Malware Analysis Sandboxes Cheat Sheet: Free Tools for Triage
A suspicious file, a weird link, a hash from an alert — these are the free services that tell you what it does without running it on your own machine. The blue-team companion to the recon sheets: where OSINT maps a target, this is triaging what lands in your inbox or your SIEM.
Never upload confidential files. Public sandboxes share submissions with vendors and, on free tiers, often the whole community — a document with credentials, PII or internal data becomes public the moment you submit it. Search by hash first, and only detonate samples you're authorized to handle.
Hash first, upload never (if you can help it)
Before submitting anything, compute its hash locally and search that. If the sample is known, you learn what it is without uploading — and without tipping off an attacker who monitors the public feeds for their own sample to appear.
sha256sum suspicious.bin
Windows PowerShell: Get-FileHash suspicious.bin. Paste the hash into VirusTotal's search — a hit means it's already been analysed and you never had to hand over the file.
Detonate it and watch — online sandboxes
When the file is genuinely unknown and you're authorized to analyse it, these run it in a disposable VM and report what it touches: files, registry, network, processes.
| Service | Best for |
|---|---|
| VirusTotal | 70+ AV engines plus community intel on a file, URL, hash or domain. The fastest first look — and the one to search by hash before you upload anything. |
| ANY.RUN | Interactive sandbox: the sample runs in a live VM you can click around in. Best for multi-stage payloads that wait for a user to open a document or click a button. |
| Joe Sandbox | Deep automated reports across Windows, Linux, macOS and Android, with behavioural graphs and MITRE ATT&CK mapping. |
| Hybrid Analysis | CrowdStrike's Falcon Sandbox front end. Free file and URL detonation with signatures, extracted IOCs and process trees. |
Decode and deobfuscate
Half of malware analysis is peeling back encoding. A Base64 blob in a script, a URL-encoded redirect, a macro that builds its command line one character at a time — these unwrap it.
| Tool | What it does |
|---|---|
| CyberChef | The “cyber swiss-army knife”. Chain recipes to decode Base64, XOR, gzip, URL-encoding and dozens more — entirely in your browser, so nothing leaves the tab. |
| URL Decoder/Encoder | Quick %-decode of a suspicious URL without spinning up a whole tool. |
| XLMMacroDeobfuscator | Extracts and deobfuscates Excel 4.0 (XLM) macros — the old technique that keeps coming back for hiding payloads in spreadsheets. |
xlmdeobfuscator --file suspicious.xls
Pulls the hidden Excel 4.0 macro out of a spreadsheet and prints the deobfuscated command line — without ever opening the file in Excel. Background on why this technique came back: Excel 4.0 macros, so hot right now.
Practise this for real
Reading about triage only goes so far. To build the muscle, generate your own alerts and work them:
- IBM QRadar Log Source Simulator — produces varied security logs to triage, search and write rules against, on your own SIEM.
- Hands-on labs — the full StashGrid lab ladder.
- OSINT & recon sheet — the offensive-recon counterpart to this defensive triage.
Tool descriptions reflect each service's current free tier, checked on the date shown up top. The hash-first and don't-upload-secrets guidance is standard SOC practice, not optional. Something changed? Tell me and I'll fix it.