File and threat analysis
Queries VirusTotal, MetaDefender, Filescan.io, Hatching Triage, Kaspersky OpenTip, YARAify, MalwareBazaar, URLhaus and MalShare all at once.
Drop the file here
or tap to choose from your device
Maximum size: 32 MBFile Scanner
Bytecode-aware triage in your browser: JVM class parsing, structural XOR/Base64/char-array string recovery, PE static analysis, family detection — plus a local class patcher that neutralizes anti-analysis methods. Nothing is uploaded, executed, or submitted. Dynamic sandbox submission is a separate, fully voluntary tab.
Select a file
LOCAL SCANFile metadata
Computed locallyArchive files
Embedded images
Extracted strings
- Static-only analysis.
Class patcher
stub anti-analysis methods · download cleaned JARAnti-analysis methods are preselected. Stubbed methods return 0/false/null (or 1/true when ticked), drop their exception tables, and never run the original body. String constants remain — the patched JAR is still flagged statically. Everything runs locally and the repacked JAR is never uploaded.
Submitting a sample here uploads it to tria.ge, a third-party sandbox operated by Recorded Future. Once uploaded, the sample WILL leave your control: it can be shared with antivirus vendors, shown to other analysts, and it cannot be recalled or deleted on request. Only submit files you are authorized to analyze, and never submit anything containing your own sensitive data. Submission is entirely voluntary — the static scanner works fully without it.
Submit to tria.ge
NO SCANTask
idleConsole
wrapper build + tria.ge polling · one ping per minuteSubmissions ride through this deployment's worker (your tria.ge report link is public by tria.ge's rules). See the Submission Policy tab: vendor submission is voluntary and everything you run through this tool stays under your control and responsibility until you explicitly press Submit.
Credits
Submission Policy
read before using Dynamic AnalysisEverything this tool does — scanning, patching, editing class files, deobfuscating — happens locally in your browser and stays entirely under your control and YOUR RESPONSIBILITY. MalAnalyze takes no action on a sample beyond showing you information. What you decide to do with a sample, a patched JAR, or a submission is your decision and your responsibility alone.
Samples are never submitted to antivirus vendors or sandboxes automatically, in the background, or by default. You may choose voluntarily whether to submit a sample to a vendor (tria.ge, VirusTotal, etc.) or not. Submission only ever happens when you explicitly press a submit button and confirm the warning — and you can use the full static scanner forever without submitting anything to anyone.
IP addresses are logged for security reasons. This deployment records the connecting IP for rate limiting and abuse prevention (bots scanning for vulnerable endpoints get banned automatically). Logs are used only to keep the service available and are not sold or shared.
When you submit a sample to tria.ge, it leaves your control: the sample may become visible to other analysts, feed vendor detections, and cannot be deleted on request. Treat every submission as public and permanent.
Edit string constants
Disassembly
Source preview
Loading…
Deobfuscate JAR
Select the exact transformers to run. They are applied from top to bottom in the order shown.
Processing happens in this browser. The uploaded JAR is treated as bytecode data and is never launched. Transformers decode string constants back into the constant pool and rename scrambled non-ASCII classes, methods, and fields — string literals are only rewritten by the decoder you picked. Selecting unrelated transformers can damage the generated JAR, so use only the passes you need. Transformers that must execute target methods are unavailable in MalAnalyze by design.
"Safe / no match" means no built-in indicator matched. It does not prove the file is safe. This is static triage, not a sandbox.