I'm wondering what the best tactic is to transfer dangerous files from an internet connected machine to an offline, separated from the web, virtual machine.

Why should I do that? Because I want to examine how small viruses, malware, spyware, etc. works, but without the risk that the beast gets released and infect my non-test devices like my personal laptop, phone, etc.

I would like to use free Virtual Machine software and plan to work with snapshots, so I'm able to redo all the damage I caused.

If this is the worst idea ever, please don't hesitate to correct me!

  • 1
    It's not clear what you want to ask. What do you want to protect against? Why does there need to be a special process to transfer a file? – schroeder Mar 14 '19 at 20:37
  • Be aware that some malware are aware of virtual environment and have different behavior. – MSD561 Mar 14 '19 at 20:53
  • Because, if I transfer the files over the network, then the VM needs to be connected to my private network. Which isn't a proper way to handle this kind of files. – Belekz Mar 14 '19 at 21:00
  • @MSD561, nope I didn't know. This for your reply! – Belekz Mar 14 '19 at 21:01

You have a bit of an XY problem. The problem is not how to safely transfer files to your sandbox. The problem is how to not accidentally transfer the files to a non-sandbox. This is minorly complicated by the fact that your sandbox is virtual, so you will have to transfer the files into a non-sandboxed piece of hardware in a way that only presents risk to the sandboxed part.

A CD-R is an incredibly safe way to marshal data from one machine to another. Being a very old and very simple API, it is highly unlikely that your host will manage to mismanage the hardware in a way which exposes your physical machine (though always possible... that's the price one pays for playing with fire). Contrast this with USB, which is a relatively complicated protocol. I doubt my USB thumb-drive has enough exploitable firmware to turn it into some malicious unerasable attack vector, but I can't be certain. CDROMs are pretty darn simple -- much easier to trust. (Remember, one of Stuxnet's attack vectors was a USB exploit)

And its very easy to see how to not propagate the virus anywhere: don't stick the CDROM in any machine you don't want infected. When you're done, you have a host of sanization procedures available to you. My personal favorite is 10 seconds in a microwave.

Remember, when you're playing with malware, you're always playing with trust. You start with some level of trust that your computers will do the things you think they are doing. As you introduce malware, its not that the computer gains viruses, its that you lose trust. You can no longer trust that they do what they claim to do. Tools like sanitization procedures are designed to leverage what you do trust to restore trust to other areas. For example, snapshots rely on your trust of the host OS in order to restore trust in the client OS you are using as a sandbox.


Use a virtual machine that can control a USB device, and that takes away control by the host machine, i.e. the host machine no longer sees the USB when it is inserted.

Then transfer the files by cheap USB stick and physically destroy it afterwards
(Or store it safely for future investigation)

Sorry, I do not know which VMs offer this (does VMware do this?).


I recommend to use a specialized sand box solution like cuckoo box which is especially created to analyse malware cuckoo sanbox. That solution offer offline analysis without being necessary to have a real one. Cuckoo Sandbox have the total control over a virtual machine and not permits it to infect your system.

  • thanks, I will look into it! Still concerns about running this sandbox on a host with value after reading the posts above. – Belekz Mar 16 '19 at 17:44
  • Sandboxes are a very wise first layer of defence when you expect the files to be safe. But IMO a little bit like seatbelts - you wouldn’t rely solely on them when you’re planning to crash hard. – Jens Ehrich Mar 16 '19 at 17:54

TLDR; Don't. Use dedicated hardware on dedicated connection instead, even if the OS you're experimenting with is virtualized.

Don't process malicious files in a VM running on a host of any value.

While transferring the files is probably not your biggest concern (moving bits from one location to another is not inherently dangerous) the processing that happens during or after the transfer can be dangerous to the guest and the host.

It may be possible to attack the host from the guest: https://en.wikipedia.org/wiki/Virtual_machine_escape. While the example given is quite old, if you don't know the malicious code intimately, then you can't be sure it doesn't contain a modern equivalent.

Use a dedicated host connected to the internet through a dedicated router on a dedicated private network. This ensures that any unintentional bad behavior is treated the same as what's already knocking on your firewall's ports. However, this is not enough...

Don't process malicious files on a system connected to the public internet

You could still unintentionally cause damage to external systems by running known malicious code on an Internet connected device. You may be able to mitigate this risk by inspecting all traffic through your firewall, running your own DNS server, emulated external services, etc. But as @Cort_Ammon has already mentioned the malware may behave differently in different environments.

There may still be other liabilities... I would consult with a lawyer (I'm not a lawyer!) if you're still considering moving forward.

  • The reason you want the host connected to the internet, is then it has the latest virus definitions right? – Belekz Mar 16 '19 at 17:43
  • No - you need this to transfer the file to the test machine. I presume you won’t be running antivirus on the test VM since you’re trying to analyze the malware behaviour. – Jens Ehrich Mar 16 '19 at 17:49
  • Sorry I meant the host where I would run the VM/Sandbox/... on. – Belekz Mar 16 '19 at 18:02
  • The host technically doesn’t need an internet connection at all (except maybe during the initial setup). – Jens Ehrich Mar 16 '19 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.