Malware Analysis Resources

quyendoattt

This is meant to be a complimentary post to the URL Scanner roundup post back in January.
Let me be the first to say I am not a malware reverse-engineering analyst.
On the other hand, when I am responding to an incident involving a system compromise, and/or am trying to both clean the system as well as understand the potential impact of what happened, being able to analyze a suspect file is critical.
It can not only give me a better understanding of how to clean it, but possibly how it got there in the first place. This lessoned-learned may help strengthen our security perimeter.
So having a collection of resources that can help analyze a malware (or potential malware) file is important to me.
The following resources are a collection of on-line file scanners, analysis-report-generating, and local sandbox creating tools to aid in that process.
There are a number of similar “list-of-lists” like this one. I’ve just tried to collect them for my own personal reference.  Major hat-tip and credit goes to the following sources which have already paved the way before me. You may find some more more resources here that I haven’t linked to as well as additional descriptions and feedback.

• Malware Sandbox Services and Software – Andre’ M. DiMino – SemperSecurus blog
• Information Security Blog » Online Malware Analysis Scanners – Coresec.org
• Mantra’s (Anti)-Malware Link Gallery – OWASP Mantra
• Malware Analysis – SecurityXploit
• Malware online scanners | Security on steroids – CleanBytes.net
• When You Only Have 10 Minutes… – Sketchymoose’s Blog

And as Sketchymoose points out in the close of that post, before you start uploading files to any of these resources:

So now, keep in mind– your submitted file is now out on the internet and is now on some database. Some of these may be owned by AV companies which look for new juicy malware to add to their signatures. So, if you are really worried about that:
(A) read documentation on their website to see what happens with collected data
(B) do your own analysis
(C) Ask customer/boss what their position is about submitting files to these sites — make sure you know the answer for choice ‘A’ too for this one
Remember collaboration is one of the biggest deciding factors in incident response, but use common sense and discretion.

On-Line Scanners and Virus/Malware Analysis Tools

• GFI Public Sandbox – Formerly known as CWSandbox
• :: mwanalysis :: CWSandbox :: – Separate CWSSandbox service maintained by Chair for Pratical Informatics 1 at the University of Mannheim
• SandBox Information Center – Norman
• VirusTotal – Free Online Virus, Malware and URL Scanner
• Jotti’s malware scan
• Metascan Online – Free online file scanning with multiple antivirus engines
• ASafaWeb – Automated Security Analyser for ASP.NET Websites
• Virus Lab – F-Prot Antivirus Virus Information
• Anubis: Analyzing Unknown Binaries – Really neat and detailed reports.
• Metascan Online – Free online file scanning with multiple antivirus engines
• ThreatExpert – Online File Scanner or try their ThreatExpert – Submission Applet
• ThreatExpert – Submit Your Sample Online – same folks, different submission interface.
• Submit a sample – Microsoft Malware Protection Center
• Eureka Malware Analysis Page – Automated malware binary analysis service
• Comodo Instant Malware Analysis
• File Verdict Service – Automated analysis system also from Comodo.
• Wepawet – focusing on JavaScript, PDF, and Flash files in particular
• F-Secure – Sample Analysis System
• Xandora – Your Online Binary Analyser – Analysis of malware PE files
• VirusChief – Online Virus Scan – scans file using a number of scan engines.
• VirSCAN.org – Free Multi-Engine Online Virus Scanner – supported by 36 AntiVirus Engines
• NoVirusThanks.org – Multi-Engine Antivirus Scanner – Service
• avast! Online Scanner
• malwr.com – free malware analysis service built on Cuckoo Sandbox
• Online Malware Tool for Malware Analysis
• Autovin » Malware Submission – Panda Security’s Automated Tool for Virus Incidents
• Ether: Malware Analysis via Hardware Virtualization Extensions – testing/beta mode still.
• SuspectFile – upload analysis service.
• SARVAM: Search and Retrieval of Malware – Added 4-16-12 per tip from Laks

