Cloud Sandbox API

The Avira Cloud Sandbox API enables security vendors and service providers to submit files and receive detailed threat intelligence reports containing a complete threat assessment.

Contact us

Cloud Sandbox Framework


The Avira Cloud Sandbox is an award-winning, highly scalable automated malware analysis service. It blends multiple advanced analysis technologies to deliver a complete threat intelligence report from an uploaded file.

The Cloud Sandbox API delivers a detailed, file-specific, threat intelligence report. It contains valuable, actionable intelligence. The report has a detailed classification of the file, information on the techniques, tactics and procedures (IoCs) present in the threat, and a description of how and why the submitted file was identified as clean, malicious, or suspicious.


Avira’s Cloud Sandbox leverages the technologies developed within the Avira Protection Cloud, the cloud security system that underpins the anti-malware and threat intelligence solutions of Avira. Through OEM technology partnerships we help many of the world’s leading cyber-security vendors protect their customers, both consumer and enterprise

Built on an AWS infrastructure, the  Dynamic Detonation Layer enables the Cloud Sandbox to manage the time-sensitive nature of partners’ requests at scale and speed.


Access to this service, and flexible integration, is enabled through a secure RestAPI.

The system is designed and constantly maintained by the experienced cyber-security engineering team at Avira. The Cloud Sandbox’s Deep Inspection and Dynamic Analysis System delivers high levels of protection and performance against constantly evolving unknown threats. It supports MITRE ATT&CK™ adversary tactics and techniques.


Cloud Sandbox Analysis Modules

File Identification

A layer that evaluates uploaded files, to make an initial assessment. It enables the Dynamic Management System.

Deep Inspection

Provides unmatched visibility into malware behavior. Includes behavioural analysis profiling and machine learning.

Dynamic Detonation Analysis

Uses an isolated detonation platform running within a highly scalable AWS environment.

Behavioral profiling and context analysis

Correlates the cascade of information developed by the system modules and provides context to the data.

Find out more about Avira's award-winning Cloud Sandbox API service

Have on-demand access to Avira's world-class malware detection and threat intelligence services using a simple API query. Contact your local integration team now:

Contact us