Why this approach

Most consumer sandboxes execute the suspicious file in an isolated environment to observe its behavior - effective, but slow and sometimes evadable (VM detection, delayed activation). RustSimpleSandbox flips the problem: before even considering detonation, it extracts everything that is observable without running anything - file structure, macros, embedded JavaScript, email headers, URLs, metadata - and checks it against heuristics and YARA rules. Fast, immune to timing-based evasion, and good enough to triage a large volume of attachments before sending the ambiguous cases to a real dynamic sandbox.

Key features

• Emails (.eml): full MIME parsing, display name/domain and Reply-To mismatch detection, Received chain reconstruction, attachment extraction and hashing (MD5/SHA1/SHA256), SPF/DKIM/DMARC verification plus reverse DNS and IP reputation (Spamhaus).
• Tracking and deceptive links in HTML bodies: tracking pixels, clickable images whose real link differs from what the image implies, deceptive link text, invisible Unicode characters (zero-width, RTLO), homograph/IDN domains with confusable-skeleton comparison (Unicode TR39) and Levenshtein-distance typosquatting.
• PDF: object counting, encryption detection, embedded JavaScript extraction with an obfuscation score, network indicators (/URI, /Launch), embedded files.
• Modern and legacy Office: OOXML external relationships, detection and routing of VBA projects/OLE objects, decompression and analysis of VBA code (suspicious APIs, decoding -enc PowerShell, entropy scoring).
• Recursive archive decompression (.zip/.tar.gz/.iso) with decompression-bomb guardrails checked before unpacking: compressed/decompressed size ratio verified per entry, bounded entry count and nesting depth, streamed reads with a hard byte cap, path name sanitization.
• YARA-X scanning: the raw file, attachments, decompressed macros and extracted JavaScript scanned against 20 rules written for this project - known packer signatures, generic heuristics (section entropy, suspicious import table, high-entropy overlay), manual-mapping/injection API detection, and rules specific to .lnk shortcuts (a common Mark-of-the-Web bypass technique).
• Malware family attribution and external rules: optional loading of a community YARA corpus, extracting the family field when an external rule declares it.
• Optional network correlation: cross-checking static network indicators against a supplied .pcap file.

Tech stack

Status

A Rust workspace split into several crates (core, detection, cli, tui, report, email-detonation, fuzz, test), developed iteratively since late July 2026. The static analysis engine (format parsing, YARA-X, heuristics, MITRE mapping, TUI navigator) is functional; the email-detonation module and export to additional report formats are the remaining work before a first stable release.