PDF File Analysis Tools

• pdf examiner – Malware Tracker – upload and scan PDF files for a slew of exploits.
• PDF X-RAY – upload and scan a suspicious PDF file to detect malicious behavior.
• PDF Stream Dumper – SuperAwesome locally-installed (freeware) tool for analysis of malicious PDF documents. Really amazing and a must-have in any incident-responder and analyst’s toolkit.
• PDF Tools « Didier Stevens – Didier has a great collection of local tools to keep handy when parsing out PDF files.
• 6 Free Local Tools for Analyzing Malicious PDF Files – great list of PDF tools from Lenny Zeltser
• Analyzing Suspicious PDF Files With Peepdf -How To post from Lenny Zeltser on using peepdf tool
• peepdf – PDF Analysis Tool – eternal-todo.com – free Python tool from Jose Miguel Esparza to pick apart PDF files.
• jsunpack – a generic JavaScript unpacker – online tool to unpack JavaScript from PDF, pcap, HTML or JavaScript files. For more information about this resource check out jsunpack-n – A generic JavaScript unpacker – Google Project Hosting page.
• malware tracker blog – Blog home page for Malware Tracker team which contains great analysis write ups and reports. Cool.

Not a PDF but Malware Tracker’s +Cryptam service can scan “Office” documents for malicious content as well.
Sandbox Tools for Malware Analysis

• Minibis – CERT.at – “Software and tips to easily build up an automated malware analysis station based on a concept introduced in the paper “Mass Malware Analysis: A Do-It-Yourself Kit”. “ from Christian Wojner.
• Zero Wine: Malware Behavior Analysis – QEMU virtual machine image with Debian OS installed, loaded with tools to upload and analyze malware and generate reports.
• Buster Sandbox Analyzer – project based on Sandboxie
• Cuckoo Sandbox – a malware analysis system addressing Windows PE files, DLL files, PDF documents, Office documents, PHP scripts, Python scripts, Internet URL’s, etc.
• Cuckoo for Cuckoo Box – SpiderLabs Anterior post on getting to run on Mac OS X.
• Analyzing Malware with Cuckoo Sandbox V3.0 – securitybananas.com post on using it.
• Cuckoo Sandbox 101– Infosanity’s Blog’s Andrew Waite addresses some gotchas he encountered.
• Capture-BAT Page – The Honeynet Project – behavioral analysis tool of apps for the Win32 systems providing insights into the software operation (impact) of malware rather than picking the malware executable itself apart; change-analysis rather than binary analysis.
• Malware analysis tool, Capture-Bat – Great tutorial written by Travis Altman on installing and analyzing results of Capture-Bat.
• Sometimes Trouble Finds You…. – interesting recent post from Sketchymoose at his blog on using Capture-Bat on a URL direction malware vector.

Adobe Shockwave/Flash Analysis Tools

• Introducing Adobe SWF Investigator – Adobe Labs tool to totally pick apart SWF files. Uses Adobe AIR platform.
• Adobe SWF Investigator | Flash security – Adobe Labs – download link
• HP Communities – SWFScan – FREE Flash decompiler – Enterprise Business Community – Decompiles Adobe Flash files and does some basic security scanning.
• Decompile Flash files with HP SwfScan – program review by Mike Williams at BetaNews

Mandiant – When One Word will do…

• MANDIANT – Red Curtain – From their product description: “MRC examines executable files (e.g., .exe, .dll, and so on) to determine how suspicious they are based on a set of criteria. It examines multiple aspects of an executable, looking at things such as the entropy (in other words, randomness), indications of packing, compiler and packing signatures, the presence of digital signatures, and other characteristics to generate a threat “score.” This score can be used to identify whether a set of files is worthy of further investigation.”
• MANDIANT Find Evil – tool that uses disassembly to detect packed executables.
• Be sure to check out all Mandiant’s Free Software offerings as many other tools here may aid in a malware response investigation.

Lessons Learned and Wisdom Shared by the Malware Analysis Pros
Thanks to the hard work and community-spirit of malware analysts, we can “sharpen-our-saw” against their efforts. These are some of the best places to start.

