malware-intel
Hybrid Analysis
The community portal of CrowdStrike's Falcon Sandbox, with a large public corpus of malware analyses searchable by file hash. The website itself is captcha-protected, so the workable route is its API, keyed via a free account. A solid stop for checking whether a hash has already been analyzed and what the sandbox observed.
Por que é útil e como funciona
Hybrid Analysis is the community portal for CrowdStrike's Falcon Sandbox, offering free hash-based lookups into a large library of publicly shared analysis reports. The website is protected by a CAPTCHA, so the practical way to query it programmatically is through its API, available with a free account. A quirk worth knowing: API clients must send the User-Agent header value Falcon Sandbox or requests will be rejected. Once authenticated, you can search by file hash and retrieve detailed behavioral reports showing what the sample did when executed.
O que há dentro
The Hybrid Analysis service exposes over 1.5 billion indicators of compromise drawn from its analyzed sample collection. The platform has been accumulating public community submissions since 2013, producing a substantial cross-platform corpus spanning Windows, Linux and Android environments.
Acesso via API
https://hybrid-analysis.com/api/v2/search/hash (api-key + UA 'Falcon Sandbox')
É necessária uma chave de API (geralmente gratuita); veja os endpoints acima para saber onde obtê-la.
Acesso
May require solving a captcha before it responds.