File Analysis

File scanner, threat detection rule library, and custom rule editor.

Rules: 200 in scope 4 categories

Comprehensive scan

Scanning against the curated default rule set (up to 200 of 8,548 enabled rules) — fast, high-confidence detections. Scanning the full library is limited to platform admins; use rule customization below to swap in specific other rules instead.

ACE_Containing_EXE malware · critical

APT28_CHOPSTICK malware · critical

APT28_SourFace_Malware1 malware · critical

APT28_SourFace_Malware3 malware · critical

APT6_Malware_Sample_Gen malware · critical

APT_APT28_generic_poco_openssl malware · critical

APT_APT29_NOBELIUM_BoomBox_May21_1 malware · critical

APT_APT29_NOBELIUM_NativeZone_Loader_May21_1 malware · critical

APT_APT41_HIGHNOON malware · critical

APT_APT41_HIGHNOON_BIN malware · critical

APT_APT41_POISONPLUG_2 malware · critical

APT_APT41_POISONPLUG_3 malware · critical

APT_APT41_POISONPLUG_SHADOW malware · critical

APT_APT41_RevokedCert_Aug19_1 malware · critical

APT_Backdoor_SUNBURST_1 malware · critical

APT_CN_TwistedPanda_SPINNER_2 malware · critical

APT_CN_TwistedPanda_loader malware · critical

APT_Cloaked_PsExec malware · critical

APT_Cloaked_ScanLine malware · critical

APT_Dropper_Raw64_TEARDROP_1 malware · critical

APT_FIN7_MsDoc_Sep21_1 malware · critical

APT_HAFNIUM_ForensicArtefacts_WER_Mar21_1 malware · critical

APT_HKTL_Proxy_Tool_Jun23_1 malware · critical

APT_HKTL_Wiper_WhisperGate_Jan22_1 malware · critical

APT_IIS_Config_ProxyShell_Artifacts malware · critical

APT_IN_TA397_wmRAT malware · critical

APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 malware · critical

APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 malware · critical

APT_MAL_CISA_10365227_03_ClientUploader_Dec21 malware · critical

APT_MAL_Hunting_LUA_SEASIDE_1 malware · critical

APT_MAL_IR_DruidFly_Wiper_Jun25 malware · critical

APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_2 malware · critical

APT_MAL_LUA_Hunting_Lua_SKIPJACK_2 malware · critical

APT_MAL_LUA_Hunting_SKIPJACK_1 malware · critical

APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 malware · critical

APT_MAL_NK_3CX_macOS_Elextron_App_Mar23_1 malware · critical

APT_MAL_RANSOM_ViceSociety_PolyVice_Jan23_1 malware · critical

APT_MAL_RU_Snake_Malware_Queue_File_May23_1 malware · critical

APT_MAL_RU_WIN_Snake_Malware_May23_1 malware · critical

APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext malware · critical

APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext malware · critical

APT_MAL_Sandworm_Exaramel_Strings_Typo malware · critical

APT_MAL_Sandworm_Exaramel_Task_Names malware · critical

APT_MAL_UNC4841_SEASPY_Jun23_1 malware · critical

APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 malware · critical

APT_MAL_WildNeutron_javacpl malware · critical

APT_MAL_macOS_NK_3CX_Malicious_Samples_Mar23_1 malware · critical

APT_Malware_PutterPanda_MsUpdater_1 malware · critical

APT_Malware_PutterPanda_PSAPI malware · critical

APT_Malware_PutterPanda_Rel malware · critical

APT_NK_MAL_DLL_Apr23_1 malware · critical

APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 malware · critical

APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 malware · critical

APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 malware · critical

APT_NK_Methodology_Artificial_UserAgent_IE_Win7 malware · critical

APT_NK_TradingTech_ForensicArtifacts_Apr23_1 malware · critical

APT_PS1_SysAid_EXPL_ForensicArtifacts_Nov23_1 malware · critical

APT_PY_ESXi_Backdoor_Dec22 malware · critical

APT_SAP_NetWeaver_Exploitation_Activity_Apr25_1 malware · critical

APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1 malware · critical

APT_SharpTongue_JS_SharpExt_Chrome_Extension malware · critical

APT_Turla_Agent_BTZ_Gen_1 malware · critical

APT_UA_Hermetic_Wiper_Feb22_1 malware · critical

APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 malware · critical

APT_UNC5221_Ivanti_ForensicArtifacts_Jan24_1 malware · critical

APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 malware · critical

APT_Webshell_SUPERNOVA_1 malware · critical

APT_Webshell_SUPERNOVA_2 malware · critical

APT_Winnti_MAL_Dec19_2 malware · critical

APT_Winnti_MAL_Dec19_4 malware · critical

ASPX Webshell webshell · critical

ASPack_ASPACK malware · critical

Acrotray_Anomaly malware · critical

Apolmy_Privesc_Trojan malware · critical

ArtTray_zip_Folder_ArtTray malware · critical

BKDR_XZUtil_KillSwitch_CVE_2024_3094_Mar24_1 malware · critical

BKDR_XZUtil_Script_CVE_2024_3094_Mar24_1 malware · critical

BTC_Miner_lsass1_chrome_2 malware · critical

BeepService_Hacktool malware · critical

BlackCat ALPHV Ransomware backdoor · critical

BlackEnergy_KillDisk_1 malware · critical

BlackEnergy_KillDisk_2 malware · critical

Brooxml_Hunting malware · critical

Brute Ratel C4 Framework backdoor · critical

ByPassFireWall_zip_Folder_Ie malware · critical

CHAOS_Payload malware · critical

CN_GUI_Scanner malware · critical

CN_Hacktool_MilkT_BAT malware · critical

CN_Hacktool_MilkT_Scanner malware · critical

CN_Hacktool_SSPort_Portscanner malware · critical

CN_Hacktool_S_EXE_Portscanner malware · critical

CN_Honker_Alien_D malware · critical

CN_Honker_Alien_command malware · critical

CN_Honker_Baidu_Extractor_Ver1_0 malware · critical

CN_Honker_COOKIE_CooKie malware · critical

CN_Honker_ChinaChopper_db malware · critical

CN_Honker_Churrasco malware · critical

CN_Honker_CleanIISLog malware · critical

CN_Honker_CnCerT_CCdoor_CMD_2 malware · critical

CN_Honker_CookiesView malware · critical

CN_Honker_CoolScan_scan malware · critical

CN_Honker_Cracker_SHELL malware · critical

CN_Honker_D_injection_V2_32 malware · critical

CN_Honker_DictionaryGenerator malware · critical

CN_Honker_F4ck_Team_F4ck_3 malware · critical

CN_Honker_F4ck_Team_f4ck malware · critical

CN_Honker_F4ck_Team_f4ck_2 malware · critical

CN_Honker_Fpipe_FPipe malware · critical

CN_Honker_GetHashes malware · critical

CN_Honker_GetHashes_2 malware · critical

CN_Honker_GetPass_GetPass malware · critical

CN_Honker_GetSyskey malware · critical

CN_Honker_GetWebShell malware · critical

CN_Honker_GroupPolicyRemover malware · critical

CN_Honker_HTran2_4 malware · critical

CN_Honker_HconSTFportable malware · critical

CN_Honker_Hookmsgina malware · critical

CN_Honker_IIS_logcleaner1_0_readme malware · critical

CN_Honker_Injection_transit malware · critical

CN_Honker_Interception3389_setup malware · critical

CN_Honker_Intersect2_Beta malware · critical

CN_Honker_LPK2_0_LPK malware · critical

CN_Honker_Layer_Layer malware · critical

CN_Honker_MAC_IPMAC malware · critical

CN_Honker_MSTSC_can_direct_copy malware · critical

CN_Honker_Master_beta_1_7 malware · critical

CN_Honker_NBSI_3_0 malware · critical

CN_Honker_Pwdump7_Pwdump7 malware · critical

CN_Honker_SAMInside malware · critical

CN_Honker_ScanHistory malware · critical

CN_Honker_ShiftBackdoor_Server malware · critical

CN_Honker_T00ls_Lpk_Sethc_v2 malware · critical

CN_Honker_T00ls_Lpk_Sethc_v4_LPK malware · critical

CN_Honker_T00ls_scanner malware · critical

CN_Honker_Tuoku_script_MSSQL_ malware · critical

CN_Honker_Tuoku_script_oracle_2 malware · critical

CN_Honker_WebCruiserWVS malware · critical

CN_Honker_Webshell_ASPX_shell_shell malware · critical

CN_Honker_Webshell_ASP_hy2006a malware · critical