• Malware Analysis Blog | quis custodiet ipsos custodes – This blog is just getting started but the posts so far have been very insightful. The post Malware Analysis as a function of intelligence and counterintelligence operations is a quite well thought out review of the issues a malware analyst must be familiar with.
• Hexacorn | Blog has a lot of great detailed posts and a few challenges as well to test your brain-cells. Check out this Malware Analysis post-tag list as well as this Extracting Strings from PE sections post for some great material. On my RSS feed list.
• Analyzing Malicious Documents Cheat Sheet by Lenny Zeltser – Lenny Zeltser shares an amazing collection of tools, resources, and techniques in a “cheat-sheet” format. Check the sidebar for PDF/DOCX versions of this page. The bottom of the page is heavy with PDF tool linkage as well as white-papers and security presentations.
• Introduction to Malware Analysis – (PDF Link) – This presentation by Lenny Zeltser outlines a lot of the important foundations the investigator should be aware of. One of many goodPresentations, Webcasts, and Speaking Engagements by Lenny Zeltser on that page.
• Also related, Lenny Zeltser’s posts: Reverse-Engineering Malware Cheat Sheet and REMnux Usage Tips for Malware Analysis on Linux. Mr Zeltser offers a SANS Institute trainings as well so if you think you are ready to take things to the next professional level, SANS Institute classes would be a fantastic place to start. See this Reverse-Engineering Malware: Malware Analysis Tools and Techniques Course – Malware Analysis Training by Lenny Zeltser link for more info.
• System Forensics – New to Me blog well written by Patrick Olsen. Love the Blogger theme! Great and detailed analysis posts. On my RSS feed list. For some sample posts check out: Zeus v2 Malware Analysis – Part I and Zeus v2 Malware Analysis – Part II .
• Advanced Malware Cleaning – on line video (~13 min) presented by Sysinternal’s Mark Russinovich showing tools and techniques to manually clean a system of malware. Still good after all these years.
• Zero Day Malware Cleaning with the Sysinternals Tools – (PDF link) – “Slides from Mark’s highly-rated Blackhat US 2011 presentation on how to use the Sysinternals tools to hunt down and eliminate malware.” Excellent slide set IMHO.
• Windows Incident Response: Malware Analysis – Harlan Carvey shares some thoughts and perspectives on the malware response and analysis field from a digital forensics perspective.
• Is Anti-Virus Really Dead? A Real-World Simulation Created for Forensic Data Yields Surprising Results – SANS Computer Forensics and Incident Response blog post by robtlee that shows the value of malware incident response and protection in an enterprise environment.
• WEBCAST: Manually Removing Viruses & Malware – Kurt Shintaku’s Blog – Mike Halsey, Microsoft MVP presentation on pulling malware off a Windows system. Registration is required and accessible until July 5th, 2012.

I sincerely hope you find several good take-aways from this post. It’s been simmering a while and I think it will greatly aid me in my own efforts and responses.
Cheers.
–Claus V.
This is meant to be a complimentary post to the URL Scanner roundup post back in January.
Let me be the first to say I am not a malware reverse-engineering analyst.
On the other hand, when I am responding to an incident involving a system compromise, and/or am trying to both clean the system as well as understand the potential impact of what happened, being able to analyze a suspect file is critical.
It can not only give me a better understanding of how to clean it, but possibly how it got there in the first place. This lessoned-learned may help strengthen our security perimeter.
So having a collection of resources that can help analyze a malware (or potential malware) file is important to me.
The following resources are a collection of on-line file scanners, analysis-report-generating, and local sandbox creating tools to aid in that process.
There are a number of similar “list-of-lists” like this one. I’ve just tried to collect them for my own personal reference.  Major hat-tip and credit goes to the following sources which have already paved the way before me. You may find some more more resources here that I haven’t linked to as well as additional descriptions and feedback.

• Malware Sandbox Services and Software – Andre’ M. DiMino – SemperSecurus blog
• Information Security Blog » Online Malware Analysis Scanners – Coresec.org
• Mantra’s (Anti)-Malware Link Gallery – OWASP Mantra
• Malware Analysis – SecurityXploit
• Malware online scanners | Security on steroids – CleanBytes.net
• When You Only Have 10 Minutes… – Sketchymoose’s Blog

And as Sketchymoose points out in the close of that post, before you start uploading files to any of these resources:

So now, keep in mind– your submitted file is now out on the internet and is now on some database. Some of these may be owned by AV companies which look for new juicy malware to add to their signatures. So, if you are really worried about that:
(A) read documentation on their website to see what happens with collected data
(B) do your own analysis
(C) Ask customer/boss what their position is about submitting files to these sites — make sure you know the answer for choice ‘A’ too for this one
Remember collaboration is one of the biggest deciding factors in incident response, but use common sense and discretion.

