Malware analysis is full of slow manual steps: identify the packer, unwrap the inner payload, set up a safe environment to run it, then correlate sandbox results with the decompiler. The add-on does those steps for you.
→ Detects packed samples on load and offers to unpack them: memory regions imported, IAT rebuilt, original entry point (OEP) found
→ Full-system Windows emulation: step through code safely, no VM needed
→ Sandbox events overlaid on the disassembly and pseudocode (VMRay or Speakeasy)
→ A heads-up from VirusTotal, MalwareBazaar and VMRay if your sample has already been reported
It works headless too: under idalib it unpacks automatically, so scripts and AI agents work with the inner payload, not the protector stub.
Willi Ballenthin walks through two case studies: unpacking a packed sample and triaging APT41’s PLUSDROP loader.
https://lnkd.in/gstaMgbF
Launch offer: 50% off with code MALADD50 until 31 December 2026.
=================================================================
Promo rules and restrictions
* Malware Analysis Add-on only works with an active IDA Pro 9.5 license.
* Cannot be combined with any other promo or discount.
* 50% off discount can be applied in the web shop or contacting sales@hex-rays.com.
* Already own IDA? To attach the Add-on to your existing license, select that license from your license list before completing your purchase. See blog for install instructions.
* 50% off discount promo ends 31 December 2026 @ 11:59pm.