Skip to content
Osint Daily
SponsoredOctoProbe house ad, 300 by 250 pixels, published 16 Oct 2026. Still frame of the square with the OctoProbe wordmark and the line One workspace for the investigation.
Osint Daily cover for Hybrid Analysis, under Threat intelligence, published 16 Oct 2026. The right side crops the listing capture. Free web malware sandbox. FAQ says some answers are outdated.

01 · Product name

Hybrid Analysis

Free web malware sandbox. FAQ says some answers are outdated.

Published by Hybrid Analysis.

FreeThreat intelligence

In short

Hybrid Analysis is the free web platform at hybrid-analysis.com for suspicious files and URLs. On 22 Oct 2026 the homepage said it is free for the security community, with a maximum upload of 250 MB and up to 1 file. The FAQ says the platform is free and warns that some FAQs are currently outdated. Basic and Vetted are access levels. No dollar and no SPDX field were printed. A public sample was marked MALICIOUS with threat score 100/100. Threat intelligence is the category. A verdict is a lead.

Website

Product pricing strategy

02

Free

The FAQ, opened 22 Oct 2026, says Hybrid Analysis is a free web-based platform, and it says to register for a free account to become a Basic user and then complete vetting for Vetted access. The homepage says free for the security community. No dollar price was printed on the homepage, the sample page, or the FAQ. No SPDX field was printed. Basic and Vetted are the FAQ's access levels. They are not prices. The 250 MB line is an upload limit. The threat score 100/100 is the sample page's score. If a later page sells a seat, quote that page. This review did not open one. The FAQ's own warning, that some FAQs are currently outdated, applies to any sentence taken from that page.

Utility and features

03

The homepage says Hybrid Analysis is free for the security community, that it detonates a file or a URL in a sandbox, and that the upload limit is 250 MB and up to 1 file. The recent-community list included sha256 ccb0358dae248b076332798961e9a0b1862393d41273eb1b3400a6d2a88dee0e marked Malicious. Unfinished counter widgets on that page, including split figures that did not form a sentence, are not quoted. An article card is dated August 31, 2026, titled Hybrid Analysis, Reengineered, and it mentions Fal.Con 2026.

  • Upload limit 250 MB. The homepage says the maximum upload is 250 MB and up to 1 file, and that the service is free for the security community.
  • Sample score 100/100. The public sample page marked that sha256 MALICIOUS, AV 19/25, 468.1KiB (479322 bytes).
  • FAQ warns it is outdated. The FAQ says some FAQs are currently outdated. Basic and Vetted are access levels. No dollar was printed.

The sample page for that sha256 says MALICIOUS, family Win/malicious_confidence_100%, peexe, 468.1KiB (479322 bytes), threat score 100/100, AV detections 19/25 with 19 Mal, 0 Sus, 6 Clean, and 0 None, and 6 indicators with 2 Mal, 1 Sus, and 3 Info. SHA-1 is c2f296e8ed90c996c58e76876963b72349679fb1. The FAQ says Hybrid Analysis is a free web-based platform. It also says some FAQs are currently outdated and are being updated. The access paragraph names Free, Basic, and Vetted. Basic can see its own submissions and submit bulk files. Vetted gets full search and sample download after vetting. No dollar was printed. No SPDX field was printed.

  1. 1

    Quote the FAQ's outdated warning when you use an FAQ sentence.

  2. 2

    Cite the sample by its sha256 and the score the page printed. Do not add an exploit step.

  3. 3

    Call Basic and Vetted access levels. Do not assign them a price the page did not print.

Caveats

04

The FAQ says some of its articles are currently outdated. A step you quote from it needs that warning beside it. Free, Basic, and Vetted are access levels on that page. Do not invent a dollar for Vetted because another sandbox sells a seat.

The sample verdict is the page's label for sha256 ccb0358dae248b076332798961e9a0b1862393d41273eb1b3400a6d2a88dee0e. It is not a procedure for running the file, and it is not an attribution. The homepage's unfinished counters were not sentences and are omitted. The reengineered article is dated August 31, 2026. That date is the card's date. The maintainer line on the pages opened is Hybrid Analysis. This listing does not add a parent company the pages did not name. Uploading a file you are not allowed to share is a separate decision from reading a public report.

Screenshots

05

Hybrid Analysis recent submissions. Homepage at https://www.hybrid-analysis.com/ on 22 Oct 2026. The page says free for the security community, maximum upload 250 MB, up to 1 file, and lists a recent submission marked Malicious. Captured 2026-10-22. Source
Hybrid Analysis public sample verdict. Sample page at https://www.hybrid-analysis.com/sample/ccb0358dae248b076332798961e9a0b1862393d41273eb1b3400a6d2a88dee0e on 22 Oct 2026. The page says MALICIOUS, threat score 100/100, AV 19/25, and 468.1KiB (479322 bytes). Captured 2026-10-22. Source

Potential use cases

06

  • An FAQ step is about to be quoted without the warning. On 22 Oct 2026 the FAQ said some of its articles are currently outdated and are being updated. The same page says Hybrid Analysis is a free web-based platform. Basic users see their own submissions and can submit bulk files. Vetted users get full search and sample download after vetting. No dollar was printed.
  • The public sample is about to grow an exploit step. The page for sha256 ccb0358dae248b076332798961e9a0b1862393d41273eb1b3400a6d2a88dee0e said MALICIOUS, family Win/malicious_confidence_100%, 468.1KiB (479322 bytes), threat score 100/100, and AV detections 19/25. That is the page's verdict. It is not a procedure for running the file.
  • The homepage limit is about to be dropped. The page says free for the security community, maximum upload 250 MB, and up to 1 file. Unfinished counter widgets on that page were not sentences and are not quoted. The reengineered article card is dated August 31, 2026. No SPDX field was printed.

Hard cases

The case where the first result is easy to over-read.

Vetted is given a seat price

The FAQ names Free, Basic, and Vetted as access levels and prints no dollar. A price copied from another sandbox's plan table is not a Hybrid Analysis price. Say the level, and say no dollar was printed on the pages opened 22 Oct 2026.

Practitioners using it

Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.

Questions

Is Hybrid Analysis free?

The homepage and the FAQ say the web platform is free. Basic and Vetted are access levels. No dollar price and no SPDX field were printed on 22 Oct 2026. The FAQ says some of its answers are currently outdated.

What did the public sample page report?

sha256 ccb0358dae248b076332798961e9a0b1862393d41273eb1b3400a6d2a88dee0e was marked MALICIOUS, threat score 100/100, AV 19/25, 468.1KiB (479322 bytes). That is the page's verdict.

Citations

07

Titled sources. These public pages are what the quotes on this listing come from.

When this listing changes, the letter says so.

Developments in OSINT. Confirm from your inbox before the first issue.

Only for this letter. Privacy

Related tools

Freemium

ANY.RUN

Interactive malware sandbox with a free account.

Threat intelligenceGUI
View listing
Freemium

VirusTotal

Multi-engine lookups for files, URLs, domains, and IP addresses.

Threat intelligenceGUI
View listing