Blue Coat Malware Analysis Appliance - MAA-S500-10-1YR

Specifications
Manufacturer: Symantec Corporation
Manufacturer Part Number: MAA-S500-10-1YR
Manufacturer Website Address: http://www.symantec.com
Brand Name: Blue Coat
Product Model: MAA S500-10
Product Name: Malware Analysis Appliance
Marketing Information:

Analyze, mitigate, and contain unknown malware, zero-day attacks, and targeted threats. The Blue Coat Malware Analysis Appliance is a key component of Blue Coat's Advanced Threat Protection solution, providing actionable intelligence that combines static, dynamic, and reputational analysis techniques. Integrated with the Blue Coat Content Analysis System or the Blue Coat Security Analytics Platform with ThreatBLADES, it provides a highly scalable solution for detecting and analyzing unknown, advanced, and targeted malware.

This adaptive and customizable sandbox solution delivers enterprise-class, comprehensive malware detonation and analysis using a unique, dual-detection approach to quickly analyze suspicious files and URLs, interact with running malware to reveal its complete behavior, and expose zero-day threats and unknown malware.

Expose More Malicious Behavior

The Malware Analysis Appliance utilizes a powerful dual-detection approach that combines virtualization and emulation to capture more malicious behavior across a wider range of custom environments than typical consolidated single-sandbox solutions.

• Emulation Sandbox: An instrumented, fully controlled, replicated PC computing environment emulates Windows systems to detect malware that otherwise will not detonate within a virtualized environment
• Virtualization Sandbox: Custom analysis profiles replicate actual Windows production environments, down to the applications and versions in use, to quickly spot anomalies and behavioral differences that unveil anti-analysis, sleep, and other advanced evasion techniques. A virtualized Android sandbox detects and analyzes mobile threats traversing enterprise networks.

Multiple Detection Techniques

The Malware Analysis Appliance uses a combination of static and dynamic analysis techniques that employ standard, custom, and open source YARA patterns to unmask cleverly disguised malware. It detects packed malware and VM-aware samples that alter their behavior in an artificial environment, plus malware that attempts to wait out any sandbox analysis using short or long sleeps

A Multi-Analysis at Many Levels

Anti-analysis defeating tools - such as hook-based introspection, high-level and low-level event capture, and detection in both kernel and user modes - intercept and convert behavior into detailed forensic intelligence.

Interact with Running Malware

Flexible plug-in architecture extends detection and processing by interacting with running malware, clicking through dialog boxes and installers, and generating unique post-processing analysis artifacts.

Generate More Relevant Results

Virtual machine profiles replicate multiple custom production environments, allowing security analysts to analyze threats across a range of operating systems and applications. They can closely match their organizations' desktop environments, gathering intelligence on malware targeting their organizations directly or seeking to exploit specific application vulnerabilities.

Customize Detection and Risk Scoring

Detection criteria, analysis parameters, firewall settings, and risk scoring can all be customized to add flexibility, unique detection, and fast response capabilities when analyzing non-traditional and targeted malware in unique production environments.

Adaptive Intelligence for Changing Threats

Since the Malware Analysis Appliance does not rely on static signatures, its flexible detection patterns are designed to detect polymorphic files, single-use targeted malware, and fast-changing website domains.

Product Type: Network Security/Firewall Appliance
Technical Information
Firewall Protection Supported:

• Malware Protection
• Threat Protection

Network & Communication
Ethernet Technology: Gigabit Ethernet
Network Standard: 1000Base-T
Management & Protocols
Manageable: Yes
Physical Characteristics
Compatible Rack Unit: 2U
Form Factor: Rack-mountable
Height: 3.4"
Width: 28"
Depth: 17.1"
Weight (Approximate): 66.14 lb
Miscellaneous
Environmentally Friendly: Yes
Environmental Certification:

• RoHS
• REACH