Descriptor: Dataset of Evasive Malware Analysis Using a Modified CAPE Sandbox (DEMACS)

Abstract

This article describes Dataset of Evasive Malware Analysis Using a Modified config and payload extraction (CAPE) Sandbox (DEMACS), a dataset designed to support research on malware analysis, detection, and classification, with particular emphasis on evasive malware behavior. Strictly limited to the Windows Portable Executable (.exe) ecosystem, the dataset contains 2713 Windows malware samples, with a total size of approximately 243 GB, together with dynamic analysis reports, screenshots, and dropped files generated using a modified CAPEv2 sandbox specifically configured to reduce common virtualization artifacts used by malware for sandbox detection. By including both the original binaries and the analysis outputs, the dataset enables end-to-end reproducibility and reanalysis of malware behavior under controlled conditions. For each analyzed sample, the dataset provides the original executable binary, JSON and HTML behavioral reports, execution screenshots, and auxiliary artifacts generated during runtime. The modified analysis environment produced rich behavioral traces, averaging 53 602 application programming interface (API) calls, 13.40 processes, 19.79 behavioral signatures, and 11.72 MITRE ATT&CK techniques per sample, more than doubling the API call volume compared to a standard sandbox configuration. A distinctive characteristic of DEMACS is the simultaneous availability of original malware binaries, behavioral artifacts, and reproducible sandbox configuration files. This combination enables reproducible experimentation, comparative evaluation of malware analysis techniques, and investigation of both static and dynamic malware characteristics. The dataset supports a wide range of applications including malware family classification, behavioral clustering, API sequence modeling, and threat intelligence enrichment. It is intended for cybersecurity researchers working on malware detection, behavioral analysis, threat intelligence, and machine learning applications. IEEE SOCIETY/COUNCIL Computer Society (CS) DATA TYPE/LOCATION Raw executable malware files, JSON and HTML analysis reports, JPG screenshots, dropped files; Various GitHub repositories DATA DOI/PID 10.57967/hf/7862