Inspect, analyze, classify, and detect, malware binary analysis
Analyze a suspected keylogger binary, inspect PE headers, identify suspicious API imports, extract string artifacts, and locate the C2 exfiltration URL.
Analyze a UEFI bootkit that modifies the boot process to load malicious code before the operating system, achieving persistence below the OS level and evading standard antivirus.
Analyze a malicious Microsoft Office document containing obfuscated VBA macros that download and execute a second-stage payload through PowerShell command construction.
Dissect a ransomware sample, identify encryption routines, ransom note templates, targeted file extensions, and a potential kill switch domain.
Investigate a fileless malware attack that abuses legitimate Windows tools (PowerShell, WMI, mshta) to execute entirely in memory, persisting through registry run keys and WMI event subscriptions.
Reverse engineer a malicious Android application to identify data exfiltration capabilities, SMS interception, overlay attacks for credential theft, and command-and-control communication channels.
Analyze a RAT binary, reverse the C2 protocol, map persistence mechanisms, enumerate capabilities, and extract network indicators of compromise.
Analyze a kernel-mode rootkit that hooks system call tables, hides processes and files from user-mode tools, and intercepts network traffic to maintain a covert backdoor.
Analyze malware protected by a custom crypter that uses multi-layer encryption, anti-debugging tricks, and runtime code generation to evade static analysis and antivirus detection.
Investigate a heavily packed dropper, identify the packing layer, analyze entropy anomalies, locate unpacking stubs, and trace the staged payload delivery.
Analyze a network worm that exploits SMB vulnerabilities, generates domain generation algorithm (DGA) domains for C2, and uses lateral movement techniques to spread across corporate networks.
Investigate a trojanized open-source library that was compromised at the package repository level, injecting a backdoor into thousands of dependent applications through the software supply chain.