Analyse a suspicious file without opening it
Two questions get mixed here, and the second is often the more interesting one in an investigation. The first is « is this dangerous ». The second is « what does this file tell me about whoever made it » : a document carries its author, its software, sometimes its save path. Start with the metadata, which requires sending nothing.
The tools, in order
- 01ExifTool (T)free
Reads metadata locally : author, software, dates, device, transmitting nothing
Widely used command-line toolkit for reading and writing EXIF, IPTC, XMP, and other metadata formats.
- 02VirusTotalfreemium
Cross-references dozens of engines and says whether the file is already known
Multi-engine file and URL scanner that aggregates results from 70+ antivirus engines and threat feeds.
- 03Any Runfreemium
Runs the file in a disposable machine and shows its network behaviour live
Interactive malware analysis sandbox allowing real-time manual interaction with Windows, macOS, Linux, and Android environments. Fast report generation with MITRE ATT&CK mapping.
- 04Triage (Hatching)freemium
Automated analysis with a structured report, handy for documenting a conclusion
High-speed malware analysis sandbox. Submit files and URLs for automated behavioral analysis. Supports Windows, Android, Linux. Fast results with detailed IOC extraction and family detection.
- 05
Says whether the sample circulates elsewhere, placing an attack as targeted or mass
Free malware sample repository by abuse.ch with 10M+ samples searchable by hash, tag, file type, YARA rules, and threat actor. Includes API and bulk download.
The pitfall to avoid
Uploading a file to a public analysis service makes it readable by others, and potentially tells its author that you received it. For a confidential document or a targeted attack, compute its hash first and search for that hash : if it is unknown, you will know that uploading it would be a disclosure.
🧭 The full plan
The copilot orders every step from your starting point, with pre-filled queries.
📖 The guides
Detailed methods by investigation type.