Upload + hash
Accept the file, compute its identity, and check the local cache before spending another call.
The “agent with tools” metaphor is a visual map of the real system. Every arm returns a typed artifact; none of them detonates the sample.
9bounded analysis tools
10maximum ReAct iterations
SSElive trace delivery
0dynamic execution paths
01 · The contract
The agent has freedom inside a fixed evidence spine.
MalWhere is not an unconstrained “ask an LLM about malware” demo. Every run begins with identity and static evidence, then allows the agent to decide which additional tools are worth calling. The report stays grounded in returned artifacts and can say unknown when the evidence is inconclusive.
Read the binary
PE metadata, imports, entropy, strings, YARA, and a byte visualization expose different surfaces.
Ask for more
The ReAct loop selects threat-intelligence or model tools from intermediate findings.
Keep evidence attached
Contradictory, missing, and positive signals remain visible beside the agent’s rationale.
Close the loop
A bounded run ends in a verdict, trace, or explicit failure state rather than a silent stall.
02 · Tool system
Nine tools, one bounded loop.
What the arms can do
Each tool is deliberately narrow. The model chooses among typed capabilities, while the application owns caching, timeouts, JSON repair, heartbeats, and cleanup.
PE metadataImportsEntropyStringsYARA scanEMBER LightGBMByte visualizerVirusTotalMalwareBazaar
Infrastructure around the tools: an SQLite hash cache avoids repeated work while the application owns timeouts, repair, heartbeats, and cleanup.
03 · Evidence artifacts
Make the reasoning inspectable.
The frontend receives the investigation over server-sent events. A heartbeat keeps long-running work alive; background execution, cleanup, and cache hits keep the interface honest even when a tool is unavailable.
Entropy and imports
Numerical and structural clues stay attached to the file instead of being flattened into a single opaque score.
EMBER LightGBM
A learned classifier contributes one signal among several, with its threshold and evidence context visible.
Byte grayscale
The byte image is a readable artifact for the operator, not a claim that the language model has verified visual perception.
04 · Boundaries
Static analysis is the safety boundary.
What it does
Hashes and caches samples, parses PE structure, computes entropy and strings, checks YARA rules, scores with EMBER, renders bytes, and conditionally queries VirusTotal or MalwareBazaar.
What it does not do
There is no sandbox, detonation, process execution, dynamic behavior capture, or claim that static evidence is a definitive verdict. The product communicates that boundary to the operator.
05 · Investigation output
The report preserves how the verdict was reached.
Every completed case exposes the sample identity, the tools called, their typed results, the evidence synthesis, and the final confidence. An analyst can inspect the chain without opening source files or reconstructing the run from logs.
Hash and file facts
The report begins with stable sample identity, PE properties, cache status, and the exact static-analysis boundary.
Calls and observations
Tool requests, returned artifacts, failures, and recovery remain ordered so the next decision has visible context.
Evidence with uncertainty
The synthesis cites the signals that support it and leaves unknowns explicit instead of forcing false certainty.