CN_Honker_Webshell_ASP_rootkit malware · critical

CN_Honker_Webshell_PHP_php1 malware · critical

CN_Honker_Webshell_PHP_php5 malware · critical

CN_Honker_Webshell_PHP_php9 malware · critical

CN_Honker_Webshell_Serv_U_by_Goldsun malware · critical

CN_Honker_Webshell_Serv_U_serv_u malware · critical

CN_Honker_Webshell_Serv_U_servu malware · critical

CN_Honker_Webshell_Tuoku_script_mssql_2 malware · critical

CN_Honker_Webshell_Tuoku_script_mysql malware · critical

CN_Honker_Webshell_WebShell malware · critical

CN_Honker_Webshell_jspshell malware · critical

CN_Honker_Webshell_jspshell2 malware · critical

CN_Honker_Webshell_portRecall_jsp malware · critical

CN_Honker_Webshell_portRecall_jsp2 malware · critical

CN_Honker_Without_a_trace_Wywz malware · critical

CN_Honker__D_injection_V2_32_D_injection_V2_32_D_injection_V2_32 malware · critical

CN_Honker__LPK_LPK_LPK malware · critical

CN_Honker__PostgreSQL_mysql_injectV1_1_Creak_Oracle_SQLServer_inject_Creaked malware · critical

CN_Honker_arp3_7_arp3_7 malware · critical

CN_Honker_cleaner_cl_2 malware · critical

CN_Honker_clearlogs malware · critical

CN_Honker_dirdown_dirdown malware · critical

CN_Honker_exp_iis7 malware · critical

CN_Honker_hxdef100 malware · critical

CN_Honker_mafix_root malware · critical

CN_Honker_ms10048_x64 malware · critical

CN_Honker_mssqlpw_scan malware · critical

CN_Honker_nc_MOVE malware · critical

CN_Honker_no_net_priv_esc_AddUser malware · critical

CN_Honker_passwd_dict_3389 malware · critical

CN_Honker_portRecall_bc malware · critical

CN_Honker_shell_brute_tool malware · critical

CN_Honker_sig_3389_2_3389 malware · critical

CN_Honker_sig_3389_3389_2 malware · critical

CN_Honker_sig_3389_3389_3 malware · critical

CN_Honker_sig_3389_DUBrute_v3_0_RC3_2_0 malware · critical

CN_Honker_super_Injection1 malware · critical

CN_Honker_syconfig malware · critical

CN_Honker_windows_mstsc_enhanced_RMDSTC malware · critical

CN_Honker_wwwscan_gui malware · critical

CN_Portscan malware · critical

CN_Toolset_LScanPortss_2 malware · critical

CN_Toolset_NTscan_PipeCmd malware · critical

CN_Toolset__XScanLib_XScanLib_XScanLib malware · critical

CN_Toolset_sig_1433_135_sqlr malware · critical

CVE_2015_1701_Taihou exploit · critical

CVE_2017_8759_SOAP_via_JS exploit · critical

Casper_Backdoor_x86 malware · critical

Casper_EXE_Dropper malware · critical

Casper_Included_Strings malware · critical

Certutil_Decode_OR_Download malware · critical

CheshireCat_Gen1 malware · critical

CheshireCat_Gen2 malware · critical

CheshireCat_Sample2 malware · critical

Chinese_Hacktool_1014 malware · critical

CleanIISLog malware · critical

CloudDuke_Malware malware · critical

CobaltStrike Beacon backdoor · critical

CoinHive_Javascript_MoneroMiner malware · critical

CoinMiner_Strings malware · critical

Conti Ransomware backdoor · critical

Scan Categories

Select which rule categories to include in the scan

No categories selected — scan will cover all 200 default rules across every category shown above.

File to Scan

Your file is uploaded to the server for string extraction and YARA scanning. The raw file is never persisted — only scan results and reports are saved.

Public by default. Scan results (file hash, matched rules, extracted strings, and analysis) are shared publicly in the community database, similar to VirusTotal or Hybrid Analysis. Do not upload files containing personal data, credentials, proprietary source code, or other sensitive/confidential information.

Drop a file or click to browse

Any file type · max 256 MB · raw file is not stored

Scan starting soon…

Select a file and click Scan File to run YARA analysis.