Getting started
Malva.RE analyzes suspicious files statically: it unpacks every layer, decompiles scripts and macros, runs YARA rules and extracts indicators (C2, URLs, configurations). The file is never executed.
1. Create an account
Sign up with your email or with Google / Microsoft on the sign-in page. Confirm your email address with the link you receive (check your spam folder if it does not arrive).
2. Submit a file
Drop a file on the home page (50 MB maximum, more than 50 formats: PE and .NET executables, Office documents, PDF, LNK, scripts, archives…). You can also submit a URL from the Scan URL tab.
On the Free plan, submissions and reports are public: do not submit customer or confidential files. Private submissions are available with Essential and Premium.
3. Read the report
- Infection chain and file structure: every extracted layer, with the malicious path highlighted.
- Characteristics: hashes, entropy, format details (PE Explorer for executables).
- YARA rules, configurations and indicators extracted by family-specific collectors.
- STICH: a structural fingerprint of the infection method (documentation).
4. Quotas
The number of analyses is counted per week: 6 on Free, 20 on Essential, 200 on Premium. See plans and features.
5. Automate
Premium plans can submit files and fetch reports programmatically: see the API documentation.