Accelerate Malware Analysis with IDA Pro

Accelerate malware
analysis in the tool you
already use.

The Malware Analysis add-on brings modern reverse-engineering workflows into IDA Pro: automatic unpacking, safe emulation and sandbox context. Built and maintained by Hex-Rays, shaped by the analysts who use it.

Built for teams under a flood of samples

SOC monitoring

Triage a high volume of alerts and surface the samples that need a human.

Incident response

Recover the inner payload fast and connect it to the wider investigation.

Threat intelligence

Study code and data structures to drive signatures and attribution.

AV & product teams

A dependable engine for developing countermeasures and shipping detection.

What’s inside the add-on

Automatic unpacker

Packed binaries are detected the moment you load them. One click unpacks in-place: the packed data is overwritten and analyzable code is presented immediately, with a manual override for the edge cases.

Read the docs

Isolated system emulation

Debug through emulation in a single click: step through a confusing sequence safely, without setting up a VM or risking execution on the wrong machine. Anything you rename along the way imports straight back into the IDB.

Read the docs

Sandbox integration

Executed instructions are highlighted directly in IDA's disassembly, so you see exactly what ran. Browse the API calls and their arguments, then jump straight to the relevant code region.

Read the docs

Built-in CyberChef

The Cyber Swiss Army Knife, inside IDA. Run the same decode, deobfuscate and transform recipes you already use, without leaving your analysis or shuttling data to another window.

Read the docs

Coming soon

Malware triage

Get the shape of an unknown sample fast. On load, IDA surfaces what it is, how it's packed, and which capabilities and indicators it carries, so you can sort the noise from the samples worth a deeper look before you sink an afternoon into any one of them.

Read the docs

Coming soon

Deobfuscation

Malware buries its logic under junk code, encrypted strings, and flattened control flow. Deobfuscation clears that layer in place: strings resolve, dead branches drop, and the pseudocode reads close to the original, so you analyze the real behavior instead of the disguise.

Read the docs

Ground truth an agent can't fake

Those same teams are starting to put agents on the front line of triage, and an agent is only as sharp as the bytes it reads. Packed, obfuscated samples feed it noise. The add-on does the deterministic work first: unpack, emulate, and map what actually ran. Drive IDA from a script, idalib, or IDA MCP, and your agent reasons over real code and real behavior instead of a confident guess.

It lives in the IDA you already know

No separate tool to learn. The Malware Analysis add-on plugs into IDA's own UI and API: a Malware menu, the familiar debugger controls for emulation, and results that render right in the disassembly and pseudocode. Rename something mid-emulation and it persists back to your database.

Detect and unpack on load

Emulate a selection, safely

Map a sandbox run onto the code

Three ways it speeds you up

Find the code that matters

Strip packers and boilerplate so you land on the inner payload in minutes, not hours.

Understand what it does

Safely emulate confusing sequences and read sandbox behaviour mapped straight onto the disassembly.

Scale across the team

A shared baseline for unpacking and triage that everyone runs, extensible to your team’s own knowledge.

Accelerate malware
analysis in the tool you
already use.

Built for teams under a flood of samples

SOC monitoring

Incident response

Threat intelligence

AV & product teams

What’s inside the add-on

Automatic unpacker

Isolated system emulation

Sandbox integration

Built-in CyberChef

Malware triage

Deobfuscation

Ground truth an agent can't fake

Real code to reason over

Answers, not guesses

Decode in place

It lives in the IDA you already know

Three ways it speeds you up

Find the code that matters

Understand what it does

Scale across the team

Malware analysts live in IDA. Now IDA works the way they do.

Ready to speed up your malware analysis?

Products

Case studies

Resources

Programs

Pricing

Company