When reading about how antivirus and sandbox work, my understanding is that an AV scans a file to see whether it matches with known viruses signatures. Sandbox can be used to obtain the behaviors of a file when it runs. However, I don't know how sandboxes can be used to detect unknown malware or not. Could you please let me know this? 
Thanks!