Hybrid Analysis is CrowdStrike’s public malware-analysis community, powered by Falcon Sandbox. It can combine static inspection, sandbox execution, network observations, extracted artifacts, and community context in one report. It is useful for investigating a sample that an analyst is authorized to share.
That last condition is essential. The public service is designed to aggregate and share threat intelligence. Its reports, screenshots, strings, and metadata can expose the contents of a submitted document even when the original sample is not available to every visitor.
This review checks the public service, terms, privacy notice, knowledge base, FAQ, and API v2.38.0 documentation as of August 30, 2026. Top5soft did not detonate malware, measure completion times, request elevated access, or test the commercial Falcon Sandbox product.
Correction published August 30, 2026: The previous edition incorrectly described public submissions as private by default, gave unsupported submission quotas, approval times, prices, detection scores, and performance figures, and claimed hands-on results without evidence. It also used generated interface images. This edition removes those claims and separates the public community service from private Falcon Sandbox deployments.
What Hybrid Analysis is
Hybrid Analysis is a free public malware-analysis service backed by CrowdStrike Falcon Sandbox. Users can search existing reports or submit supported files and URLs for analysis. The public FAQ describes a combination of static and runtime analysis, while the current API exposes report search, submission, quick-scan, feed, artifact, and related workflows according to authorization level.
The platform is designed for SOC, CERT, DFIR, malware-research, and incident-response work. It is not an endpoint antivirus product and does not make a file safe to open on the analyst’s own computer. Its value is observability: running or inspecting suspicious content in a managed environment and collecting evidence that can support a decision.
Falcon Sandbox is the underlying commercial product. CrowdStrike offers cloud and private deployment options beyond the public community service. Product capabilities, capacity, environments, privacy controls, integrations, and support depend on the purchased deployment and contract; a feature visible in Falcon Sandbox marketing should not automatically be attributed to every free community account.
The public-service privacy model
The Terms and Conditions say Hybrid Analysis is designed to aggregate and share threat intelligence with the public. Submitted content may be hosted, reproduced, modified, published, displayed, and distributed in free or paid offerings. The terms instruct users not to submit confidential, proprietary, or unauthorized personal information.
The privacy notice adds an important nuance. A submission form may offer a “do not share my sample with the community” choice, but screenshots and associated metadata can still be shared. Extracted strings, filenames, URLs, process arguments, document previews, and other report artifacts can reveal information even when the input file is not generally downloadable.
The knowledge base is blunter: reports from the public sandbox are searchable, input samples can be available to vetted users, and sensitive files should not be uploaded. A deletion request exists for mistakes, but removal can require staff review and the service says reports of exceptional security relevance may be retained.
For an internal document, customer record, unreleased build, proprietary script, credential-bearing log, or regulated incident artifact, do not rely on a checkbox as a confidentiality boundary. Use a licensed private Falcon Sandbox workflow, an approved on-premises sandbox, or another environment covered by the organization’s data-handling agreement.
How the analysis workflow works
A normal investigation begins by searching for an existing hash or report. If the exact sample has already been analyzed, the report may provide enough context without another upload. As with any hash lookup, a rebuilt or modified file produces a different cryptographic hash.
When an authorized sample is submitted, the service can inspect file structure and execute supported content in a selected environment. Reports can include file metadata, extracted strings, signatures, process activity, filesystem and registry changes, network connections, contacted hosts, screenshots, dropped or extracted files, and behavioral indicators. Availability varies with file type, environment, execution path, account, and analysis outcome.
Dynamic analysis is conditional. Malware can wait, require user interaction, check its environment, depend on unavailable services, use encrypted configuration, or deliver a later-stage payload only to selected targets. The absence of observed malicious behavior is therefore not proof that the sample is benign.
The public service can also perform Quick Scan operations for supported types without a full sandbox detonation. Static or multiscanner signals can be useful for triage, but they answer a different question from observed runtime behavior. A good workflow keeps those evidence types separate rather than compressing everything into one score.
Environments and execution controls
The live API documentation currently lists submission environments that include Windows 7, Windows 10, Windows 11, Ubuntu Linux, Android static analysis, and macOS on ARM. The exact set available to a user can change and may depend on authorization or deployment, so the environment list in the submission interface or API should be treated as authoritative for that account.
API submission options include action scripts, custom command lines, document passwords, runtime choices, and network modes. The current API describes normal Internet access as the default and also exposes TOR-routed or simulated networking where supported. Allowing a sample to reach the Internet may reveal the sandbox address, contact attacker infrastructure, download more content, or transmit data created during execution.
Choose the environment that matches the sample’s architecture and expected runtime. A Windows executable observed only in an unrelated environment can fail for reasons that say nothing about maliciousness. Similarly, a document may need a password or a particular application path before its behavior appears.
These controls are investigative tools, not a recipe to maximize execution at any cost. Analysts should follow authorization, egress, legal, and threat-intelligence policies before enabling live networking or interacting with attacker-controlled infrastructure.
How to read a report
Start with identity and provenance: hash, file type, size, signing information, known names, first-seen context, and the source through which the sample was obtained. Then compare static indicators with runtime observations.
A strong behavioral case usually connects several facts. For example, a document launches a script interpreter, the script writes an executable, that process establishes a network connection, and persistence changes follow. Each artifact should be inspected in context. A command line can be suspicious without being malicious, and a network connection can belong to a legitimate dependency.
Threat scores, verdict labels, community votes, and mapped techniques help prioritize attention, but none should be treated as a probability or final truth. Check which evidence triggered the label and whether the behavior actually occurred in the selected environment. Review warnings and incomplete-analysis indicators before relying on absence.
Dropped files, PCAPs, memory strings, and public samples are dangerous content. Access may require vetting, and download permission does not make an artifact safe. Store them in an isolated research environment, verify hashes, prevent accidental execution, and do not open links or commands from comments on a normal workstation.
