Malicious File Analysis OSINT Tools
Analyze suspicious files, URLs and indicators of compromise (IOCs) without risking your machine. These threat intelligence tools help identify malware, ransomware and phishing.
29 tools · Version française
- #totalhashMalware Hash Registry that searches against 30+ antivirus databases to validate malware hashes with detection percentage results. Updated daily.free
- Akana Android MalwareOnline Android Interactive Analysis Environment with plugins for analyzing malicious Android applications and APKs for suspicious behavior and malware characteristics.free
- Any Runalso written AnyRunInteractive malware analysis sandbox allowing real-time manual interaction with Windows, macOS, Linux, and Android environments. Fast report generation with MITRE ATT&CK mapping.freemium
- detux Linux SandboxOpen-source multiplatform Linux sandbox for analyzing Linux malware across multiple CPU architectures (x86, x86-64, ARM, MIPS) using QEMU emulation and traffic analysis.free
- EtherGeorgia Tech malware analysis framework using Intel VT hardware virtualization for transparent, stealthy malware analysis resistant to anti-analysis techniques.free
- Ghidra (T)also written GhidraFree and open-source reverse engineering framework from NSA for analyzing compiled software. Includes disassembly, decompilation, scripting, and interactive graphing for malware analysis.free
- Hybrid Analysisalso written HybridAnalysisFree automated malware analysis service powered by CrowdStrike Falcon Sandbox. Combines runtime data with memory dump analysis to extract execution pathways and IOCs for evasive malware.freemium
- ID RansomwareFree ransomware identification tool that analyzes ransom notes and encrypted file samples to identify variants and provide decryption guidance. Detects 1181+ ransomware types.free
- Joe APK AnalyzerPart of Joe Sandbox suite; performs dynamic and static analysis of Android Application Packages to detect malicious behavior and generate detailed analysis reports.freemium
- Joe File AnalyzerPart of Joe Sandbox suite; performs hybrid code analysis of PE files on Windows with detailed behavioral and system interaction reporting.freemium
- JoeSandbox Document Analyzeralso written Joe Sandbox Document AnalyzerHosted automated malware analysis service that performs dynamic and static analysis of files including Office documents, PDFs, and executables with comprehensive behavioral reporting.freemium
- Jotti's Malware ScannerFree multi-scanner malware analysis service that submits files for analysis against 14+ antivirus engines. No installation or account setup required.free
- KoodousCollaborative platform for Android malware research and analysis with community-driven database of 70+ million Android applications with crowd-sourced malware detection.freemium
- Malware Analysis ToolsCurated resource and reference guide for malware analysis tools with recommendations for virtualization, safety practices, and tool selection for analysis scenarios.free
- Malware Configalso written MalwareConfigDatabase for searching and analyzing extracted malware configurations by hash, domain, or IP address to track C2 infrastructure and malware attributes.free
- Malware-Traffic-Analysis.netalso written Malware-Traffic-AnalysisTraining resource and PCAP repository providing network traffic captures from malware infections since 2013. Includes tutorials and exercises for malware traffic analysis.free
- MalwareBazaar (abuse.ch)also written Malware Bazaar (abuse.ch), MalwareBazaar (abuse ch), MalwareBazaar(abuse.ch)Free malware sample repository by abuse.ch with 10M+ samples searchable by hash, tag, file type, YARA rules, and threat actor. Includes API and bulk download.free
- MetaDefenderalso written Meta DefenderOPSWAT's cloud-based multi-engine malware scanning platform with advanced threat detection using 30+ antivirus engines, CDR technology, and behavioral analysis.freemium
- OffVis (T)also written OffVis, Off VisMicrosoft Office Visualization Tool for analyzing Office binary files to identify exploits and malicious structures. Displays hex and object tree views.free
- Origami Framework (T)also written Origami Framework, OrigamiFrameworkRuby framework for parsing, analyzing, and forging PDF documents. Includes PDF Walker GUI and PDFcop heuristic checker for detecting dangerous PDF content.free
- PDF Tools (T)also written PDF Tools, PDFToolsFree suite of PDF analysis tools by Didier Stevens including pdfid (keyword scanning) and pdf-parser.py for analyzing malicious PDF documents and extracting embedded objects.free
- Pikker.ee Cuckoo Sandboxalso written Pikker ee Cuckoo SandboxPublic instance of Cuckoo Sandbox malware analysis system hosted in Estonia. Provides automated dynamic analysis with detailed result reporting for submitted files.free
- Triage (Hatching)also written Triage(Hatching)High-speed malware analysis sandbox. Submit files and URLs for automated behavioral analysis. Supports Windows, Android, Linux. Fast results with detailed IOC extraction and family detection.freemium
- TYLabs QuickSand Frameworkalso written TY Labs Quick Sand FrameworkPython-based malware analysis framework for analyzing Office documents and PDFs to identify exploits in decoded streams using YARA signatures.freemium
- Uncover ItStatic malware configuration extractor that quickly analyzes files without execution to extract malware configurations, C2 infrastructure, and IOCs in under 5 seconds.free
- VirusShare.comalso written Virus Share.com, VirusShareRepository of 111+ million live malware samples provided for security researchers, incident responders, forensic analysts, and researchers.free
- VirusTotalalso written Virus TotalMulti-engine file and URL scanner that aggregates results from 70+ antivirus engines and threat feeds.freemium
- VX VaultActive collection of malware samples and related data shared among security researchers and malware analysts for threat intelligence.free
- YARAifyalso written YAR AifyScans a file against thousands of public YARA rules and returns which ones match. Names a threat family rather than giving a yes-or-no verdict.free
Frequently asked
- How to safely analyze a suspicious file?
- Upload it to VirusTotal (analyzed by 70+ antivirus) or ANY.RUN (behavioral sandbox). Never open it directly.
- What is an IOC?
- An Indicator of Compromise is an artifact (file hash, IP, domain, registry path) indicating potential malicious activity.