Malware analysis service.

Analyze protected or ordinary binaries in an isolated environment and receive a clear, evidence-backed behavioral report.

Start an analysis Find the right plan

Unknown does not have to mean protected. Start with the file and the question you need answered.

What is a malware analysis service?

A malware analysis service examines a suspicious file for you and reports what it does: which files and processes it touches, how it persists, what it contacts on the network and which imports it uses. Devirt's malware analysis service analyzes protected or ordinary binaries in an isolated environment and returns an evidence-backed behavioral report, with a coverage ledger that states which parts of the code were proven and which stayed open.

The protection is the obstacle.
Understanding is the outcome.

What we support

Unknown-file triage for hosting and trust teams
File, process, persistence, network, and import behavior
Full evidence ledger with explicit analysis bounds

Family recognition is an intake decision, not a guarantee for every build. Custom behavior and multiple protection layers can require a separate assessment.

What changes in your workflow

A binary does not need virtualization to enter the automated analysis path. Devirt can reverse ordinary compiled programs, map their behavior and interfaces, and surface risk indicators for your authorized review.

The delivery pairs readable output with a full ledger for the agreed scope. Proven, runtime-dependent, unresolved, and permanently bounded units remain distinguishable, including units that were never virtualized.

See how the checks work

Who uses a malware analysis service

A malware analysis service is for teams that need to know what a file does before they decide how to handle it. Devirt's malware analysis service serves these teams:

Incident response and security operations teams that need the behavior of a sample found on their own systems.
Threat intelligence and malware researchers who need the logic behind a sample, including code hidden by a protector.
Trust and safety teams at file-hosting platforms that need an evidence-backed handling decision for an unknown upload.

Devirtualization for trust and safety teams

What the malware analysis report contains

A Devirt malware analysis report describes the file, process, persistence, network and import behavior of the sample, together with a full evidence ledger that states the explicit analysis bounds. You can also choose any of the five output formats: an IDA database, annotated pseudocode, a full reverse engineering report covering architecture, behavior and identity surfaces with an executive summary, LLVM IR, or API JSON for automated workflows.

The malware analysis report covers file behavior, process behavior, persistence, network behavior and imports, and each finding comes with an evidence ledger that places every function in one of four states: proven, runtime-dependent, unresolved or permanently bounded. — Illustration. Every behavioral finding comes with the ledger that states how far it was proven.

See a synthetic sample assessment

Sandbox results vs evidence-backed analysis

A malware sandbox run shows what a sample did during that run. The result is fast, but it covers only the paths the run took, and samples that detect a debugger, a virtual machine or a sandbox can change their behavior while they are observed.

An evidence-backed malware analysis recovers the code behind the behavior and states what the analysis did not settle. Functions that depend on an input or environment the analysis never observed are reported as runtime-dependent instead of being left out, so the report shows its own limits.

One sandbox run shows what the sample did during that run and leaves open the paths it never took. Evidence-backed analysis shows the recovered code behind the behavior and keeps every function it could not settle in the ledger. — Illustration. A sandbox shows what happened once. An evidence-backed report also says what it did not settle.

A protected binary analysis workflow, stage by stage

Protected and VM-packed malware

Malware authors use the same commercial protectors as software developers, including VMProtect and Themida, to slow down analysis. A protector's virtual machine turns selected functions into bytecode, so a decompiler shows the interpreter instead of the malicious logic, and unpacking alone does not make those functions readable.

Devirt's malware analysis service applies the same automated devirtualization it offers for VMProtect and Themida to protected samples, so the logic recovered from inside the protector's virtual machine is reported in the same coverage ledger as the unprotected code.

Devirtualization for malware analysts

How the evidence is reported

Every Devirt result places each unit in the agreed scope in one of four states: proven, runtime-dependent, unresolved or permanently bounded. The four states always add up to the total, so a function the analysis could not settle stays visible in the ledger instead of disappearing from the report, and a counterexample or a timeout is never counted as proof.

How live malware samples are handled

Devirt analyzes each malware sample in an isolated service with no shared customer state, and its data-handling policy requires analysis infrastructure to be network-isolated during execution. Samples are used only for the analysis you requested; they are not shared between customers or used to train models.

