Sqeegie

While not a full-proof detection vector, using common default VM resolutions (I.e. 800x600 or 1024x768), could be a good test for default sandboxes. https://www.bleepingcomputer.com/news/security/trickbot-malware-now-checks-screen-resolution-to-evade-analysis/