Ransomware file analyzer: check a file against ransomware IOCs
We check the file against the Ransomware.live database (IOCs and YARA rules) to see if it matches a known ransomware family. It also gets a static analysis in an isolated sandbox: PE / .NET / ELF structure and capabilities, shortcuts (LNK), scripts, Office macros, ransomware behaviour strings, MITRE ATT&CK techniques and embedded IOCs. Don't upload documents that contain personal or confidential data.
Looking up an IP address or a hash (MD5, SHA-1, SHA-256, …) rather than a file? Use the Ransomware.live IOC search engine.
1 Prove you're human
Drag the circle into the matching outline.
2 Upload a file
How the ransomware file analyzer works
1. Hash and IOC matching
MD5, SHA-1, SHA-256 and SHA-512 are matched against the ransomware IOCs published by Ransomware.live, and the file's strings against emails, Tox IDs, wallets and onion addresses tied to ransomware groups.
2. YARA rules per group
The file is scanned with the YARA rules written for each ransomware group, so a known family is named even when its exact hash is new.
3. Sandboxed static analysis
PE, .NET, ELF, LNK, scripts and Office macros are parsed in an isolated sandbox: imports and capabilities, entropy, signatures, decoded PowerShell, ransom-note text and MITRE ATT&CK techniques.
Frequently asked questions
Is this ransomware file checker free?
Yes. Solve a short puzzle to prove you're human, then upload up to 64 MB per file, up to 20 files per verification. Each file gets a permanent report link you can share.
What does the analyzer check?
The file's MD5, SHA-1, SHA-256 and SHA-512 against the hash IOCs Ransomware.live publishes, its embedded strings against our other IOCs (emails, Tox IDs, Bitcoin and Monero wallets, onion addresses, mutexes), and its bytes against our per-group YARA rules.
Is the file executed?
No. The analysis is static: the file is parsed, never run, inside an isolated sandbox with no network access. It covers Windows PE and .NET executables, Linux ELF binaries, Windows shortcuts (LNK), PowerShell and other scripts, and Office documents with VBA macros.
Does "No match" mean the file is safe?
No. It means we have no known indicator for it: new or repacked ransomware has no IOC yet. Look the SHA-256 up on other services too, and report anything suspicious to us.
Are uploaded files kept?
Yes. Files are kept for research, with their hashes, analysis and upload details (visible to Ransomware.live staff only, never on the public report). Don't upload documents containing personal or confidential data.
How are findings mapped to MITRE ATT&CK?
Every behaviour and capability the static analysis finds (shadow-copy deletion, file-encryption APIs, process injection, encoded PowerShell...) carries the matching MITRE ATT&CK technique IDs, listed together on the report.