malware-intel
Hybrid Analysis
The community portal of CrowdStrike's Falcon Sandbox, with a large public corpus of malware analyses searchable by file hash. The website itself is captcha-protected, so the workable route is its API, keyed via a free account. A solid stop for checking whether a hash has already been analyzed and what the sandbox observed.
Por qué es útil y cómo funciona
Hybrid Analysis is the community portal for CrowdStrike's Falcon Sandbox, offering free hash-based lookups into a large library of publicly shared analysis reports. The website is protected by a CAPTCHA, so the practical way to query it programmatically is through its API, available with a free account. A quirk worth knowing: API clients must send the User-Agent header value Falcon Sandbox or requests will be rejected. Once authenticated, you can search by file hash and retrieve detailed behavioral reports showing what the sample did when executed.
Qué contiene
The Hybrid Analysis service exposes over 1.5 billion indicators of compromise drawn from its analyzed sample collection. The platform has been accumulating public community submissions since 2013, producing a substantial cross-platform corpus spanning Windows, Linux and Android environments.
Acceso por API
https://hybrid-analysis.com/api/v2/search/hash (api-key + UA 'Falcon Sandbox')
Se requiere una clave de API (normalmente gratuita); consulta los endpoints anteriores para saber dónde obtenerla.
Acceso
May require solving a captcha before it responds.