Devirt is an automated binary analysis service for the trust and safety teams of file-hosting and distribution platforms that need to know whether an uploaded executable shows malware indicators and what it does. When a file is packed or virtualized, Devirt recovers what the protected code does and reports its file, process, persistence, network and import behavior with the analysis bounds stated, as evidence for your team's decision. Files go in one at a time or through the API, and standard automated jobs have a 24-hour SLA.
Create an account first, then upload in your workspace. If your file needs manual review, we email a written quote before paid work begins. Upload a file of up to 500 MiB and see the scope and the total before you pay. Compare prices and subscription options.
Malware triage is the first, time-limited look at a suspicious file: whether it is likely malicious, what it does and whether it needs deeper analysis. For a platform's trust and safety team, protected executables are where triage stalls, because a packer or a virtualizing protector hides the code from a static scanner, and a sandbox run shows only the paths the file took.
Devirt takes that escalation. It accepts protected, unknown and unprotected executables, identifies the protection at intake and recovers what the code does, so an uploaded file your first pass could not explain gets a readable account of its behavior.
No. Devirt reports what the file does: its file, process, persistence, network and import behavior, risk indicators and resolved interfaces, with the analysis bounds stated. Your team uses that evidence to decide whether to allow, quarantine, escalate or remove the file under your platform's rules.
Paths the analysis did not observe and behavior that depends on the environment stay marked in the ledger, so what was not checked stays visible next to what was.
Devirt delivers the output you select, together with the coverage ledger and a proof summary. For platform work, three formats cover most cases.
| Format | What it contains | Use it to |
|---|---|---|
| Full RE report (.pdf) | Architecture, behavior, identity surfaces and an executive summary | Document an allow, quarantine, escalate or remove decision |
| API JSON (.json) | Structured findings and coverage | Feed your moderation and case tools |
| IDA database (.i64) | Proven functions, named imports, typed API calls and the coverage ledger | Hand a hard case to a reverse engineer |
For a behavioral account of the whole file, protected or not, the malware analysis service reports its file, process, persistence, network and import behavior with the analysis bounds stated. Recurring submissions can go through the Devirt API, with an optional completion webhook; API access needs an API-enabled plan.
Every Devirt result carries a coverage ledger, so a handling decision can say which behavior was established and which stayed open. The ledger places every in-scope unit in one of four states: proven, runtime-dependent, unresolved or permanently bounded.
An illustrative sample, a coverage percentage or a successful decompilation is not a guarantee about every behavior of a real program, and the ledger keeps those limits in view. How Devirt separates proof from observation explains what counts as proof.
Send only files your platform is permitted to inspect under its own terms with its users. At signup and at every upload you attest to your authority to submit the file, and Devirt can decline a job or ask you to clarify its scope or authorization. Devirt does not give legal advice, so settle questions your terms leave open with counsel.
Recovery observes the sample's execution in an isolated environment, and Devirt's data-handling policy requires analysis infrastructure to be network-isolated during execution. Samples are processed only for the analysis you requested: they are not shared between customers, used to train models or added to the curated library, and input deletion begins once processing finishes and the output is available.
Yes. The Devirt API takes submissions, reports job status and returns results, with an optional signed completion webhook; API access needs an API-enabled plan. Dedicated processing, team API keys and custom SLAs can be agreed for enterprise volume.
You see the scope and the total before you pay, and complexity never adds an automatic surcharge. The per-analysis prices for protected binaries are published, and a revised scope or price always needs your approval before it is charged.
Not seeing your use case here?Create an account for assessment