CAPEsandbox

About CAPEsandbox

CAPEsandbox (CAPE) is a malware analysis sandbox that provides a REST API for submitting samples and URLs for automated analysis and retrieving the results. The API supports creating analysis tasks from files or URLs, listing and viewing tasks, retrieving generated reports and screenshots, downloading analyzed binaries and associated PCAP files, and querying available analysis machines and system status.

Task submission accepts parameters such as analysis package, timeout, priority, target machine or platform, tags, memory dumping, timeout enforcement, and virtual machine clock settings. The current API version uses token-based authentication via django-rest-framework, with configurable request throttling (default 5 requests per minute) set in api.conf or per-user through the Django admin interface. An older, deprecated API (api.py) is also documented, exposing similar endpoints without the token-based authentication scheme.

The tool is intended for users operating or integrating with a CAPE sandbox instance, whether self-hosted or via a public instance such as capesandbox.com, to programmatically automate malware submission and result retrieval.

Key features

• Submit files or URLs for automated malware analysis via REST API
• Retrieve JSON analysis reports and task status by task ID
• Download screenshots, PCAP files, and analyzed binaries from completed tasks
• Token-based authentication with configurable per-user request throttling
• List and view details of available analysis machines and their platforms
• Select analysis package, platform, machine tags, and VM clock settings per task

Frequently asked questions