Malware analysis tools

A sample repository run by abuse.ch. Look up a hash to see whether it is a known sample, what family it belongs to and what it contacts.

Use it when

You have a hash and want family attribution rather than a verdict count.

Think twice when

You need a verdict on an unknown file. It only knows samples already submitted.

Scans a file, hash, URL or domain against 70+ antivirus engines and aggregates the verdicts, with a community comment history.

Use it when

You have a hash and want to know whether it is already known bad, or you need a fast second opinion on a file you already know is safe to publish.

Think twice when

The file contains anything confidential. Uploads are shared with paying subscribers, so submitting a client invoice, an HR document or a customer export is a disclosure. Search the hash first.

An interactive sandbox. You watch the detonation live and can click through the lures the way a victim would.

Use it when

The malware needs interaction to reveal itself, such as a password- protected archive or a multi-stage document lure.

Think twice when

Anything confidential. Free-tier sessions are public and browsable.

Detonates a file in an instrumented VM and reports its behaviour: files written, processes spawned, network destinations, persistence.

Use it when

A hash lookup came back unknown and you need to know what the thing actually does.

Think twice when

The sample is confidential. Free-tier submissions are public.

Community-reported abuse history for an IP address, with a confidence score and report categories.

Use it when

Triaging a suspicious source address in firewall or authentication logs.

Think twice when

Judging a shared or cloud IP. Scores age badly and addresses get reassigned.

Reports whether Google currently considers a site unsafe. The same data behind the browser interstitial.

Use it when

A quick reputation check, or confirming why your own site is being flagged to visitors.

Think twice when

You need depth. A clean result means "not yet flagged", not "safe".

Visits a URL in a sandboxed browser and records the page, its requests, redirects, certificates and a screenshot.

Use it when

Checking whether a link in a suspicious email is a phishing page, without opening it yourself.

Think twice when

The URL contains a token, a password reset link or anything identifying. Scans default to public. Set the visibility to unlisted, and never scan a link that is itself a credential.

Parses raw email headers into a readable delivery path with SPF, DKIM and DMARC results and per-hop delays.

Use it when

Working out whether a suspicious email really came from where it claims, which is the first question in any suspected business email compromise.

Think twice when

Headers contain internal hostnames and addresses. Redact before pasting.

DNS, mail and blocklist diagnostics, including SPF, DKIM and DMARC record checks for any domain.

Use it when

Confirming your own domain is set to DMARC enforcement, which is a baseline defence against spoofing.

Think twice when

You need historical data. It reports current state only.

Tells you which known breaches an email address or phone number appears in. Domain search covers every address on a domain you control.

Use it when

After an infostealer infection, or to set up notifications for your own domain. The domain search is the underused part.

Think twice when

You need certainty that credentials are safe. Absence is not evidence; plenty of breaches are never disclosed.

A browser-based toolkit for decoding, deobfuscating and inspecting data. Base64, hex, URL encoding, XOR, archive inspection and much more.

Use it when

Unpicking an obfuscated script or a suspicious encoded string. Everything runs in your browser, so nothing is transmitted.

Think twice when

Never a bad choice for inspection. It does not detonate anything, so it will not tell you what a binary does.

Microsoft's Windows internals tools. Autoruns for persistence, Process Explorer for running processes, TCPView for connections.

Use it when

Triaging a Windows machine you suspect is compromised, before deciding whether to rebuild.

Think twice when

You have already decided to rebuild, which for a business machine is almost always the right call.

A structured catalogue of adversary techniques, with detection and mitigation notes for each.

Use it when

Turning sandbox output into a coherent account of what happened, or mapping your controls against real technique coverage.

Think twice when

You want a quick verdict. It is a reference work, not a scanner.

Australia and New Zealand's free identity and cyber support service, with case managers for affected individuals.

Use it when

Referring customers or staff after a breach exposed their personal information. Worth naming in your notification.

Think twice when

Never. It is the single most useful referral to give an affected person.

The Australian government's cybercrime and incident reporting portal. Routes to ASD and, for criminal matters, to state and territory police.

Use it when

Any incident. Reporting is free and gets you assistance. See /report/ for which reports are mandatory.

Think twice when

Never. Note it does not satisfy your Privacy Act or SOCI obligations.

The ACCC's scam reporting service, with current scam alerts for Australia.

Use it when

Reporting a scam or invoice fraud attempt, and checking whether a campaign is already circulating locally.

Think twice when

Urgent incidents. Use the ASD hotline for anything live.