as PCAP dumps for network activity analysis. Objects can be analyzed simultaneously across Windows XP, Windows 7, Windows 10, and Windows 11 with various versions of relevant applications. Analysis results include detailed information and video reports on file behavior. The software contains a knowledge base from MITRE ATT&CK. Connection to a vxCube virtual machine is available via VNC viewer to control the file analysis process. The system incorporates an API that allows integration with other services. The service is available in two versions: a cloud version that sends files to the vendor's servers, and an on-premise version that allows analysis within a network without sending files to external services.
