Hey all - Cyble (YC W21) here. We've been heads-down on MalwareAnalyzer (https://malwareanalyzer.com): a public malware analysis and threat intelligence platform. Submit a file, a URL, or a hash and get a verdict backed by real evidence. Public analysis is free and unlimited, and no account is required.

We just crossed 500,000 samples analyzed, which felt like a reasonable excuse to finally post here.

What's actually in it

Multi-engine static scanning. Free and open engines (ClamAV, YARA, hash feeds, static tooling) run locally; third-party AV engines run on an isolated in-VPC Windows scanner. The report shows only the engines that actually ran — no padded vendor list.

Real sandbox detonation. We execute the sample, not just scan it. Full behavior capture across process, file, registry and network activity.

Interactive live-VM analysis. Take the wheel mid-detonation: click through installers, dismiss dialogs, trigger the behavior that only fires on user interaction. Choose your guest OS, network mode and engine — and diff two builds side by side.

URL and phishing analysis. Paste a link and get the redirect chain, hosting and verdict without touching it yourself.

Queryable threat-intelligence graph. Pivot from a sample out to infrastructure, families and related samples. Search the whole corpus by content, indicator, MITRE technique or family — then save it as a standing hunt and get notified when something new matches.

ATT&CK mapping with receipts. Every technique is attributed to its source (static capa rule vs. observed at runtime) with confidence weights, plus rule-set hashes so a report is reproducible.

Reports that admit what they don't know. If an analysis tier fails to complete, the report is marked degraded and queued for re-analysis rather than presented as clean coverage. A report with no findings and no degradation notice is a real negative result.

An API with no key required.

```

curl -X POST https://malwareanalyzer.com/v1/submit \

-H 'content-type: application/json' \

-d "{\"fileName\":\"sample.bin\",\"fileBase64\":\"$(base64 < sample.bin | tr -d '\n')\"}"

```

Returns a task id and a report URL. Submissions are unlimited; lookups are capped at 1,000/day per IP.

Why this might matter even if you're not a security company

Someone on your team is eventually going to get a strange attachment, an unsigned installer from a vendor, or a "recruiter" link that smells wrong. Drop it in and get an answer in about a minute - better than a Slack thread of guesses.

Free covers submissions and full reports. Premium compute (private analysis, deep URL scans, the AI assistant) runs on credits, and every account starts with a free grant.

Happy to go deep on any of this - the interactive sandbox was by far the hardest part to get right. Feedback, bug reports and "your report was wrong about my file" all very welcome.