A sandbox check is an anti-analysis test used by malware to detect whether it is running inside a virtual machine, emulator, or security lab. Samples may look for common artifacts such as suspicious device names, low system resources, missing user activity, analysis tools, or timing patterns that do not match a normal workstation. If the test succeeds, the malware may stop, delay execution, or hide its most dangerous behavior.
This matters because sandboxes are a major defense for safely detonating unknown files and observing what they do. When malware can recognize that environment, it can evade static and dynamic analysis, reducing the chance of detection by signatures or automated behavior rules. Defenders respond by using layered telemetry, realistic sandbox settings, memory inspection, and monitoring for anti-VM logic in code. In real attacks, sandbox checks often appear alongside obfuscation and command-and-control traffic to make samples harder to study and attribute.