Accounts, API access, and vetting
Registered users can create a restricted public API key. The API v2 documentation describes authorization levels including restricted, default, elevated, and super. Non-vetted free accounts begin with restricted access, primarily for searching; higher privileges unlock additional endpoints such as automated submission or artifact download.
Hybrid Analysis requires vetting before granting higher-risk capabilities such as downloading malware samples, using higher-privilege API access, or running YARA hunting workflows. The official knowledge base explains where to submit the request but does not promise approval or a fixed response time. The previous article’s 24-to-48-hour guarantee was unsupported.
Current API quotas are reported in the account and response headers. They should not be replaced with a universal number copied from an old screenshot or unrelated deployment. API documentation also changes: version 2.38.0, for example, marks the file-collection endpoints unsupported after August 21, 2026. Integrations need changelog monitoring and explicit handling for deprecation and quota responses.
API keys and downloaded artifacts are security-sensitive. Do not share credentials, embed them in public code, or run an automated submission pipeline before its data-classification and public-disclosure rules are enforced upstream.
Pricing and private deployment
The public Hybrid Analysis community service is free under its terms. CrowdStrike sells Falcon Sandbox for customers that need higher capacity, expanded environments and analysis, private cloud processing, or an on-premises deployment.
CrowdStrike’s official request page describes private and on-premises options but directs buyers to a trial or sales contact. Publicly stable list prices for a comparable 2026 configuration are not provided. This review therefore does not repeat the old invented monthly and annual figures.
A useful quote request should specify monthly file volume, burst rate, file types and sizes, required operating systems, automated submissions, API consumption, artifact retention, storage region, analyst seats, integrations, high availability, support, and whether files must remain inside the customer’s environment.
Privacy is a deployment property, not a consequence of receiving a full public API key. Vetting controls access to dangerous community capabilities; it does not turn the public service into a confidential sandbox. Teams with sensitive samples need a contract and architecture that explicitly provide the required isolation, retention, and sharing behavior.
Strengths and limitations
Documented strengths
- Combines static inspection and managed runtime analysis in one research workflow.
- Provides searchable community reports before a new submission is considered.
- Captures processes, files, registry activity, network behavior, and extracted artifacts when available.
- Supports several operating-system environments and configurable detonation options.
- Offers Quick Scan, search, submission, report, feed, and artifact APIs according to authorization.
- Uses vetting for capabilities that expose malware samples or higher-risk automation.
- Has commercial private-cloud and on-premises Falcon Sandbox paths.
Important limitations
- The community service is public-facing and built for threat-intelligence sharing.
- Screenshots and metadata can expose sensitive content even when sample sharing is restricted.
- Dynamic analysis can miss behavior that does not trigger in the selected environment.
- Public reports, labels, and scores require analyst interpretation.
- Quotas and accessible endpoints depend on the account and authorization level.
- Elevated access requires vetting and is not guaranteed on a schedule.
- Downloaded samples and artifacts remain dangerous.
- Commercial pricing and exact entitlements require a quote.
Alternatives and complementary tools
The source-verified file scanner guide separates public reputation, interactive sandboxes, cloud multiscanning, and local document sanitization.
VirusTotal is usually the better first hash-reputation lookup because of its broad contributor corpus. Standard submissions also participate in sharing, while licensed Private Scanning produces a different report without partner antivirus verdicts.
ANY.RUN emphasizes live interaction with the remote analysis machine. That can help trigger installers, dialogs, or staged behavior; Community analyses are public and private work requires an appropriate plan.
MetaDefender Cloud combines multiscanning with additional technologies such as Deep CDR and API workflows. Privacy depends on the selected service and license.
Filescan.io focuses on rapid static analysis and emulation for supported content. Its community workflow also needs a disclosure review before upload.
Dangerzone locally converts supported documents into reconstructed PDFs. It does not identify malware behavior, but it avoids sending the source document to a public cloud sandbox.
Verdict
Hybrid Analysis is a capable public research sandbox for samples that can legitimately enter a shared threat-intelligence community. Its combination of static evidence, execution artifacts, network observations, search, and API access can add much more context than a simple multiscanner count.
It is not a private-by-default place for sensitive files. The official terms and privacy notice allow broad use of submitted content, and screenshots or metadata may remain public even when the original sample is not shared with every visitor. A full API key changes authorization, not that disclosure model.
Search for an existing hash first. Submit only content that policy and ownership allow the organization to disclose. Select the environment deliberately, inspect whether the expected code path ran, and treat scores as triage rather than a verdict. Use private or on-premises Falcon Sandbox when confidentiality is a requirement.
Best fit: public malware research, authorized incident-response samples, behavioral context, and API-assisted community investigation.
Poor fit: confidential documents, proprietary binaries, personal data, unattended uploads without classification controls, or decisions based only on a threat score.
Frequently asked questions
Is Hybrid Analysis free?
The public community service is free under its terms. Private, on-premises, and expanded Falcon Sandbox deployments require a CrowdStrike quote.
Are Hybrid Analysis submissions private?
Do not assume that. The public service is designed to share threat intelligence. Even when the input sample is not shared with the community, screenshots and metadata can still expose content.
Does a full API key make submissions confidential?
No. A higher authorization level enables additional public-service capabilities. Confidential processing requires a private Falcon Sandbox deployment and appropriate contract.
Can Hybrid Analysis miss malware?
Yes. Behavior may depend on user interaction, time, network access, geography, dependencies, or environment checks. A report showing no specific threat is not a safety guarantee.
What should I do after uploading a sensitive file by mistake?
Use the report-deletion request described in the official knowledge base and contact support when needed. Removal may require review, so prevention is safer than relying on takedown.
