// tool reference · Incident & Response

Binary Analysis Assistant Pro

実行を伴わない静的なバイナリトリアージ：機能、IOC、次の対応。

What it does

Statically inspects a suspicious binary or blob: strings, imports, embedded URLs and IPs, packer indicators, and capability inference. The sample is never executed and never written to disk.

When to use it

A sample arrived and you need a fast read before deciding whether to escalate to a sandbox.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
(file upload)	file	任意	Sample file, up to —.
pasted	textarea	任意	Or paste hex/base64.
use_ai	checkbox	任意	AI capability inference.
authorized	checkbox	required	You confirm you may analyse this sample.

What you get back

Extracted indicators and inferred capability.

活用例

Input

(upload: sample.bin -- 240 KB)

Output (abridged)

STRINGS (notable)
  http://198.51.100.9/gate.php
  SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  vssadmin delete shadows /all /quiet

IMPORTS
  CryptEncrypt, CryptGenKey   -- crypto capability
  InternetOpenUrl             -- network egress
  RegSetValueEx               -- persistence

PACKER
  Entropy 7.91/8.0 across .text -- packed or encrypted. Static strings
  are therefore PARTIAL; assume more capability than is visible.

CAPABILITY (inferred)
  Ransomware. 'vssadmin delete shadows' destroys Volume Shadow Copies --
  that string has essentially one purpose: preventing recovery.

  -> IOC: 198.51.100.9. Hunt for it across the estate NOW.
  -> Static only. Detonate in a real sandbox for behaviour.

How it works

STATIC ONLY. The upload is validated with is_uploaded_file(), read into MEMORY, string-extracted, and discarded. Nothing is written to disk and nothing is executed — this is the design decision that makes an upload feature safe on shared hosting. It is not a substitute for a sandbox.

Limits

Read live from the platform configuration.

Free	— (Pro only)
Pro	— scans
Max file	— bytes
Strings extracted	—
Strings sent to AI	—

Limitations — what it does なし do

STATIC ONLY. The sample is never executed, so packed or encrypted payloads hide their real behaviour -- high entropy means you are seeing the wrapper, not the malware. This is a triage tool that tells you whether to escalate. It is not a sandbox and not a substitute for one.

プライバシー

The sample is never persisted. Extracted strings may be sent to the AI provider when AI is enabled.

Standards

MITRE ATT&CK