Malware Analysis Tools
From static analysis to reverse engineering and sandboxes: the reference tools of malware analysts, mostly free.
Only handle samples in an isolated virtual machine with no network access to your environment (FLARE-VM or REMnux), and never upload a confidential file to a public service like VirusTotal: third parties can then access it.
Ghidra
Reverse engineering suite released by the NSA: disassembler, decompiler and scripting.
Windows, macOS, Linux
Official websiteIDA Free / IDA Pro
Hex-Rays’ reference disassembler; the free version includes a cloud decompiler for x86/x64.
Windows, macOS, Linux
Official websitex64dbg
Open source debugger for 32- and 64-bit Windows executables, widely used for unpacking.
Windows
Official websiteDetect It Easy
Identifies a file’s compiler, packer or protector: the first triage step.
Windows, macOS, Linux
Official websitePEStudio
Inspects a Windows executable without running it: suspicious imports, strings, resources, indicators.
Windows
Official websitecapa
Mandiant tool that describes a binary’s capabilities (encryption, persistence…) and maps them to MITRE ATT&CK.
Windows, macOS, Linux
Official websiteYARA
Rule language to identify and classify malware families from patterns.
Windows, macOS, Linux
Official websiteCAPE Sandbox
Open source sandbox, Cuckoo’s successor, with automatic config and payload extraction.
Linux (hôte)
Official websiteANY.RUN
Interactive online sandbox: you watch and interact with the sample live. Free analyses are public.
Web
Official websiteVirusTotal
Multi-antivirus scanning and relationships between files, domains and IPs. Submitted files are shared.
Web
Official websiteFLARE-VM
Mandiant script that turns a Windows VM into a fully equipped analysis workstation.
Windows (VM)
Official websiteREMnux
Linux distribution dedicated to malware analysis: malicious documents, scripts, network traffic.
Linux (VM)
Official website