> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/ida-9.5/add-ons/malware.md). # Malware Analysis Accelerate malware analysis in the tool you already use. The Malware Analysis add-on brings malware analysis workflows into IDA Pro: automated unpacking, safe emulation, sandbox context, and data decoding. It helps malware analysts find the code that matters and understand what it does, without leaving IDA. Hex-Rays builds and maintains it. ## Basic Resources


Overview	What the add-on does, who it is for, and its key features	Overview
Getting Started	Requirements, installation, and first use	Getting Started

## Concepts


Automated Unpacking	Detect packed samples on load and unpack them in place	Automated Unpacking
Isolated System Emulation	Step through code safely with IDA's debugger controls	Isolated System Emulation
Sandbox Integration	Show VMRay and Speakeasy runs on the code	Sandbox Integration
Bochs	IDA's Bochs debugger, ready to use with no setup	Bochs
Sogen	Emulator that runs the real Windows system DLLs	Sogen
Speakeasy	Windows malware emulator and sandbox from Mandiant	Speakeasy
Multi-Service Checker	Look up the sample on VirusTotal, VMRay, and MalwareBazaar	Multi-Service Checker
CyberChef	Decode and transform data with CyberChef recipes in IDA	CyberChef

## Try it yourself


Unpack a malware sample	Load a packed sample and let the add-on recover the inner payload	Unpack a Malware Sample
Import sandbox results from VMRay	Map a VMRay run onto the disassembly	Import Sandbox Results from VMRay
All how-tos	Emulation, stack strings, manual unpacking, decoding data, and more	How-tos

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.hex-rays.com/ida-9.5/add-ons/malware.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.