Hybrid Analysis

Definition

Hybrid Analysis is a free automated malware analysis service that detonates submitted files and URLs inside instrumented virtual sandboxes and reports the resulting behavior, network activity, and threat classification. It was built on CrowdStrike's Falcon sandbox technology and made available to the security community as a no-cost portal for researchers, incident responders, and students. Users submit a sample and receive a detailed report covering process trees, dropped files, registry modifications, and network indicators without needing their own sandbox infrastructure.

Overview

Hybrid Analysis addresses a practical problem for security researchers and responders: building and maintaining an isolated, instrumented environment capable of safely detonating malware is costly and technically demanding. Hybrid Analysis removes that barrier by offering a public portal where anyone can submit a suspicious file or URL and receive an automated behavioral report generated by a hosted sandbox, without running any infrastructure themselves. Under the hood, submitted samples are executed inside virtual machines instrumented to hook system calls, monitor process creation, and capture network traffic while the sample runs. The underlying engine, derived from CrowdStrike's Falcon Sandbox, combines this dynamic execution with static analysis of the file's structure to produce a combined verdict and a threat score. The report includes a process tree showing what the sample spawned, any files it dropped or modified, registry keys it touched, and network connections it attempted, along with extracted indicators of compromise that can feed other tools. Compared to VirusTotal, which mainly aggregates static antivirus verdicts, Hybrid Analysis specializes in dynamic behavioral detonation, closer in purpose to Any.Run but fully automated rather than interactively driven by the analyst in real time. It sits between a pure reputation lookup and a fully manual reverse-engineering session in Ghidra or IDA Pro, giving a behavioral picture without requiring the analyst to write or step through disassembled code. In practice, incident responders submit phishing attachments or suspicious downloads to quickly understand what a sample does before deciding on containment steps. Threat researchers use it to generate behavioral reports for malware families they are tracking, and students and hobbyists use the free public portal to learn how malware analysis reports are structured without needing lab infrastructure. Its API also supports automated submission pipelines that flag samples encountered by other security tools. Limitations include that public submissions may be visible to other users and vendors, which rules out submitting sensitive or client-confidential samples, and that sophisticated malware can detect sandbox environments and alter its behavior or refuse to execute, producing an incomplete report. Execution time is also limited per submission, so malware with long dormant periods or that requires specific triggering conditions may not reveal its full behavior, meaning analysts sometimes still need manual dynamic or static analysis to confirm findings. Its reports are often used alongside network capture tools like Wireshark to corroborate observed command-and-control traffic against packet-level evidence, and its structured indicators feed directly into SIEM correlation rules for ongoing detection.

Key Features

• Automated dynamic detonation of files and URLs in isolated sandboxes
• Generates process trees showing spawned processes and file drops
• Captures network traffic and registry activity during execution
• Combines static and dynamic analysis into a single threat score
• Offers a free public tier alongside paid enterprise access
• Built on CrowdStrike's Falcon Sandbox detonation technology
• Extracts indicators of compromise for downstream threat intelligence use
• Provides an API for automated sample submission and reporting

Use Cases

Alternatives

Frequently Asked Questions

Related in Cybersecurity