> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/ida-9.5/add-ons/malware/release-notes.md). # Release Notes The Malware Analysis add-on has its own versions and release dates, separate from IDA. Each entry gives the add-on version, the release date, and the minimum IDA version. ## Malware Analysis 1.0 Minimum IDA version: IDA Pro 9.5. This is the first public release of the Malware Analysis add-on. It adds the **Extensions > Malware Analysis** menu to IDA Pro. ### What's included The [Multi-service Checker](/ida-9.5/add-ons/malware/concepts/multi-service-checker.md) finds out if VirusTotal, VMRay, or MalwareBazaar already knows the sample. It searches by the SHA-256 hash, and you can upload the sample to a service that does not know it. Open it with **Extensions > Malware Analysis > Triage > Services Checker** (Shift-U). [Automated unpacking](/ida-9.5/add-ons/malware/concepts/automated-unpacking.md) finds packed PE files when you open them and unpacks them in place. By default it uses the Bochs emulator, so the sample does not run on your system. To unpack at a different time, use **Malware Analysis > Unpacking > Unpack now\...** (Shift-P). To write the database to a new PE or ELF file, use **Malware Analysis > Unpacking > Dump database to binary...** (Ctrl+Shift+D). In idalib, the add-on unpacks a packed PE file automatically when you open it, always with an emulator. With [isolated system emulation](/ida-9.5/add-ons/malware/concepts/isolated-system-emulation.md), you step through a PE file in the [Speakeasy](/ida-9.5/add-ons/malware/concepts/emulators/speakeasy.md) emulator with IDA's debugger controls. Click the "magic wand" toolbar button to start a session. The sample cannot change your files, run code on your host, or connect to your network. [Sandbox integration](/ida-9.5/add-ons/malware/concepts/sandbox-integration.md) shows a Speakeasy or VMRay run on the code. Executed instructions get a highlight, and the trace view lists the API calls with their arguments. From the trace you can run capa, apply API names and types at indirect calls, and import memory regions from the run. [CyberChef](/ida-9.5/add-ons/malware/concepts/cyberchef.md) decodes and transforms data from the database with CyberChef recipes, in a panel next to the disassembly. It comes from the optional `ida-cyberchef` plugin. HCLI installs this plugin with the add-on when it can. The add-on includes the `ida-bochs-binaries` plugin, so IDA's [Bochs](/ida-9.5/add-ons/malware/concepts/emulators/bochs.md) debugger works with no setup. To change the settings of all features, use **Malware Analysis > Settings...**. A change applies when the next action starts. The add-on sends no telemetry, and it connects to an online service only when you set the API key for that service. See [Network and Data Sharing](/ida-9.5/add-ons/malware/network-and-data.md). [Triage](/ida-9.5/add-ons/malware/concepts/triage.md) and [Deobfuscation](/ida-9.5/add-ons/malware/concepts/deobfuscation.md) are coming soon. ### Requirements * IDA Pro 9.5 or later, with the MALWARE add-on in your license. IDA Free and IDA Home are not supported. * Windows x64, Linux x64, Linux arm64, or macOS on Apple silicon * Python 3.10 to 3.14 * [HCLI](https://hcli.docs.hex-rays.com) 0.27.0 or later ### Install ```bash hcli login hcli extension install hexrays/malware-analysis ``` Then restart IDA if it is open. To install offline, update, or uninstall, see [Getting Started](/ida-9.5/add-ons/malware/getting-started.md). If you have a question, an idea, or a problem, email . The Malware Analysis team reads every message and replies quickly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.hex-rays.com/ida-9.5/add-ons/malware/release-notes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.