On-Line Scanners and Virus/Malware Analysis Tools

• GFI Public Sandbox – Formerly known as CWSandbox
• :: mwanalysis :: CWSandbox :: – Separate CWSSandbox service maintained by Chair for Pratical Informatics 1 at the University of Mannheim
• SandBox Information Center – Norman
• VirusTotal – Free Online Virus, Malware and URL Scanner
• Jotti’s malware scan
• Metascan Online – Free online file scanning with multiple antivirus engines
• ASafaWeb – Automated Security Analyser for ASP.NET Websites
• Virus Lab – F-Prot Antivirus Virus Information
• Anubis: Analyzing Unknown Binaries – Really neat and detailed reports.
• Metascan Online – Free online file scanning with multiple antivirus engines
• ThreatExpert – Online File Scanner or try their ThreatExpert – Submission Applet
• ThreatExpert – Submit Your Sample Online – same folks, different submission interface.
• Submit a sample – Microsoft Malware Protection Center
• Eureka Malware Analysis Page – Automated malware binary analysis service
• Comodo Instant Malware Analysis
• File Verdict Service – Automated analysis system also from Comodo.
• Wepawet – focusing on JavaScript, PDF, and Flash files in particular
• F-Secure – Sample Analysis System
• Xandora – Your Online Binary Analyser – Analysis of malware PE files
• VirusChief – Online Virus Scan – scans file using a number of scan engines.
• VirSCAN.org – Free Multi-Engine Online Virus Scanner – supported by 36 AntiVirus Engines
• NoVirusThanks.org – Multi-Engine Antivirus Scanner – Service
• avast! Online Scanner
• malwr.com – free malware analysis service built on Cuckoo Sandbox
• Online Malware Tool for Malware Analysis
• Autovin » Malware Submission – Panda Security’s Automated Tool for Virus Incidents
• Ether: Malware Analysis via Hardware Virtualization Extensions – testing/beta mode still.
• SuspectFile – upload analysis service.
• SARVAM: Search and Retrieval of Malware – Added 4-16-12 per tip from Laks

PDF File Analysis Tools

• pdf examiner – Malware Tracker – upload and scan PDF files for a slew of exploits.
• PDF X-RAY – upload and scan a suspicious PDF file to detect malicious behavior.
• PDF Stream Dumper – SuperAwesome locally-installed (freeware) tool for analysis of malicious PDF documents. Really amazing and a must-have in any incident-responder and analyst’s toolkit.
• PDF Tools « Didier Stevens – Didier has a great collection of local tools to keep handy when parsing out PDF files.
• 6 Free Local Tools for Analyzing Malicious PDF Files – great list of PDF tools from Lenny Zeltser
• Analyzing Suspicious PDF Files With Peepdf -How To post from Lenny Zeltser on using peepdf tool
• peepdf – PDF Analysis Tool – eternal-todo.com – free Python tool from Jose Miguel Esparza to pick apart PDF files.
• jsunpack – a generic JavaScript unpacker – online tool to unpack JavaScript from PDF, pcap, HTML or JavaScript files. For more information about this resource check out jsunpack-n – A generic JavaScript unpacker – Google Project Hosting page.
• malware tracker blog – Blog home page for Malware Tracker team which contains great analysis write ups and reports. Cool.

Not a PDF but Malware Tracker’s +Cryptam service can scan “Office” documents for malicious content as well.
Sandbox Tools for Malware Analysis