Released output is retained for 72 hours by default or 30 days on Team, and processing audit logs for 90 days.

A live malware sample moves through three steps: an authorized upload, analysis in an isolated service that is network-isolated during execution, and a released report retained for 72 hours by default or 30 days on Team. The sample is never shared between customers or used to train models. — Illustration. The sample is used only for the analysis you requested.

See what lands on your desk.

One recovered program. Different ways to work with it. Inspect a teaching example, switch formats, and follow the link back to its evidence.

One analysis · five handoffs

Example deliverableSynthetic data · not a customer file

Same logic. A different view.

VirtualizedInstructions through a VM

Protected logicTeaching VM / instruction listing

1; Authored teaching VM, not vendor bytecode
200  LOAD32  r0, input.size
301  PUSH    r0
402  PUSH    0x10
503  UGE
604  STORE   p0
705  LOAD32  r1, input.magic
806  PUSH    r1
907  PUSH    0x44565254
1008  EQ
1109  LOAD    p0
1210  AND
1311  RET

DevirtualizedThe deliverable you can inspect

validate_recordC / sample function

1#include <stdbool.h>
2#include <stdint.h>
3 
4bool validate_record(uint32_t size, uint32_t magic) {
5  const uint32_t header_size = 16u;
6  const uint32_t expected_magic = 0x44565254u;
7 
8  if (size < header_size) {
9    return false;
10  }
11 
12  return magic == expected_magic;
13}

Drag the divider to reveal the difference. Or choose a view above. Keyboard: arrow keys, Home and End.

In ordinary language

Check the declared size. Check the type marker. Accept only when both checks pass.

The evidence travels with the file.

Readable code explains the behavior. The ledger explains how far you can rely on it.

Download teaching source

Original teaching material, not customer output. The IDA view illustrates a database's contents; it is not a downloadable .i64. No measured proof or service benchmark is claimed by these examples.

Your build determines
the final scope.

Standard automated jobs have a 24-hour SLA; eligible express jobs have a one-hour SLA. Novel engagements use an accepted offer, a 72–168 hour window, and senior review before release.

Compare starting prices

Malware analysis service: questions and answers

Can I submit malware I did not write?

Yes, for defensive work. Malware analysis and defensive threat intelligence are accepted use cases under Devirt's acceptable use policy, which also prohibits deploying or improving malware.

Read the acceptable use policy

Will my malware sample be shared?

No. Devirt processes each sample only for the analysis you requested, does not share it between customers and does not use it to train models.

What happens if the sample detects the analysis?

Behavior that depends on the environment is reported, not hidden. Functions whose outcome depends on an input or environment state the analysis did not observe are marked runtime-dependent in the coverage ledger, and unfamiliar builds or several protection layers can need a written assessment before work starts.

Does Devirt give a malicious or clean verdict?

Devirt reports what the sample does and what the analysis proved, with explicit bounds, so your team can make the handling decision on evidence it can inspect.

What happens if the analysis fails?

Functions the analysis could not settle stay in the ledger as runtime-dependent, unresolved or bounded. If a job fails or misses its service level, used credits are returned and the per-job cash refund is requested automatically.

How long does a malware analysis take?

Standard automated jobs have a 24-hour service level, and eligible express jobs a one-hour service level. Novel engagements use an accepted offer, a 72 to 168 hour window and senior review before release.

Your binary stays your business.

Isolated analysis. No sharing between customers. No training on your upload. Your file is used only for the work you requested.

Read the data-handling policy

Input

Your uploaded file

Isolated processing

In scope

Output

Your result files

Not yet released

In scope

Audit

Processing record

Recording the work

In scope

Different data. Different clocks.

Input deletion follows delivery. This timeline shows the default 72-hour output window. Team outputs are kept for 30 days. Audit records have a separate 90-day window.

Policy illustration, not a live deletion certificate. Deletion is confirmed from provider receipts. Assessment inputs, unpaid jobs, and account/billing records have their own rules in the policy.

What do you need to understand?

Start in your account. If your upload needs manual work, we review it and email you a written scope and quote before paid work begins.

Create your workspace

Create an account, verify your email and upload your file. We review custom work and email your scope and quote.

Create account

Find the right plan