# Malware analysis tools > Free tools for checking a file, link, address or email, and what happens > to whatever you submit. **Check before you upload.** Most public scanners share what you submit. Uploading a file that contains personal information is a disclosure, and for an Australian APP entity that can be an eligible data breach in its own right, separate from the incident being investigated. Search the hash first: if it is already known you learn what you needed and disclose nothing. ## URL and domain ### AbuseIPDB https://www.abuseipdb.com - Disclosure: Lookup only: you send an identifier, never the content itself - Cost: freemium - Purpose: Community-reported abuse history for an IP address, with a confidence score and report categories. - Use it when: Triaging a suspicious source address in firewall or authentication logs. - Think twice when: Judging a shared or cloud IP. Scores age badly and addresses get reassigned. ### Google Safe Browsing status https://transparencyreport.google.com/safe-browsing/search - Disclosure: Lookup only: you send an identifier, never the content itself - Cost: free - Purpose: Reports whether Google currently considers a site unsafe. The same data behind the browser interstitial. - Use it when: A quick reputation check, or confirming why your own site is being flagged to visitors. - Think twice when: You need depth. A clean result means "not yet flagged", not "safe". ### urlscan.io https://urlscan.io - Disclosure: PUBLIC: submissions are visible to other users or paying subscribers - Cost: freemium - Purpose: Visits a URL in a sandboxed browser and records the page, its requests, redirects, certificates and a screenshot. - Use it when: Checking whether a link in a suspicious email is a phishing page, without opening it yourself. - Think twice when: The URL contains a token, a password reset link or anything identifying. Scans default to public. Set the visibility to unlisted, and never scan a link that is itself a credential. ## Sandbox ### ANY.RUN https://any.run - Disclosure: PUBLIC: submissions are visible to other users or paying subscribers - Cost: freemium - Purpose: An interactive sandbox. You watch the detonation live and can click through the lures the way a victim would. - Use it when: The malware needs interaction to reveal itself, such as a password- protected archive or a multi-stage document lure. - Think twice when: Anything confidential. Free-tier sessions are public and browsable. ### Hybrid Analysis https://www.hybrid-analysis.com - Disclosure: PUBLIC: submissions are visible to other users or paying subscribers - Cost: freemium - Purpose: Detonates a file in an instrumented VM and reports its behaviour: files written, processes spawned, network destinations, persistence. - Use it when: A hash lookup came back unknown and you need to know what the thing actually does. - Think twice when: The sample is confidential. Free-tier submissions are public. ## Reference ### MITRE ATT&CK https://attack.mitre.org - Disclosure: Runs locally: nothing leaves your browser or machine - Cost: free - Purpose: A structured catalogue of adversary techniques, with detection and mitigation notes for each. - Use it when: Turning sandbox output into a coherent account of what happened, or mapping your controls against real technique coverage. - Think twice when: You want a quick verdict. It is a reference work, not a scanner. ## Utilities ### CyberChef https://gchq.github.io/CyberChef/ - Disclosure: Runs locally: nothing leaves your browser or machine - Cost: free - Purpose: A browser-based toolkit for decoding, deobfuscating and inspecting data. Base64, hex, URL encoding, XOR, archive inspection and much more. - Use it when: Unpicking an obfuscated script or a suspicious encoded string. Everything runs in your browser, so nothing is transmitted. - Think twice when: Never a bad choice for inspection. It does not detonate anything, so it will not tell you what a binary does. ### Sysinternals Suite https://learn.microsoft.com/sysinternals/ - Disclosure: Runs locally: nothing leaves your browser or machine - Cost: free - Purpose: Microsoft's Windows internals tools. Autoruns for persistence, Process Explorer for running processes, TCPView for connections. - Use it when: Triaging a Windows machine you suspect is compromised, before deciding whether to rebuild. - Think twice when: You have already decided to rebuild, which for a business machine is almost always the right call. ## Credential and identity ### Have I Been Pwned https://haveibeenpwned.com - Disclosure: Lookup only: you send an identifier, never the content itself - Cost: free - Purpose: Tells you which known breaches an email address or phone number appears in. Domain search covers every address on a domain you control. - Use it when: After an infostealer infection, or to set up notifications for your own domain. The domain search is the underused part. - Think twice when: You need certainty that credentials are safe. Absence is not evidence; plenty of breaches are never disclosed. ## Australian ### IDCARE https://www.idcare.org - Disclosure: Vendor-held: stored by the vendor, not published - Cost: free - Purpose: Australia and New Zealand's free identity and cyber support service, with case managers for affected individuals. - Use it when: Referring customers or staff after a breach exposed their personal information. Worth naming in your notification. - Think twice when: Never. It is the single most useful referral to give an affected person. ### ReportCyber https://www.cyber.gov.au/report - Disclosure: Vendor-held: stored by the vendor, not published - Cost: free - Purpose: The Australian government's cybercrime and incident reporting portal. Routes to ASD and, for criminal matters, to state and territory police. - Use it when: Any incident. Reporting is free and gets you assistance. See /report/ for which reports are mandatory. - Think twice when: Never. Note it does not satisfy your Privacy Act or SOCI obligations. ### Scamwatch https://www.scamwatch.gov.au - Disclosure: Vendor-held: stored by the vendor, not published - Cost: free - Purpose: The ACCC's scam reporting service, with current scam alerts for Australia. - Use it when: Reporting a scam or invoice fraud attempt, and checking whether a campaign is already circulating locally. - Think twice when: Urgent incidents. Use the ASD hotline for anything live. ## File and hash analysis ### MalwareBazaar https://bazaar.abuse.ch - Disclosure: Lookup only: you send an identifier, never the content itself - Cost: free - Purpose: A sample repository run by abuse.ch. Look up a hash to see whether it is a known sample, what family it belongs to and what it contacts. - Use it when: You have a hash and want family attribution rather than a verdict count. - Think twice when: You need a verdict on an unknown file. It only knows samples already submitted. ### VirusTotal https://www.virustotal.com - Disclosure: PUBLIC: submissions are visible to other users or paying subscribers - Cost: freemium - Purpose: Scans a file, hash, URL or domain against 70+ antivirus engines and aggregates the verdicts, with a community comment history. - Use it when: You have a hash and want to know whether it is already known bad, or you need a fast second opinion on a file you already know is safe to publish. - Think twice when: The file contains anything confidential. Uploads are shared with paying subscribers, so submitting a client invoice, an HR document or a customer export is a disclosure. Search the hash first. ## Email ### Google Admin Toolbox Messageheader https://toolbox.googleapps.com/apps/messageheader/ - Disclosure: Vendor-held: stored by the vendor, not published - Cost: free - Purpose: Parses raw email headers into a readable delivery path with SPF, DKIM and DMARC results and per-hop delays. - Use it when: Working out whether a suspicious email really came from where it claims, which is the first question in any suspected business email compromise. - Think twice when: Headers contain internal hostnames and addresses. Redact before pasting. ### MXToolbox https://mxtoolbox.com/SuperTool.aspx - Disclosure: Lookup only: you send an identifier, never the content itself - Cost: freemium - Purpose: DNS, mail and blocklist diagnostics, including SPF, DKIM and DMARC record checks for any domain. - Use it when: Confirming your own domain is set to DMARC enforcement, which is a baseline defence against spoofing. - Think twice when: You need historical data. It reports current state only. --- General information only, not legal advice. https://www.malware.com.au/tools/