Malware analysis: find out what a file actually does
Submit an executable, a document, an archive or a script. It is scanned by the full engine roster, executed in an instrumented sandbox where the file type supports it, and returned as a report showing the behaviour, the indicators, and the evidence behind the verdict.
What the analysis covers
- Signatures and rules. Antivirus engines, curated YARA rule packs and hash reputation feeds each produce their own named line on the report, so agreement between engines is visible rather than implied.
- File structure. Parsers for PE, ELF, Mach-O, Android packages, Office documents, PDFs, archives and email carriers extract sections, imports, certificates, macros, embedded files and entropy.
- Runtime behaviour. Executables are detonated in a full-system sandbox recording the process tree with command lines, API activity, files written, registry changes and captured network traffic.
- Indicators and attribution. Domains, addresses, URLs, mutexes and registry keys are extracted and filtered for benign infrastructure, then mapped to a malware family and ATT&CK techniques where the evidence supports it.
Malware families seen recently
- Zusy
- HUILoader
- Mira
- Mirai
- Upantix
- Somhoveran
- Yogi
- Fileinfector
- Razy
- VJadtre
- Midie
- NabucurObfs
- Wapomi
- Emotet
- Expiro
Common questions
- What file types can you analyze?
- Windows executables and libraries, Linux ELF binaries, Android packages, Office documents, PDFs, scripts, archives and email files. Archives are unpacked and their members analysed as their own samples, including password-protected archives using common malware passwords.
- How long does an analysis take?
- Static results are typically available in seconds. A full detonation takes a few minutes once a sandbox guest is free, and busy periods queue rather than skipping the sandbox, because a fast incomplete answer is worth less than a correct one.
- Can I analyze a file privately?
- Yes, with an account. A private sample is never published, never indexed and never appears in the public feeds. Anonymous submissions are public.