malware-intel
Hybrid Analysis
The community portal of CrowdStrike's Falcon Sandbox, with a large public corpus of malware analyses searchable by file hash. The website itself is captcha-protected, so the workable route is its API, keyed via a free account. A solid stop for checking whether a hash has already been analyzed and what the sandbox observed.
Чем полезен и как работает
Hybrid Analysis is the community portal for CrowdStrike's Falcon Sandbox, offering free hash-based lookups into a large library of publicly shared analysis reports. The website is protected by a CAPTCHA, so the practical way to query it programmatically is through its API, available with a free account. A quirk worth knowing: API clients must send the User-Agent header value Falcon Sandbox or requests will be rejected. Once authenticated, you can search by file hash and retrieve detailed behavioral reports showing what the sample did when executed.
Что внутри
The Hybrid Analysis service exposes over 1.5 billion indicators of compromise drawn from its analyzed sample collection. The platform has been accumulating public community submissions since 2013, producing a substantial cross-platform corpus spanning Windows, Linux and Android environments.
Доступ по API
https://hybrid-analysis.com/api/v2/search/hash (api-key + UA 'Falcon Sandbox')
Требуется ключ API (обычно бесплатный); где его получить — см. эндпоинты выше.
Доступ
May require solving a captcha before it responds.