Malware analysis sandboxes save time and help with triage during incident response and forensic investigations. They provide an overview of the specimen’s capabilities, so that analysts can decide where to focus their follow-up efforts.
Here is a comprehensive listing of freely available automated malware analysis services:
- AMAaaS (Android files)
- Any.run (Community Edition)
- Binary Guard True Bare Metal
- Intezer Analyze (Community Edition)
- IRIS-H (focuses on document files)
- CAPE Sandbox
- Comodo Valkyrie
- Detux Sandbox (Linux binaries)
- Hatching Triage (Individual and researcher licenses)
- Joe Sandbox Cloud (Community Edition)
- SecondWrite (free version)
- Hybrid Analysis
If you know of another reliable and free service I didn’t list, please let me know. My other lists of free security resources are: Blocklists of Suspected Malicious IPs and URLs and On-Line Tools for Malicious Website Lookups.
In the malware analysis course I teach at SANS Institute, I explain how to reverse-engineer malicious software in your own lab. It’s a useful skill for incident responders and security practitioners; however, analyzing all software in this manner is impractical without some automated assistance.