malware-intel
Hybrid Analysis
The community portal of CrowdStrike's Falcon Sandbox, with a large public corpus of malware analyses searchable by file hash. The website itself is captcha-protected, so the workable route is its API, keyed via a free account. A solid stop for checking whether a hash has already been analyzed and what the sandbox observed.
Why it’s useful & how it works
Hybrid Analysis is the community portal for CrowdStrike's Falcon Sandbox, offering free hash-based lookups into a large library of publicly shared analysis reports. The website is protected by a CAPTCHA, so the practical way to query it programmatically is through its API, available with a free account. A quirk worth knowing: API clients must send the User-Agent header value Falcon Sandbox or requests will be rejected. Once authenticated, you can search by file hash and retrieve detailed behavioral reports showing what the sample did when executed.
What’s inside
The Hybrid Analysis service exposes over 1.5 billion indicators of compromise drawn from its analyzed sample collection. The platform has been accumulating public community submissions since 2013, producing a substantial cross-platform corpus spanning Windows, Linux and Android environments.
API access
https://hybrid-analysis.com/api/v2/search/hash (api-key + UA 'Falcon Sandbox')
An API key is required (usually free); see the endpoints above for where to get one.
What we measured
Our own probes, not the archive’s own claims. Re-run periodically; every reading below is dated.
Reachability
- Direct request
- Responded HTTP 200 268 ms
- Through a datacenter proxy
- Responded HTTP 200 614 ms
- API, direct
- Blocked HTTP 403 189 ms
- API, through a proxy
- Blocked HTTP 403 804 ms
Reachability measured 2026-08-22.
Access
May require solving a captcha before it responds.