Malware Analysis Tools
Sandboxing services and analysis frameworks that execute, classify, and triage suspicious binaries, documents, and scripts to extract indicators and understand attacker capabilities.
Software in Malware Analysis Tools
12 toolsNo tools in this category match the selected filters.
| Tool | License | Platforms | Pricing |
|---|---|---|---|
| ANY.RUN Interactive online malware sandbox where analysts control the VM during detonation in real time. | Proprietary | Web | Freemium |
| capa Capability detector that identifies what a binary does and maps findings to MITRE ATT&CK, supporting both static and dynamic analysis. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| CAPE Sandbox Open-source malware analysis sandbox derived from Cuckoo that adds automated unpacking, debugger integration, and C2 configuration extraction. | GPL-3.0-only | Linux | Open Source |
| Detect It Easy Cross-platform file type and packer identifier for PE, ELF, Mach-O, and APK samples. | MIT | Linux, macOS, Windows | Open Source |
| FLOSS Automated string extractor that deobfuscates stack, tight, and encoded strings in malware binaries. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| Hybrid Analysis Free automated malware analysis service powered by CrowdStrike Falcon Sandbox. | Proprietary | Web | Freemium |
| Joe Sandbox Deep automated malware analysis platform for Windows, macOS, Android, and Linux samples. | Proprietary | Web | Freemium |
| oletools Python toolkit for analyzing Microsoft Office documents, VBA macros, and OOXML attachments. | BSD-2-Clause | Linux, macOS, Windows | Open Source |
| peepdf Python PDF analysis tool for finding JavaScript, shellcode, and exploit artifacts in documents. | GPL-3.0-or-later | Linux, macOS, Windows | Open Source |
| pestudio Windows static analysis tool that surfaces suspicious indicators in PE files without executing them. | Proprietary | Windows | Free / Commercial |
| Recorded Future Triage Cloud malware sandbox for Windows, Linux, macOS, and Android samples with automated scoring. | Proprietary | Web | Freemium |
| VirusTotal Online service that scans files, domains, IPs, and URLs against dozens of antivirus engines. | Proprietary | Web | Freemium |
About Malware Analysis Tools
Malware analysis tools examine suspicious files and scripts to determine what they do and how to detect them. The category includes automated sandboxes that run samples in isolated environments and record behavior such as created, modified, and deleted files and network traffic. Static analysis tools read the file itself, identifying capabilities, packers, obfuscated strings, and malicious macros without executing anything. Binary diffing tools, listed in the reverse engineering category, compare two builds of a program, which helps analysts understand what a vendor changed in a security patch. Analysts use these tools to extract indicators of compromise, classify malware families, and produce detection rules. The work overlaps with digital forensics, where sandbox and static analysis results feed incident investigations, and with reverse engineering, where deeper questions require disassembly and debugging. Most static analysis tools in this category are open source, while hosted sandboxes are usually commercial services with free public tiers.
Covered Topics
In This Catalog
- This category lists 12 tools: 6 open source, 5 freemium, and 1 free / commercial.
- By platform, 6 run on Linux, 6 on Windows, 5 on macOS, and 5 on the web.
- The most common license among the open-source tools is Apache-2.0 (2 tools).
Frequently Asked Questions
What is Malware Analysis Tools?→
Sandboxing services and analysis frameworks that execute, classify, and triage suspicious binaries, documents, and scripts to extract indicators and understand attacker capabilities.
What topics does the Malware Analysis Tools category cover?→
Automated Sandboxing, Static Capability Detection, Packer & File Type Identification, String & Macro Deobfuscation, Online Malware Scanning
Which Malware Analysis tools are open source?→
6 of the 12 tools in this category are open source: capa, CAPE Sandbox, Detect It Easy, FLOSS, oletools, and peepdf.