Getting Started

Installation

Requirements

• A Malware Analysis Add-on license, purchased through the Hex-Rays portal

• IDA Pro 9.5

• Python 3.10, with a dedicated Python virtual environment, as described in IDAPython environment

• HCLI 0.26 or newer

Install with HCLI

Most users should install with HCLI, which pulls all necessary files from our portal and installs any necessary dependencies. If you are installing offline or with a floating license, see the following sections.

Once you have purchased a license, install the Malware Analysis Add-on using HCLI. The Add-on will not appear in hcli extension search until you have an active license.

hcli login
hcli extension install hexrays/malware-analysis

Install offline

If you use IDA in an offline environment, such as within an airgapped network, use this method to install the Malware Analysis Add-on.

Download the offline extension bundle from the portal, using the section "Release > Plugins > Malware Analysis" and a name like "malware-analysis-offline". The bundle contains all the components and dependencies in a single archive, suitable for installation without internet connectivity. You'll need to transfer HCLI v0.26+ and the bundle to the offline environment via sneakernet.

Offline bundle in the Hex-Rays portal download center

On the offline system, use HCLI to install the Malware Analysis Add-on using the bundle:

hcli extension --repo=/path/to/bundle install malware-analysis

Note that this system still needs all the same prerequisites listed above, including IDA 9.5, Python 3.10 with a virtual environment, and HCLI.

Install for use with a Floating License Server

Use the steps described in Install offline, sharing the extension bundle within your team.

First use

Verify the menu items

Default behavior and configuration

Next steps

The concept pages explain how each feature works and how to configure it:

• Automated Unpacking detects packed samples on load and unpacks them in place.

• Isolated System Emulation lets you step through code safely with IDA's debugger controls.

• Sandbox Integration shows VMRay and Speakeasy runs on the code.

• Multi-Service Checker looks up the sample on public and commercial malware services.

• CyberChef decodes and transforms data with CyberChef recipes in IDA.

To try a common workflow from start to end, begin with Unpack a malware sample or Import sandbox results from VMRay. The how-tos page lists all workflows, such as how to recover a stack string, emulate code from an idalib script, or decode data with CyberChef and write it back to the IDB.