A suspicious file or process is only a threat until someone can explain exactly what it does. We turn that uncertainty into a decision: contain it, hunt for it, or stand down. That decision is based on controlled analysis, never a public sandbox verdict.
Malware analysis is the controlled examination of a suspicious file, process or memory artefact to determine what it can do, how it persists or communicates, which indicators can be hunted, and what response is justified by the evidence.
Public multi-scanner sites and shared sandboxes are useful for commodity hashes. They are the wrong tool when the sample may contain your data, unpublished tradecraft, or anything you cannot afford to broadcast to every other uploader on that platform.
This is a private, authorised malware analysis service. Transfer is arranged after authority and scope are confirmed, over a controlled channel. This website has no upload field and never detonates files.
What private malware analysis can answer
Capability
What the artefact can execute, persist, collect, change or communicate when the evidence supports it.
Exposure
Which contextual indicators and behaviours your defenders can hunt across the affected environment.
Response
Whether the evidence supports containment, broader hunting, eradication work or standing down.
Confidence
Which conclusions are observed directly, inferred technically or still unresolved.
Private analysis versus a public sandbox
Commission private analysis when
- The sample may contain client, official or personal information
- You need indicators to hunt across the rest of the estate
- The payload looks targeted, unique or unpublished
- Leadership needs a brief they can act on, not a detection ratio
A public scanner is enough when
- The hash is already in wide circulation
- The file is yours to share and contains no one else’s data
- You only need a commodity reputation signal
- You can accept the artefact becoming public
A detection ratio is not a behaviour map. Zero detections is not a clean bill of health. Read the article private malware analysis versus a public sandbox.
Current landscape
The useful question is not only whether an engine flags the artefact, but what it does in this environment and what action the evidence supports.
ASD’s ACSC defines a cyber security incident as an unwanted or unexpected event that affects the confidentiality, integrity or availability of a system or the information it stores. In FY2024–25 the Centre responded to more than 1,200 incidents (up 11%), and ransomware was present in 11% of them, consistent with the year before, not disappearing. Malware designed to covertly harvest usernames and passwords remains the precursor: stolen credentials then become the next cybercrime. Source: ACTR 2024–25.
When an endpoint detection and response (EDR) product fails, malicious cyber actors move in the gap. After the 19 July 2024 CrowdStrike outage, ASD identified hundreds of malicious websites imitating CrowdStrike and shared indicators of compromise (IOCs) over its Cyber Threat Intelligence Sharing (CTIS) platform. That is threat intelligence in the ASD sense: IOCs you can hunt, not a public sandbox score. ASD’s own annual report records the case.
Software supply-chain malware is now worm-like. CrowdStrike, Google and Shadowserver disrupted the Glassworm botnet in 2026 after it seeded VS Code extensions, npm and Python packages. The Shai-Hulud npm worm (from late 2025) used stolen tokens to infect the next maintainer’s packages. Private malware analysis is how you tell whether a “dependency update” is a computer virus in the (ISC)² sense, a program written to copy and disperse itself without the owner’s knowledge, or a noisy but benign package.
We state attribution only to the confidence the evidence supports. Shared loaders and phishing-as-a-service kits (ASD has written about Darcula Phishkit targeting Australians) are routinely misread as unique actors.
When this fits
Suspicious artefact
A file, process or memory artefact may be malicious and you need a defensible answer.
EDR alert validation
Your endpoint tooling raised an alert but cannot explain the full behaviour or impact.
Hunt scope is unclear
You need contextual indicators to search the wider environment for related activity.
A decision is blocked
Leadership and responders need one evidence base expressed at the right technical depth.
Decisions and outcomes
Analysis is built to answer: what does this sample actually do, persistence, command and control, exfiltration, lateral movement; how did it likely get in; what indicators can we hunt and block right now; and how confident are we in each finding. Confidence is stated explicitly, inference is never presented as certainty.
Scope
Typically included
- Static analysis, unpacking, string and configuration extraction, code structure
- Dynamic and behavioural analysis in an isolated environment, process, network, filesystem and registry activity
- Indicators of compromise where the sample exposes them
- An executive brief in plain language, plus a full technical report
Not included unless agreed
- Any form of public upload, a suspected sample is never submitted through this website; transfer is arranged privately, after authorisation, over a controlled channel
- Malware development, weaponisation or offensive tooling of any kind
- Attribution stated with more certainty than the evidence supports
Deliverables
- Executive brief for non-technical stakeholders
- Technical analysis report with methodology and evidence
- IOC list in a usable format, where extractable
- Eradication and containment guidance
Process
Authorise
Confirm you own or are authorised to submit the artefact.
Scope
Agree what questions the analysis needs to answer.
Analyse
Controlled analysis in an isolated environment, never on the public website.
Report and remediate
Deliver findings, IOCs and next steps.
Methods and standards
Static analysis, unpacking and configuration extraction are combined with controlled behavioural analysis when relevant to the question and safe within the agreed scope. Findings clearly separate direct observation, technical inference and recommendation, so your team can see exactly how confident each conclusion is. Exact tooling is confirmed per engagement rather than advertised as a fixed capability list.
Security and evidence
No public evidence upload
This page never accepts malware, source code or evidence. Secure transfer is agreed only after authorisation and scoping, outside this website.
Limitations
What this engagement cannot promise
Malware analysis cannot guarantee complete attribution or prove that no other compromise exists. Detection content is only as strong as the behaviours and indicators the specific artefact exposes, and one analysed sample does not establish the full extent of an incident.
Common questions
What malware artefacts can be assessed?
A scoped analysis may begin with a suspicious executable, script, document, process or memory artefact, depending on the question and the available evidence. Suitability and handling are confirmed before transfer; do not send the artefact through this website.
Why not upload the sample to VirusTotal or a public sandbox?
Those platforms share artefacts, metadata and often the fact of your submission with other participants. That can leak client data inside the sample, warn an operator that the payload has been seen, or put an unpublished implant into general circulation. Public verdicts are also a popularity contest among engines, not a behaviour map of this file in your environment. Read private analysis versus a public sandbox.
What is in a professional malware analysis report?
A decision for leadership; a technical narrative of capability (persistence, C2, theft, lateral movement); evidence for each claim; indicators you can hunt; and an explicit confidence rating. It will not invent an actor name when the evidence only supports a family or technique.
Can you tell us who wrote the malware?
Only to the confidence the evidence supports. Shared code, reused infrastructure and open-source tooling are routinely misread as unique attribution. We will say “unknown” rather than over-claim.
Do I send the file through this website?
No. Never. Use Request an assessment or Get incident help with contact details and high-level scope only. If analysis proceeds, a private transfer channel is agreed after authorisation.
Case Studies
Current published case studies. Public-source illustrations are labelled clearly and are not presented as client engagements. View all case studies.
Six gift cards and a forged executive
A courier employee bought six $500 prepaid cards after mail that looked like it came from an executive. There was no malware. The missing control sat in the payment process.
More than $150,000 to a supplier who never changed banks
A construction firm paid an invoice twice after a supplier mailbox was taken over. No callback. No funds recovered.
The backup that encrypted itself
Ransomware at an auto parts store encrypted the live files and the backup disk still plugged into the same machine. Years of data went with the old system.
Related
Ready to talk about your situation?
Tell us the high-level scope. No malware, source code or evidence – just enough for us to route you safely.