Read before it runs.
The file is taken apart on the page before it ever gets a machine. Configuration, keys and intent, extracted, not observed.
Lives inside Threat.Zone
What the extractor returns
- C2 addresses
- The servers the sample is built to call home to, read straight from its configuration.
- Encryption keys
- The keys it carries to protect its traffic and its payload.
- Protocols
- How it intends to talk once it is running.
- .NET deobfuscation
- Wrapped .NET is read through the wrapping, so the code underneath is the code you see.
- 30 micro-analysis engines
- Structure, packers, signatures, strings. Each engine reads one thing and reads it well.
Where reading is not enough, emulation predicts what the file would do. Its behaviour is worked out by emulating it, instruction by instruction, without ever letting it run.
Threat.Zone Static analysis is the first pass in Threat.Zone. Every submission is read before it is run.
See Threat.ZoneQuestions we get asked
What is static malware analysis?
Reading a file without running it: its structure, packers, signatures, strings and embedded configuration. It is fast, it is safe, and it works on samples that refuse to run in a sandbox. Its limit is what the file hides behind encryption or unpacking, which is where dynamic analysis takes over.
What does the configuration extractor return?
The C2 addresses the sample is built to call, the encryption keys it carries, the protocols it intends to speak, and for wrapped .NET the deobfuscated code underneath. These land in the report as indicators you can block or hunt with before the sample has run anywhere.
Static or dynamic malware analysis: which one do I need?
Both. Static analysis answers in seconds and never executes the sample; dynamic analysis in the sandbox shows what it actually does, including behaviour that static reading cannot reach. Threat.Zone runs both on every submission and puts the results in one report.
What is emulation and when is it used?
When reading is not enough and running is not wanted, the file is emulated instruction by instruction to predict what it would do. Shellcode, JavaScript, PowerShell and Visual Basic scripts are typical cases; the output arrives in seconds without a machine ever executing the sample.
See the file before it moves.
Register at app.threat.zone and submit a sample. The static report is ready before the dynamic one begins.
Register now