• Minibis – CERT.at – “Software and tips to easily build up an automated malware analysis station based on a concept introduced in the paper “Mass Malware Analysis: A Do-It-Yourself Kit”. “ from Christian Wojner.
• Zero Wine: Malware Behavior Analysis – QEMU virtual machine image with Debian OS installed, loaded with tools to upload and analyze malware and generate reports.
• Buster Sandbox Analyzer – project based on Sandboxie
• Cuckoo Sandbox – a malware analysis system addressing Windows PE files, DLL files, PDF documents, Office documents, PHP scripts, Python scripts, Internet URL’s, etc.
• Cuckoo for Cuckoo Box – SpiderLabs Anterior post on getting to run on Mac OS X.
• Analyzing Malware with Cuckoo Sandbox V3.0 – securitybananas.com post on using it.
• Cuckoo Sandbox 101– Infosanity’s Blog’s Andrew Waite addresses some gotchas he encountered.
• Capture-BAT Page – The Honeynet Project – behavioral analysis tool of apps for the Win32 systems providing insights into the software operation (impact) of malware rather than picking the malware executable itself apart; change-analysis rather than binary analysis.
• Malware analysis tool, Capture-Bat – Great tutorial written by Travis Altman on installing and analyzing results of Capture-Bat.
• Sometimes Trouble Finds You…. – interesting recent post from Sketchymoose at his blog on using Capture-Bat on a URL direction malware vector.

Adobe Shockwave/Flash Analysis Tools

• Introducing Adobe SWF Investigator – Adobe Labs tool to totally pick apart SWF files. Uses Adobe AIR platform.
• Adobe SWF Investigator | Flash security – Adobe Labs – download link
• HP Communities – SWFScan – FREE Flash decompiler – Enterprise Business Community – Decompiles Adobe Flash files and does some basic security scanning.
• Decompile Flash files with HP SwfScan – program review by Mike Williams at BetaNews

Mandiant – When One Word will do…

• MANDIANT – Red Curtain – From their product description: “MRC examines executable files (e.g., .exe, .dll, and so on) to determine how suspicious they are based on a set of criteria. It examines multiple aspects of an executable, looking at things such as the entropy (in other words, randomness), indications of packing, compiler and packing signatures, the presence of digital signatures, and other characteristics to generate a threat “score.” This score can be used to identify whether a set of files is worthy of further investigation.”
• MANDIANT Find Evil – tool that uses disassembly to detect packed executables.
• Be sure to check out all Mandiant’s Free Software offerings as many other tools here may aid in a malware response investigation.

Lessons Learned and Wisdom Shared by the Malware Analysis Pros
Thanks to the hard work and community-spirit of malware analysts, we can “sharpen-our-saw” against their efforts. These are some of the best places to start.

• Malware Analysis Blog | quis custodiet ipsos custodes – This blog is just getting started but the posts so far have been very insightful. The post Malware Analysis as a function of intelligence and counterintelligence operations is a quite well thought out review of the issues a malware analyst must be familiar with.
• Hexacorn | Blog has a lot of great detailed posts and a few challenges as well to test your brain-cells. Check out this Malware Analysis post-tag list as well as this Extracting Strings from PE sections post for some great material. On my RSS feed list.
• Analyzing Malicious Documents Cheat Sheet by Lenny Zeltser – Lenny Zeltser shares an amazing collection of tools, resources, and techniques in a “cheat-sheet” format. Check the sidebar for PDF/DOCX versions of this page. The bottom of the page is heavy with PDF tool linkage as well as white-papers and security presentations.
• Introduction to Malware Analysis – (PDF Link) – This presentation by Lenny Zeltser outlines a lot of the important foundations the investigator should be aware of. One of many goodPresentations, Webcasts, and Speaking Engagements by Lenny Zeltser on that page.
• Also related, Lenny Zeltser’s posts: Reverse-Engineering Malware Cheat Sheet and REMnux Usage Tips for Malware Analysis on Linux. Mr Zeltser offers a SANS Institute trainings as well so if you think you are ready to take things to the next professional level, SANS Institute classes would be a fantastic place to start. See this Reverse-Engineering Malware: Malware Analysis Tools and Techniques Course – Malware Analysis Training by Lenny Zeltser link for more info.
• System Forensics – New to Me blog well written by Patrick Olsen. Love the Blogger theme! Great and detailed analysis posts. On my RSS feed list. For some sample posts check out: Zeus v2 Malware Analysis – Part I and Zeus v2 Malware Analysis – Part II .
• Advanced Malware Cleaning – on line video (~13 min) presented by Sysinternal’s Mark Russinovich showing tools and techniques to manually clean a system of malware. Still good after all these years.
• Zero Day Malware Cleaning with the Sysinternals Tools – (PDF link) – “Slides from Mark’s highly-rated Blackhat US 2011 presentation on how to use the Sysinternals tools to hunt down and eliminate malware.” Excellent slide set IMHO.
• Windows Incident Response: Malware Analysis – Harlan Carvey shares some thoughts and perspectives on the malware response and analysis field from a digital forensics perspective.
• Is Anti-Virus Really Dead? A Real-World Simulation Created for Forensic Data Yields Surprising Results – SANS Computer Forensics and Incident Response blog post by robtlee that shows the value of malware incident response and protection in an enterprise environment.
• WEBCAST: Manually Removing Viruses & Malware – Kurt Shintaku’s Blog – Mike Halsey, Microsoft MVP presentation on pulling malware off a Windows system. Registration is required and accessible until July 5th, 2012.

