MalLab
A malware-analysis lab for Windows, built for defenders.
Drop in a sample and MalLab does the triage: it works out what the file is, scans it with YARA rules, checks its hash against threat-intel sources, and — when you choose to — detonates it inside a disposable Windows Sandbox to watch what it does. It runs as a small local app on your own machine, and nothing executes on the host.
What it does
- Static triage. File type, hashes, entropy, strings, indicators, PE structure, Office macros and a risk score — all without running anything.
- YARA and retrohunt. Scan a sample, or re-scan every sample already in the lab, with your own rules or a managed rule pack.
- Threat intelligence. Hash lookups across the usual sources, plus indicator enrichment for IPs, domains and URLs. Only the hash is sent; samples are never uploaded.
- Sandboxed detonation. Run a sample in a hardened, throwaway Windows Sandbox and get a process-and-network graph, behaviour detections mapped to MITRE ATT&CK, and any files it drops.
- A verdict you can read. Every piece of evidence is fused into one answer: a score, a family name, a confidence level and the reasons behind it — written up as an HTML report you can print to PDF.
Get it
Download the latest MalLab-Setup-x.y.z.exe from
Releases and run it. The installer
sets up everything MalLab needs (no Python required) and offers to turn on Windows Sandbox and
download the analysis tools.
First-run warning: the installer isn't code-signed yet, so Windows may say
"Windows protected your PC". Click More info, then Run anyway. You can also
check the download against SHA256SUMS.txt from the same release.
What it needs
- 64-bit Windows 10 (version 1903 or later) or Windows 11
- For detonation: Windows Sandbox, which needs Windows Pro, Enterprise or Education, hardware virtualization (Intel VT-x / AMD-V) enabled in the BIOS, and about 4 GB of RAM
- On Windows Home or without Sandbox, MalLab still runs: static triage, YARA, threat-intel lookups and reports all work; only the live detonation features are unavailable
Built to stay safe
- Nothing runs on your host. Samples only ever execute inside Windows Sandbox, stored by hash rather than their real name.
- Network off by default. Each run checks, from inside the VM, that there's really no route out before the sample is allowed to run. A simulated-network mode lets you see what a sample tries to reach without letting it reach anything.
- A host network guard adds firewall rules on your PC so a networked sandbox can't turn around and touch the machine it's running on.
- Fail-closed. If an isolation check fails, the sample simply isn't executed, and the run is marked as such.
Who it's for
MalLab is a defensive tool — for malware analysts, incident responders, researchers and students. Only analyse samples you're authorised to handle, and follow your organisation's rules and local law; live malware is dangerous even inside a sandbox. It's open source under the MIT license, and you can build the installer yourself from the README.