Malware Analysis

Accelerate malware analysis in the tool you already use.

The Malware Analysis add-on brings malware analysis workflows into IDA Pro: automated unpacking, safe emulation, sandbox context, and data decoding. It helps malware analysts find the code that matters and understand what it does, without leaving IDA. Hex-Rays builds and maintains it.

Basic Resources

Overview

What the add-on does, who it is for, and its key features

Getting Started

Requirements, installation, and first use

Concepts

Automated Unpacking

Detect packed samples on load and unpack them in place

Isolated System Emulation

Step through code safely with IDA's debugger controls

Sandbox Integration

Show VMRay and Speakeasy runs on the code

Bochs

IDA's Bochs debugger, ready to use with no setup

Sogen

Emulator that runs the real Windows system DLLs

Speakeasy

Windows malware emulator and sandbox from Mandiant

Multi-Service Checker

Look up the sample on VirusTotal, VMRay, and MalwareBazaar

CyberChef

Decode and transform data with CyberChef recipes in IDA

Try it yourself

Unpack a malware sample

Load a packed sample and let the add-on recover the inner payload

Import sandbox results from VMRay

Map a VMRay run onto the disassembly

All how-tos

Emulation, stack strings, manual unpacking, decoding data, and more