Hybrid Analysis is a cloud-based malware analysis service for investigating files and URLs. It combines static and dynamic analysis to help detect unknown threats. File collections can receive Falcon Static Analysis (ML), reputation lookups, checks by AV engines, and static analysis. The community service allows up to 30 file uploads per month, with a maximum size of 100 MB per upload. Search options cover reports, YARA, strings, and indicators of compromise. Registered users can generate a restricted free Public API key for submissions, searches, report retrieval, and data erasure, subject to privileges. The API is available alongside the web service. Hybrid static and runtime analysis is supported for Windows 7 and Windows 10, with extensive static analysis for Android APK files. Listed integrations include VirusTotal, OPSWAT Metadefender, and SIEM systems such as HP ArcSight, Suricata, and Phantom. Submitted content may be retained or shared, including screenshots and metadata from samples marked not to share. Use is limited to internal business security or legitimate research purposes.
Who it is for
It suits security teams and legitimate researchers who need to analyze files or URLs and search for reports or indicators. Users should consider the service’s data-sharing terms before submitting content.
What is good
- Free community service with 30 monthly uploads
- Supports file and URL submissions
- Includes report, YARA, string, and IOC searches
- Offers a restricted free Public API key
What to know first
- Maximum upload size is 100 MB
- Community uploads are limited to 30 per month
- Submitted content may be retained or shared
Verdict
Hybrid Analysis offers file and URL analysis, multiple search tools, and API access on a free community plan. Its upload limits and content-sharing terms are important considerations before use.
Hybrid Analysis plans and pricing
All plansCompared on malware analysis sandboxes
- Free plan
- Yes
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
- Deployment model
- cloud
