Malware Analysis Tools
Sandboxing services and analysis frameworks that execute, classify, and triage suspicious binaries, documents, and scripts to extract indicators and understand attacker capabilities.
| Tool | License | Platforms | Pricing | Action |
|---|---|---|---|---|
| ANY.RUN | Proprietary | Web | Freemium | Profile→ |
| capa | Apache-2.0 | Linux, macOS, Windows | Open Source | Profile→ |
| CAPE Sandbox | GPL-3.0-only | Linux | Open Source | Profile→ |
| Detect It Easy | MIT | Linux, macOS, Windows | Open Source | Profile→ |
| FLOSS | Apache-2.0 | Linux, macOS, Windows | Open Source | Profile→ |
| Hybrid Analysis | Proprietary | Web | Freemium | Profile→ |
| Joe Sandbox | Proprietary | Web | Freemium | Profile→ |
| oletools | BSD-2-Clause | Linux, macOS, Windows | Open Source | Profile→ |
| peepdf | GPL-3.0-or-later | Linux, macOS, Windows | Open Source | Profile→ |
| PEStudio | Proprietary | Windows | Freemium | Profile→ |
| Recorded Future Triage | Proprietary | Web | Freemium | Profile→ |
| VirusTotal | Proprietary | Web | Freemium | Profile→ |
Software in Malware Analysis Tools
ANY.RUN
FreemiumInteractive online malware sandbox where analysts control the VM during detonation in real time.
capa
Open SourceCapability detector that identifies what a binary does and maps findings to MITRE ATT&CK, supporting both static and dynamic analysis.
CAPE Sandbox
Open SourceOpen-source malware analysis sandbox derived from Cuckoo that adds automated unpacking, debugger integration, and C2 configuration extraction.
Detect It Easy
Open SourceCross-platform file type and packer identifier for PE, ELF, Mach-O, and APK samples.
FLOSS
Open SourceAutomated string extractor that deobfuscates stack, tight, and encoded strings in malware binaries.
Hybrid Analysis
FreemiumFree automated malware analysis service powered by CrowdStrike Falcon Sandbox.
Joe Sandbox
FreemiumDeep automated malware analysis platform for Windows, macOS, Android, and Linux samples.
oletools
Open SourcePython toolkit for analyzing Microsoft Office documents, VBA macros, and OOXML attachments.
peepdf
Open SourcePython PDF analysis tool for finding JavaScript, shellcode, and exploit artifacts in documents.
PEStudio
FreemiumWindows static analysis tool that surfaces suspicious indicators in PE files without executing them.
Recorded Future Triage
FreemiumCloud malware sandbox for Windows, Linux, macOS, and Android samples with automated scoring.
VirusTotal
FreemiumOnline service that scans files, domains, IPs, and URLs against dozens of antivirus engines.
Frequently Asked Questions
What is Malware Analysis Tools?→
Sandboxing services and analysis frameworks that execute, classify, and triage suspicious binaries, documents, and scripts to extract indicators and understand attacker capabilities.
What topics does the Malware Analysis Tools category cover?→
Automated Sandboxing, Static Capability Detection, Binary & Patch Diffing, Deobfuscation & File Carving, Online Malware Scanning
About Malware Analysis Tools
Malware analysis tools examine suspicious files and scripts to determine what they do and how to detect them. The category includes automated sandboxes that run samples in isolated virtual machines and record behavior such as file changes, registry writes, and network connections. Static analysis tools read the file itself, identifying capabilities, packers, obfuscated strings, and embedded configurations without executing anything. Binary diffing tools compare two builds of a program, which helps analysts understand what a vendor changed in a security patch. Analysts use these tools to extract indicators of compromise, classify malware families, and produce detection rules. The work overlaps with digital forensics, where sandbox and static analysis results feed incident investigations, and with reverse engineering, where deeper questions require disassembly and debugging. Most static analysis tools in this category are open source, while interactive sandboxes are usually commercial services with free public tiers for single samples.
Covered Topics & Disciplines
Related Security Categories
Disk and memory forensics, malware sandboxes, and incident response collection platforms.
Disassemblers, binary decompilers, and dynamic execution analyzers.
Threat intelligence platforms, IOC sharing communities, and STIX/TAXII tooling for collecting and distributing threat data.