{"id":112785,"title":"MalwareAnalyzer: Static scanning, real detonation, an interactive live VM, and a threat graph you can pivot through","tagline":"We just crossed 500K samples analyzed - free for anyone here.","body":"Hey all - Cyble (YC W21) here. We've been heads-down on MalwareAnalyzer (\u003chttps://malwareanalyzer.com\u003e): a public malware analysis and threat intelligence platform. Submit a file, a URL, or a hash and get a verdict backed by real evidence. Public analysis is free and unlimited, and no account is required.\n\nWe just crossed 500,000 samples analyzed, which felt like a reasonable excuse to finally post here.\n\n**What's actually in it**\n\n**Multi-engine static scanning.** Free and open engines (ClamAV, YARA, hash feeds, static tooling) run locally; third-party AV engines run on an isolated in-VPC Windows scanner. The report shows only the engines that actually ran — no padded vendor list.\n\n**Real sandbox detonation.** We execute the sample, not just scan it. Full behavior capture across process, file, registry and network activity.\n\n**Interactive live-VM analysis.** Take the wheel mid-detonation: click through installers, dismiss dialogs, trigger the behavior that only fires on user interaction. Choose your guest OS, network mode and engine — and diff two builds side by side.\n\n**URL and phishing analysis.** Paste a link and get the redirect chain, hosting and verdict without touching it yourself.\n\n**Queryable threat-intelligence graph.** Pivot from a sample out to infrastructure, families and related samples. Search the whole corpus by content, indicator, MITRE technique or family — then save it as a standing hunt and get notified when something new matches.\n\n**ATT\u0026amp;CK mapping with receipts.** Every technique is attributed to its source (static capa rule vs. observed at runtime) with confidence weights, plus rule-set hashes so a report is reproducible.\n\n**Reports that admit what they don't know.** If an analysis tier fails to complete, the report is marked degraded and queued for re-analysis rather than presented as clean coverage. A report with no findings _and_ no degradation notice is a real negative result.\n\n**An API with no key required.**\n\n\\`\\`\\`\n\ncurl -X POST \u003chttps://malwareanalyzer.com/v1/submit\u003e \\\\\n\n  -H 'content-type: application/json' \\\\\n\n  -d \"{\\\\\"fileName\\\\\":\\\\\"sample.bin\\\\\",\\\\\"fileBase64\\\\\":\\\\\"$(base64 \u0026lt; sample.bin | tr -d '\\\\n')\\\\\"}\"\n\n\\`\\`\\`\n\nReturns a task id and a report URL. Submissions are unlimited; lookups are capped at 1,000/day per IP.\n\n**Why this might matter even if you're not a security company**\n\nSomeone on your team is eventually going to get a strange attachment, an unsigned installer from a vendor, or a \"recruiter\" link that smells wrong. Drop it in and get an answer in about a minute - better than a Slack thread of guesses.\n\nFree covers submissions and full reports. Premium compute (private analysis, deep URL scans, the AI assistant) runs on credits, and every account starts with a free grant.\n\nHappy to go deep on any of this - the interactive sandbox was by far the hardest part to get right. Feedback, bug reports and \"your report was wrong about my file\" all very welcome.","slug":"TL7-malwareanalyzer-static-scanning-real-detonation-an-interactive-live-vm-and-a-threat-graph-you-can-pivot-through","created_at":"2026-08-31T15:04:07.208Z","updated_at":"2026-09-19T09:00:28.062Z","total_vote_count":2,"url":"https://www.ycombinator.com/launches/TL7-malwareanalyzer-static-scanning-real-detonation-an-interactive-live-vm-and-a-threat-graph-you-can-pivot-through","share_image_url":"//bookface-static.ycombinator.com/assets/ycdc/yc-og-image-c440a0ad1dacfb86eeeb343717479cc54d256614449b4ef719977a0a451f8bc8.png","company":{"id":22781,"name":"Cyble","slug":"cyble","url":"https://cyble.com/","logo":"https://bookface-images.s3.amazonaws.com/small_logos/f1559fe73a2c1a1b683d40299a231a3a0becfe24.png","batch":"Winter 2021","industry":"B2B","tags":["SaaS","Security","AI"],"search_path":"https://bookface.ycombinator.com/company/22781"}}