Nice Way To Evade Dynamic Analysis

One of the most important rules in building dynamic analysis environments is to avoid internet connection by the "potential malicious code". Indeed the "potential malicious code" would try to exploit the analysis system per se if an internet connection is available. To respect this basic rule, when a sandboxed code tries to open an internet page, the sandbox environment sends back a static 200 code, letting the "potential malicious code" compare the received page to the needed one. At such point the analysis system might try to "taint" and/or to apply its own detection mechanisms.

A smart way to detect if a code is sandboxed or not is to try to reach out an unreachable internet site.

more here...........http://marcoramilli.blogspot.com/2014/09/nice-way-to-evade-dynamic-analysis.html