New Virustotal Endpoint offers Functionality Descriptions for Malware Analysts’ Code Requests

“Virustotal has updated its endpoint and fixed some functionality to offer more malware analysts.”

Today, VirusTotal introduced its new endpoint, a potent addition to its Code Insight platform that takes code requests and provides malware analysts with a description of its capabilities.

The new API endpoint, which pre-analyzes decompiled or disassembled code and emphasizes characteristics most important to malware hunters, was created to expedite reverse engineering processes.

Analysts can now concentrate on intricate inquiry stages instead of boilerplate documentation thanks to early adopters’ reports of notable reductions in manual triage time.

Key Takeaways

1. AI-generated summaries and thorough descriptions of code samples are returned by the analyze-binary endpoint.
2. It gradually improves insights by learning from analyst-approved history.
3. A persistent CodeInsight Notebook is created in IDA Pro with the integration of the VT-IDA Plugin.

New Endpoint Overview

Base64-encoded code blocks and context-relevant metadata can be sent as a JSON payload to the new endpoint, api/v3/codeinsights/analyse-binary. Among the payload parameters are:

Upon receiving a request, the endpoint returns two fields:

A succinct description of the function’s goal, such as anti-debugging logic or network I/O procedures. A thorough explanation of string references, API calls, control flow, and possible obfuscation methods.

The service creates a contextual model that learns as the analyst iterates by chaining together earlier requests in the history array.

Virustotal

Code Insight is different from standalone static analysis because of its chaining functionality, which allows the endpoint to “remember” and improve its insights in response to user comments.

Integration into IDA Pro

VirusTotal modified its VT-IDA Plugin to take advantage of the new endpoint right within the IDA Pro interface in order to show practical usefulness.

Now, without ever leaving their reverse engineering environment, malware researchers may choose a function in the disassembly or decompiled view, launch the plugin, and get immediate insights. Important characteristics include:

• The summary and description can be approved or changed by analysts, who can also provide more context or fix any errors.
• In order to preserve institutional knowledge, approved analyses are entered into a notebook that remains open between sessions.
• The complete notebook history is sent with each plugin execution, allowing the endpoint to generate increasingly detailed and precise assessments over time.

This endpoint represents a major advancement in the incorporation of AI-driven LLM into conventional reverse engineering tools.

Code Insight streamlines repetitive operations and speeds up threat discovery by automating the initial evaluation of code blocks and learning iteratively from analyst comments.

Early responses from the security community have been extremely positive, even though it is still in trial status.

Analysts should anticipate deeper contextual awareness, improved accuracy, and wider format support as VirusTotal enhances the service, all of which are intended to help defenders in the always-changing malware battlefield.

About The Author

Suraj Koli is a content specialist in technical writing about cybersecurity & information security. He has written many amazing articles related to cybersecurity concepts, with the latest trends in cyber awareness and ethical hacking. Find out more about “Him.”

Read More:

WhatsApp Launches Emergency Update for Zero-Click Exploit Targeting iOS and macOS Devices

About Author

daksh kataria

See author's posts