Malware Analysis

The Malware Analysis lab performs static analysis only — the engine (lib/malware.ts) runs entirely on the GuardFox server with no external services or third-party sandbox. When you submit a file, the pipeline computes the following in a single pass:

• File type — detected from magic bytes (PE/EXE/DLL, ELF, Mach-O, PDF, ZIP/DOCX/APK, OLE2 DOC/XLS, RAR, GZIP, BZ2, JPEG, PNG, GIF, CAB), with a printable-byte heuristic to flag text/script files.
• Hashes — MD5, SHA-1 and SHA-256 of the raw bytes.
• Shannon entropy — a 0–8 value used to flag packed/encrypted content, mapped to a Low / Medium / High risk band.
• Strings & IOCs — printable strings (minimum length 4) are extracted, then scanned for URLs, IPv4 addresses, email addresses and domains.
• PE headers — for Windows executables, the parser reads the machine type, subsystem, section names, EXE/DLL/driver flags and a list of suspicious imported APIs.
• YARA-style rules — twelve built-in signature rules are matched against the file's strings and raw text.
• Threat score & verdict — a weighted score (capped at 100) is derived from the rule hits, entropy and imports, and mapped to a verdict.

Every completed analysis is saved to a per-organization submission history. When a file scores 40 or higher, the analyzer also raises an alert (severity Critical at 70+, otherwise High) tagged malware-lab and triggers any matching SOAR playbooks.

Submit a file

The page opens on the Upload & Analyze File mode. Drag a file onto the drop zone or click it to browse. Any file type is accepted (EXE, DLL, PDF, Office documents, scripts, archives). A progress indicator steps through the pipeline while the server analyzes the bytes.

Read the results

When analysis completes, a verdict banner shows a circular threat gauge, the verdict label, threat score out of 100, file type, size, entropy and risk band, analysis time in milliseconds, and clickable MITRE ATT&CK technique links. Below it, behavior tags summarize what was found, and the results are split across tabs:

• Overview — MD5 / SHA-1 / SHA-256 hashes, PE header details (machine, subsystem, EXE/DLL/driver, sections, suspicious imports) and suspicious strings.
• YARA Matches — each matched rule with its severity, MITRE technique, description and the specific patterns that hit.
• Extracted Strings — the printable strings pulled from the file (first 200 shown).
• IOCs — indicators grouped by type (IPs, URLs, domains, emails, registry keys, mutexes, file paths, SHA-256/MD5 hashes, Bitcoin addresses, shell commands). Individual indicators can be copied, and the whole set can be exported as a STIX 2.1 bundle.
• Sandbox Emulation — a representative runtime trace (process tree, filesystem, registry and network activity).
• Deobfuscator — the script deobfuscator, described below.
• JSON Report — the full machine-readable report, which can also be downloaded via Download Report.

Previous analyses

The Previous Analyses panel lists your organization's recent submissions with the file name, a truncated hash and a color-coded threat score. Clicking an entry reloads that report from history.

Script Deobfuscator

Switch to the Script Deobfuscator mode (or the Deobfuscator tab) to paste an obfuscated command line or script. It runs entirely in your browser and will Base64-decode a PowerShell -EncodedCommand/-enc payload (decoded as UTF-16LE) and defang URLs, domains and IPs (for example http://evil.com becomes hxxp://evil[.]com). The output can be copied to the clipboard.

Verdict thresholds

The threat score (0–100) maps directly to a verdict:

How the score is built

The score is a sum of weighted signals, capped at 100:

• YARA rule hits: +25 per Critical rule, +15 High, +8 Medium, +3 Low/Info.
• Entropy: +20 if above 7.5, or +10 if above 7.0.
• Suspicious imports: +15 for CreateRemoteThread, +10 for VirtualAllocEx.
• +5 if any public (non-RFC1918) IP address is found.

Entropy is also reported as a risk band: High above 7.0, Medium above 5.5, otherwise Low.

Built-in detection rules

The engine ships with these twelve YARA-style rules, each mapped to a MITRE ATT&CK technique:

All endpoints require an authenticated session and are scoped to the caller's organization.

Analyze a file

POST /api/malware/analyze — accepts a multipart form with a single file field and returns the full analysis report as JSON. Also persists the submission to history and, for scores of 40+, raises an alert.

curl -X POST https://YOUR-GUARDFOX-HOST/api/malware/analyze \
  -H "Cookie: next-auth.session-token=..." \
  -F "[email protected]"

Key fields in the response report:

List submission history

GET /api/malware/submissions — returns up to the 100 most recent submissions for your organization (newest first). Each item includes fileName, fileHash, fileSize, fileType, verdict, threatScore, createdAt and a parsed iocs array.

curl https://YOUR-GUARDFOX-HOST/api/malware/submissions \
  -H "Cookie: next-auth.session-token=..."

Fetch one submission

GET /api/malware/submissions/{id} — returns a single submission with its parsed iocs, staticAnalysis, behavior, sandbox and threatIntelParsed objects. A matching DELETE removes the record.

curl https://YOUR-GUARDFOX-HOST/api/malware/submissions/SUBMISSION_ID \
  -H "Cookie: next-auth.session-token=..."