malware-intel
Hybrid Analysis
The community portal of CrowdStrike's Falcon Sandbox, with a large public corpus of malware analyses searchable by file hash. The website itself is captcha-protected, so the workable route is its API, keyed via a free account. A solid stop for checking whether a hash has already been analyzed and what the sandbox observed.
Son utilité et son fonctionnement
Hybrid Analysis is the community portal for CrowdStrike's Falcon Sandbox, offering free hash-based lookups into a large library of publicly shared analysis reports. The website is protected by a CAPTCHA, so the practical way to query it programmatically is through its API, available with a free account. A quirk worth knowing: API clients must send the User-Agent header value Falcon Sandbox or requests will be rejected. Once authenticated, you can search by file hash and retrieve detailed behavioral reports showing what the sample did when executed.
Ce qu’elle contient
The Hybrid Analysis service exposes over 1.5 billion indicators of compromise drawn from its analyzed sample collection. The platform has been accumulating public community submissions since 2013, producing a substantial cross-platform corpus spanning Windows, Linux and Android environments.
Accès API
https://hybrid-analysis.com/api/v2/search/hash (api-key + UA 'Falcon Sandbox')
Une clé API est requise (généralement gratuite) ; consultez les points d’accès ci-dessus pour savoir où l’obtenir.
Accès
May require solving a captcha before it responds.