from : ananlysismalware.wordpress.com/2014/04/09/malware-analysis-resources/

Online scanners for Malware

Here is a list with online malware analysis services, updated as needed. Every time you feel a file is suspicious or you receive a file from an untrusted source, it’s recommended to scan it with one of these online services before to open it. Please bear in mind that even a friend’s computer can be considered an untrusted source, since it can be malware infected and files sharing is a good chance for malware to spread.

The main advantage of these online scanners is that the submitted files will be scanned with many antivirus engines, reducing the chances for a virus to be unrecognized and therefore labeled as inoffensive — sometimes this is called multi-engine scanning. If an antivirus fail to detect an infected file, there are others that may recognize the infected code inside the file.

Here are also online services which provide detailed informations about the actions taken of a malware on the infected operating systems and services able to scan a given URL for possible threats.

Here you go :

VirusTotal http://www.virustotal.com/

Maximum file size: 32MB

Can be submitted suspicious files or URLs.

Jotti’s malware scan http://virusscan.jotti.org/en

Maximum file size: 20MB

Anubis http://anubis.iseclab.org/

Maximum file size: 8MB

This service provide a detailed report about the actions that an executable does on an operating system. In the case an URL is submitted, the report is about Internet Explorer process details when is visiting the submitted URL.

ThreatExpert http://www.threatexpert.com/filescan.aspx

Maximum file size: 5MB

Files scanner

VirSCAN http://virscan.org/

Maximum file size: 20MB

This scanning service supports Rar/Zip compressed files.

Joe Sandbox http://www.joesecurity.org/

Advanced analysis system providing detailed reports about submitted executables, PDF or DOC(Microsoft Word) files.

Sunbelt’s CWSandbox http://www.sunbeltsecurity.com/sandbox/

Maximum file size: 12288 KB

The results of the file analysis are sent to provided email adress.

Microsoft Security Portalhttps://www.microsoft.com/security/portal/Submission/Submit.aspx

Maximum file size: 10MB

The files can be submitted RAR or ZIP compressed.

Eureka Malware Analysis http://eureka.cyber-ta.org/

It’s an automated malware binary analysis service. For each uploaded binary, the Eureka service will attempt to unpack and disassemble the binary, and will produce an annotated callgraph, subroutine/data index page, strings summary, and list of embedded DNS entries.

Comodo Instant Malware Analysis http://camas.comodo.com/cgi-bin/submit

Very simple to use file scanner

Wepawet http://wepawet.iseclab.org/index.php

It’s a service for analyzing web-based malware therefore the file formats supported are Flash, JavaScript, and PDF files. Can be submitted both files or URLs.

F-SECURE SAMPLE ANALYSIS SYSTEM https://analysis.f-secure.com/portal/login.html

Can be submitted files or URLs for analysis. In order to obtain the scanning results, the registration is required.

FilterBit http://filterbit.com/index.cgi

Maximum file size: 20MB

Xandora http://www.xandora.net/upload/

Online binary analyzer, can be submitted either MD5 hash of a file, an IP or a Domain for analysis. Can be used Drag & Drop for files upload max size: 10MB and after analysis(15 to 30 minutes) the file MD5 hash will be used to search and see the report.

VirusChief http://viruschief.com/

novirusthanks Multi-Engine Antivirus Scanner http://vscan.novirusthanks.org/

Maximum file size: 20MB

Can be scanned a suspicious file or a Web adress .

Votiro https://cloud.votiro.com/

Votiro – Cloud Sanitization Service analyzes suspicious files and facilitates the quick neutralization of trojans, viruses, worms and zero-day attacks.

