// tool reference · Incident & Response
AI Reverse Engineering Pro
Static, no-execution binary triage: capability, IOCs, next step.
What it does
Statically inspects a suspicious binary or blob: strings, imports, embedded URLs and IPs, packer indicators, and capability inference. The sample is never executed and never written to disk.
When to use it
- A sample arrived and you need a fast read before deciding whether to escalate to a sandbox.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| (file upload) | file | optional | Sample file, up to —. |
| pasted | textarea | optional | Or paste hex/base64. |
| use_ai | checkbox | optional | AI capability inference. |
| authorized | checkbox | required | You confirm you may analyse this sample. |
What you get back
Extracted indicators and inferred capability.
Worked example
Input
(upload: sample.bin -- 240 KB)
Output (abridged)
STRINGS (notable) http://198.51.100.9/gate.php SOFTWARE\Microsoft\Windows\CurrentVersion\Run vssadmin delete shadows /all /quiet IMPORTS CryptEncrypt, CryptGenKey -- crypto capability InternetOpenUrl -- network egress RegSetValueEx -- persistence PACKER Entropy 7.91/8.0 across .text -- packed or encrypted. Static strings are therefore PARTIAL; assume more capability than is visible. CAPABILITY (inferred) Ransomware. 'vssadmin delete shadows' destroys Volume Shadow Copies -- that string has essentially one purpose: preventing recovery. -> IOC: 198.51.100.9. Hunt for it across the estate NOW. -> Static only. Detonate in a real sandbox for behaviour.
How it works
STATIC ONLY. The upload is validated with is_uploaded_file(), read into MEMORY, string-extracted, and discarded. Nothing is written to disk and nothing is executed — this is the design decision that makes an upload feature safe on shared hosting. It is not a substitute for a sandbox.
Limits
Read live from the platform configuration.
| Free | — (Pro only) |
| Pro | — scans |
| Max file | — bytes |
| Strings extracted | — |
| Strings sent to AI | — |
Limitations — what it does not do
STATIC ONLY. The sample is never executed, so packed or encrypted payloads hide their real behaviour -- high entropy means you are seeing the wrapper, not the malware. This is a triage tool that tells you whether to escalate. It is not a sandbox and not a substitute for one.
Privacy
The sample is never persisted. Extracted strings may be sent to the AI provider when AI is enabled.
Standards
MITRE ATT&CK