Vajra Sandbox
A production-grade malware analysis and threat-detection platform built during an internship at Vajra Labs, IIT Bombay. Security researchers upload suspicious files, which are analyzed through static, dynamic, and memory-analysis pipelines running inside isolated virtual machines. Every submission produces an automated PDF report, while a hardened authentication layer keeps the system locked down.
Overview
Vajra Sandbox was developed during an internship at Vajra Labs, a cybersecurity research lab at IIT Bombay. The platform addresses the need for an accessible, high-throughput malware analysis tool that security researchers can use to quickly triage suspicious files without setting up complex local environments.
When a user uploads a sample, it enters a processing pipeline orchestrated by Celery workers backed by Redis as the message broker. Each sample is dispatched to an isolated virtual machine where three parallel analysis tracks run: static analysis (file headers, strings, imports), dynamic analysis (behavioral monitoring in a sandboxed execution environment), and memory analysis (process dumps and memory forensics).
The results converge into an automated PDF report that analysts can share with their teams. The entire platform is containerized with Docker, and I led a 3-person development team using sprint-based agile workflows with regular code reviews and CI integration.
Key Features
Multi-Vector Analysis
Each sample undergoes three independent analysis passes — static (PE headers, string extraction, import tables), dynamic (behavioral monitoring during sandboxed execution), and memory (process memory dumps and forensic inspection). Results from all three vectors merge into a unified threat assessment.
VM-Isolated Execution
Every submitted sample runs inside its own isolated virtual machine to prevent cross-contamination and host compromise. The VM is spun up on demand, monitored throughout execution, and torn down afterward — ensuring even the most evasive malware cannot escape the sandbox boundary.
Async Task Processing
Asynchronous Celery workers with Redis as the message broker process submissions without blocking the web interface. Users upload samples and keep working while analysis runs in the background. The system handles 200+ daily submissions with zero bottlenecks under high load.
Hardened Security Layer
Security-first design with JWT-based authentication, TOTP two-factor authentication for all accounts, equation-based CAPTCHA to prevent automated abuse, and per-endpoint rate limiting — ensuring only authenticated researchers can access the platform.
Architecture
The system follows a decoupled architecture with a clear separation between the frontend, API layer, and analysis backend. Here is how a sample flows through the pipeline:
- Upload & Validation — users submit samples through the Next.js frontend. The Django REST Framework API validates the file, stores it securely, and enqueues an analysis task.
- Task Dispatch — Celery picks up the task from the Redis queue and provisions an isolated VM. Static, dynamic, and memory analysis modules run concurrently within the VM.
- Analysis Execution — static analysis extracts file metadata and signatures; dynamic analysis monitors runtime behavior including network calls, file-system changes, and registry modifications; memory analysis inspects process dumps for injected code and suspicious patterns.
- Report Generation — results from all vectors are aggregated, scored, and rendered into a comprehensive PDF report stored in PostgreSQL and made available for download.
- Notification — the user is notified upon completion and can view or download the report from the dashboard.