Maximum file size: 64MB (Supported File Types:pdf,jpg,jpeg,png,bmp,tif,tiff,gif,wmf,emf)

avast! Online scanner http://onlinescan.avast.com/

Maximum file size: 16MB

Kaspersky file online scanner http://www.kaspersky.com/virusscanner

Maximum file size: 1MB

Anti-virus scan service IrishCreamService   http://icreamservice.com/

Maximum file size: 20MB

It test files, URLs, domaims or IPs with 14 antivirus engines.

Joe DD – Joe Document Dissector   http://joedd.joesecurity.org/

Joe DD  is an automated malware analysis platform for detecting malicious documents. Very good to analyze suspicious email attachments.

*

System scanning services working via your browser(Active X plugin based). The majority of these services are provided by security vendors

Trojan Scanner http://www.windowsecurity.com/trojanscan/

TrojanScan is licensed from Emsi Software GmbH . Old now.

Internet vulnerability scanner- Firewall test https://www.grc.com/x/ne.dll?bh0bkyd2

Bitdefender—60-Second QuickScan http://quickscan.bitdefender.com/

It works with Internet Explorer, Mozilla Firefox and Chrome browser, using a plugin. The system scan is performed very quickly, in under 60 seconds.

BitDefender Online Scanner http://www.bitdefender.com/scanner/online/free.html

Accessible from your browser, it will scan and automatically clean the system memory, in addition to all files and drives’ boot sectors.

Emsisoft Web Malware Scan http://www.emsisoft.com/en/software/ax/

ESET Online Scanner http://www.eset.com/home/products/online-scanner

F-Secure Online Scanner http://www.f-secure.com/en_EMEA-Labs/security-threats/tools/online-scanner/

HouseCall – Free Online Virus Scan http://housecall.trendmicro.com/us/

Support for 64-bit, Windows 7, and Windows 7 SP1

Panda ActiveScan 2.0  http://www.pandasecurity.com/homeusers/solutions/activescan/

ActiveScan 2.0 is an advanced online scanner based on Collective Intelligence (scanning in-the-cloud)

Rising Online Malware Scannerhttp://online.rising.com.cn/order/KillVirus_EN_Rav.asp

*

Websites scanning services:

desenmascara.me  http://desenmascara.me/

A scanning service for websites able to detect malicious code included in hacked websites such as malicious iframes, redirections, scripts etc. It also detect if software used for a website is up to date. Because it’s new it was tested by me on a few websites vulnerable to SQL injection and has performed very well, being able to detect the weaknesses.

URLVoid http://www.urlvoid.com/

It’s a service for scanning domains(websites) in order to identify possible exploits, malware and malicious threats.

JSUNPACK  http://jsunpack.jeek.org/dec/go

It’s a generic JavaScript unpacker, can be submitted URLs, PDF, HTML or JavaScript files for analysis and malware detection.

urlQuery.net  http://urlquery.net/

It is a service for detecting and analyzing web-based malware. It provides detailed information about the activities a browser does while visiting a site and presents the information for further analysis.

https://www.metascan-online.com/en

 http://siteinspector.comodo.com/

http://zulu.zscaler.com/

http://www.websicherheit.at/en/website-security-check/

Programa: Network Protocol Analyzer
Eset Online Scanner
Panda Online Scanner
HouseCall Online Scanner
Sunbelt Online Scanner
Symantec Online Scanner
BitDefende Online Scanner
Mcafee Online Scanner
F-Secure Online Scanner
CA Threat Online Scanner
Webroot Online Scanner

Firmas
VirusChief online Scanner.
Dr. Web online Scanner.
Jotti online Scanner.
VirusTotal online Scanner.
Virscan online Scanner.
Avast online Scanner.
No Virus Thanks.

Sandbox
Anubis online Scanner.
FortiGuard online Scanner.
Norman online Scanner.
ThreatExpert online Scanner.
CW Sandbox online Scanner.
GFI Threat Track.
JS Unpack.
Comodo I.M.A.
Wepawet.
MalBox.
ViCheck.
Xandora.
Panda autovin.
Eureka.
Malwr.
XecScan

from: cleanbytes.net/malware-online-scanners