Interactive CAPE Sandbox
In GLIMPS Malware Expert
When submitting a file in GLIMPS Malware Expert, analysts can now choose to launch an interactive session in the CAPE sandbox. A Windows virtual machine is spun up for them, and a new window opens so they can interact directly with the Windows environment and the file under analysis: open the document, respond to prompts from the malware, trigger the actions needed for detonation, and more. All artifacts generated during the session are then re-analyzed by the other GLIMPS Malware engines, in line with the platform’s hybrid analysis approach.
Observable Extraction
In GLIMPS Malware Expert and other GLIMPS Malware products
A new service, Observable Extractor, handles the extraction of observables (URLs, IP addresses, domains, hashes, and email addresses) across all submitted file types. It replaces the Advanced String Extraction service with a far more effective engine, capable of surfacing significantly more observables from analyzed files.
Batch Script Support
In GLIMPS Malware Expert and other GLIMPS Malware products
The MultiScripts AI engine now analyzes Batch scripts (.bat), in addition to PowerShell, JavaScript, and Python scripts. This extension strengthens detection of malicious or obfuscated administration scripts circulating across the IT environment.
New MultiScripts Model
In GLIMPS Malware Expert and other GLIMPS Malware products
The MultiScripts AI engine now runs on a new, lighter model that reduces processing times and the service’s memory footprint. The new model can also analyze much longer scripts, whereas large scripts were previously truncated. This improves detection of malicious sections buried in large volumes of code.
Other improvements and fixes are included in this release.
