Using HybridAnalysis

HybridAnalysis is an automated sandbox offering from CrowdStrike utilizing their Falcon Sandbox technology in order to perform rapid triage of malware samples and provide IOCs to analysts.

Navigating to https://hybrid-analysis.com presents us with the following screen:

Figure 4.1 – The HybridAnalysis home page

Here, we can drag and drop a malware sample to be analyzed by the engine. We'll drag our WastedLocker/Locky sample onto the window and begin:

Figure 4.2 – The submission page for HybridAnalysis

After submitting our sample, we'll see the name of our file and have the option to add a comment for the community, as well as a few other options, including one to not submit to any unaffiliated third party.

As with any online, public sandbox, the file will be available to the community as well as CrowdStrike, who owns the HybridAnalysis sandbox, and is shared for intelligence...