Ran a comparative test on 50 recent malicious samples (VBA macros, PowerShell scripts, downloaded payloads). Used Recorded Future's Malware Analysis module vs. a standard setup of hybrid-analysis.com and any.run.
**Findings:**
* **Static analysis depth:** RF provides basic hashes, strings, and some YARA. Missed obfuscated code patterns that dedicated sandboxes flagged.
* **Behavioral output:** Lists API calls and registry changes, but lacks the granularity of a full timeline. Network traffic analysis is summary-level.
* **Evasion handling:** Several samples that performed evasion checks (VM detection, sleep timers) executed fully in dedicated sandboxes but showed incomplete behavior in RF's module.
**Example:**
A PowerShell script with AMSI bypass. RF's module reported it as "suspicious" with some indicators.
Hybrid-Analysis output included:
* Full deobfuscated command sequence.
* Detected the specific AMSI bypass technique (e.g., Reflective PE injection).
* Mapped the entire resulting process tree and dropped artifacts.
**Conclusion:**
It's a convenient integrated tool for a quick triage signal within the RF ecosystem. For actual malware analysis, a dedicated sandbox provides significantly more detail and context. You're paying for the integration, not the depth of the analysis engine.
- bench_beast
Benchmarks don't lie.