increasinglyantivirus solutions employ some form of sandboxing to determine the behavior of suspicious specimens whether this sandbox runs on the network perimeterwhich is becoming more popularor on the target machine itselfwe must do our best to avoid tipping our hand to any defense in place on the target' network we can use few indicators to try to determine whether our trojan is executing within sandbox we'll monitor our target machine for recent user inputincluding keystrokes and mouse-clicks then we'll add some basic intelligence to look for keystrokesmouse-clicksand double-clicks our script will also try to determine if the sandbox operator is sending input repeatedly ( suspicious rapid succession of continuous mouse-clicksin order to try to respond to rudimentary sandbox detection methods we'll compare the last time user interacted with the machine versus how long the machine has been runningwhich should give us good idea whether we are inside sandbox or not typical machine has many interactions at some point during day since it has been bootedwhereas sandbox environment usually has no user interaction because sandboxes are typically used as an automated malware analysis technique we can then make determination as to whether we would like to continue executing or not let' start working on some sandbox detection code open sandbox_detect py and throw in the following codeimport ctypes import random import time import sys user ctypes windll user kernel ctypes windll kernel keystrokes mouse_clicks double_clicks these are the main variables where we are going to track the total number of mouse-clicksdoubleclicksand keystrokes laterwe'll look at the timing of the mouse events as well now let' create and test some code for detecting how long the system has been running and how long since the last user input add the following function to your sandbox_detect py scriptclass lastinputinfo(ctypes structure)_fields_ [("cbsize"ctypes c_uint)("dwtime"ctypes c_ulongdef get_last_input()struct_lastinputinfo lastinputinfo(struct_lastinputinfo cbsize ctypes sizeof(lastinputinfoget last input registered user getlastinputinfo(ctypes byref(struct_lastinputinfo)now determine how long the machine has been running run_time kernel gettickcount(elapsed run_time struct_lastinputinfo dwtime print "[*it' been % milliseconds since the last input event elapsed