# 🆕 The Malware Analysis add-on for IDA Pro is here

**URL:** <https://community.hex-rays.com/t/the-malware-analysis-add-on-for-ida-pro-is-here/866>\
**Category:** Announcements\
**Created:** [November 5, 2026, 2:53pm UTC](https://community.hex-rays.com/t/the-malware-analysis-add-on-for-ida-pro-is-here/866 "2026-11-05T14:53:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jb\_hexrays](https://sea2.discourse-cdn.com/flex002/user_avatar/community.hex-rays.com/jb_hexrays/32/12_2.png) [@jb\_hexrays](https://community.hex-rays.com/u/jb_hexrays)\
**Post date:** [November 5, 2026, 2:53pm UTC](https://community.hex-rays.com/t/the-malware-analysis-add-on-for-ida-pro-is-here/866/1 "2026-11-05T14:53:45Z")

</div>

Malware analysis is full of slow manual steps: identify the packer, unwrap the inner payload, set up a safe environment to run it, then correlate sandbox results with the decompiler. The add-on does those steps for you.

→ Detects packed samples on load and offers to unpack them: memory regions imported, IAT rebuilt, original entry point (OEP) found  
→ Full-system Windows emulation: step through code safely, no VM needed  
→ Sandbox events overlaid on the disassembly and pseudocode (VMRay or Speakeasy)  
→ A heads-up from VirusTotal, MalwareBazaar and VMRay if your sample has already been reported

It works headless too: under idalib it unpacks automatically, so scripts and AI agents work with the inner payload, not the protector stub.

**[Willi Ballenthin](https://www.linkedin.com/in/ballenthin/)** walks through two case studies: unpacking a packed sample and triaging APT41’s PLUSDROP loader.  
👉🏽 **[https://lnkd.in/gstaMgbF](https://www.linkedin.com/safety/go/?url=https%3A%2F%2Flnkd%2Ein%2FgstaMgbF&urlhash=0FV2&mt=pErviyqJUmjRrF0v_zcCk4IQVLCwtxBC74Awx5IFOJYQrCCknPglKS4NY6q8g7-Rydh-hJ-N8rOiYmRQv7JCdWsOxTvzhAjfZpwdCdbA--tmtJ9lMXbn6BAK8LHLiQo83tTcZo-zgbVhiGxCXHElj1IwF_jE89_VlxWOuME7l9WLMhu9V61noWk35gFHVIcl&isSdui=true)**

➡ Launch offer: 50% off with code MALADD50 until 31 December 2026.

=================================================================  
**Promo rules and restrictions**  
\* Malware Analysis Add-on only works with an active IDA Pro 9.5 license.  
\* Cannot be combined with any other promo or discount.  
\* 50% off discount can be applied in the web shop or contacting **[sales@hex-rays.com](mailto:sales@hex-rays.com)**.  
\* Already own IDA? To attach the Add-on to your existing license, select that license from your license list before completing your purchase. See blog for install instructions.  
\* 50% off discount promo ends 31 December 2026 @ 11:59pm.