> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/add-ons/malware/overview.md). # Overview The Malware Analysis add-on is a set of IDA Pro features for malware analysts. Hex-Rays builds and maintains them as one product. You install the add-on with HCLI, and it adds the **Extensions → Malware Analysis** menu to IDA. The add-on uses IDA's own UI and API, so there is no new interface to learn. Emulation uses the debugger controls you already know. As it recovers relevant context, like resolved indirect calls, the results show in the disassembly and pseudocode views. When you rename an item during emulation, IDA keeps the new name in your database. ## Purpose Analysts use IDA because of how it disassembles and decompiles code. But IDA is a general tool, and malware analysis has many slow manual steps: find the packer, unpack the sample, set up a safe debugger, and match sandbox output to the code. The add-on does these steps for you, or makes them easier, so you can find the code that matters and understand what it does. * Remove repetitive unpacking work on commodity malware. * Step through confusing code safely, with no VM to set up. * Turn sandbox output into context on the code that caused it. Many teams keep their own scripts for these tasks, and the scripts stop working when their maintainer leaves. Hex-Rays maintains the add-on, so you get updates and you can report bugs to . ## Who it is for The add-on is for malware analysts, often on a team that triages many samples. In SOC monitoring, analysts triage a high volume of alerts and find the samples that need a human. In incident response, they recover the inner payload fast and connect it to the wider investigation. Threat intelligence analysts study code and data structures to write signatures and attribute samples. AV and product teams use the add-on to develop countermeasures and ship detections. For a team, the add-on gives a common baseline. All analysts can unpack common samples and emulate code in the same way. This makes the analysis more consistent, and junior analysts can recover payloads that otherwise need manual unpacking skills. ## Key features ### Multi-service checker Check if external services, such as VirusTotal, VMRay, and MalwareBazaar, already know the sample, so that you can quickly get their analysis and background context. Open the checker with **Extensions → Malware Analysis → Triage → Services Checker** (Shift + U). The checker searches each service by the SHA-256 hash of the input file, so you get results before auto-analysis completes. Each service needs an API key. If a service does not know the sample, you can upload it. By default, the checker asks for confirmation before each upload. See [Multi-service Checker](/add-ons/malware/concepts/multi-service-checker.md). ### Automated unpacking When you open a packed PE file, the add-on asks if it should unpack the sample. After you confirm, the unpacker unpacks the sample in place: it overwrites the packed data and shows analyzable code immediately. You can also start it at any time with **Malware Analysis → Unpacking → Unpack now\...** (Shift + P). You do not have to set up a debugger, dump memory, or repair imports by hand. For samples that the unpacker cannot handle, you can unpack manually with the isolated system emulator. See [Automated Unpacking](/add-ons/malware/concepts/automated-unpacking.md). ### Isolated system emulation Start an interactive "debug" session with one click on the toolbar button (the "magic wand"), or with **Malware Analysis → Emulation → Start interactive emulation → with Speakeasy**. Step, set breakpoints, and stop or restart with IDA's debugger controls. Interactive emulation uses [Speakeasy](/add-ons/malware/concepts/emulators/speakeasy.md) and works on PE files. The sample runs in the emulator, never on your system, so you do not need a VM or a remote debugger. It cannot change your files, run code on your host, or connect to your network. See [Isolation](/add-ons/malware/concepts/isolated-system-emulation.md#isolation). See [Isolated System Emulation](/add-ons/malware/concepts/isolated-system-emulation.md). ### Sandbox integration Import a sandbox run from VMRay or Speakeasy and cross-reference its behavior with the code. The **Malware Analysis → Sandbox** menu runs the Speakeasy sandbox, loads a Speakeasy report, or fetches or imports VMRay results. IDA highlights the instructions that executed, which shows you the code coverage. The trace view shows the API calls and their arguments, and lets you jump directly to the code that made each call. You can also import memory regions from the run, such as shellcode and injected payloads. See [Sandbox Integration](/add-ons/malware/concepts/sandbox-integration.md). ### CyberChef Use CyberChef, the "Cyber Swiss Army Knife", in IDA. Develop and run transformation recipes against data in the IDB, and write the results back into your database. This helps you extract configuration blocks from malware. Open it with **Malware Analysis → Data Transformation → Open CyberChef**. CyberChef is a separate, optional plugin that HCLI installs together with the add-on when it can. ![CyberChef side panel next to the disassembly](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-9815c62b46a58edf8559d509b4b8c26174acd820%2Fcyberchef-side-panel.png?alt=media\&token=2d74a406-6255-4bd0-a260-9be42813d6f9) See [CyberChef](/add-ons/malware/concepts/cyberchef.md). ## Getting started To install the add-on and open your first sample, see [Getting Started](/add-ons/malware/getting-started.md). For the features in each release, see [Release Notes](/add-ons/malware/release-notes.md). If you have a question, an idea, or a problem, email . The Malware Analysis team reads every message and replies quickly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.hex-rays.com/add-ons/malware/overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.