How to use AI Malware Analysis | 4ntar3s

Start with a lab example, inspect a file, or import event records. Everything you add stays in the current browser tab. Export your report before reloading, closing the tab, or clearing the session.

Find your way around

Switching among the four app views keeps your session. The numbers on Overview summarize incidents, inspected files, processed events, and copies currently in the vault. They are counters, not buttons.

Start with the lab scenario

1. Open Overview.
2. Click Load lab scenario.
3. In an otherwise empty session, you should see 4 incidents, 3 files, and 11 events.
4. Select an incident to read its evidence. Open File analysis to inspect the sample file results.

The scenario uses labeled, harmless examples. Its sample events describe a startup change, a download-and-execute pattern, and AI API activity accompanied by a startup-file write. The AI-related activity also matches a persistence rule, so four incident records come from three example behavior chains.

The same Load lab scenario action can appear in an empty incident list. It opens the same example set.

Loading the scenario keeps your existing files and events. Loading it again does not duplicate its records.

Investigate an incident

1. In Overview, click an incident in the list.
2. Read the selected finding's title, priority, explanation, and recommended next step.
3. Follow the event timeline.
4. Click Show event fields on an event to expand its recorded details. Click it again to collapse them.

Use Search incidents to filter by an incident title, host, rule, or technique. Clear the search text to show the unfiltered list. Use the severity dropdown to select All severities, Critical, High, Medium, Low, or Informational. Search and severity filters work together; return to All severities if a finding is hidden.

Changing a filter does not delete records. A message saying no incidents match your filters means the current view is empty, not that the session has been cleared. Scores help decide what to review first; they are not percentages of certainty.

Inspect a file

1. Select File analysis.
2. Click Inspect a file and choose one file, or drag one file onto Drop one file for inspection.
3. Wait for the inspection to finish.
4. Click its row under Inspected files to view the result.

Each file must be 10 MiB or smaller. The current session can retain up to 50 files and 64 MiB of file and event data in total, including vault copies. Choosing a file reads a temporary copy in this browser tab; its bytes are not uploaded.

The selected result shows the filename, size, detected type, SHA-256, priority, and any supporting findings. An empty findings list means the available checks found no matching indicators; review the displayed result before deciding your next action.

Copy the SHA-256

Click Copy SHA-256 beside the selected file's hash. Paste it into your notes or another tool when you need to identify those exact file bytes. If the browser blocks clipboard access, follow the message and copy the selected hash manually with your usual copy shortcut.

Select another result

Click a different file row to change the detail panel. Inspecting another file adds another result to the session. The file count includes inspected copies even when a copy has moved to the vault.

Import event records

1. Open Overview.
2. Click Import events.
3. Choose a .json, .jsonl, or .ndjson file no larger than 10 MiB.
4. Wait for the import to finish, then select a resulting incident.

Use a JSON event array, an object containing an events array, or newline-delimited JSON records. Records need a timestamp (time), host (host), and integer event ID (event_id). A process GUID (process_guid) and the relevant process, network, file, or registry fields are needed to connect events into a finding. The online importer uses Sysmon-style event IDs; it does not accept XML files. Reimporting the same event content does not add duplicate records.

The session can hold 10,000 events. If an import is rejected, read the message, correct the input or start a new session after exporting, and try again. Not every imported event produces an incident.

Move a copy to the vault

1. In File analysis, select the inspected file.
2. Click Quarantine analysis copy.
3. Read the confirmation and verify the selected filename.
4. Click Quarantine copy to continue, or Cancel to leave it where it is.
5. Open Response vault to see the resulting entry.

This action moves only the temporary copy held by this browser session. The original file on your device stays where it is. It does not stop a process or isolate a computer. Vault copies still count toward the session's retained-file limit.

The vault displays the copy's filename, hash, status, and action time. The file detail view also shows when its copy is quarantined.

Restore a copy

1. Open Response vault.
2. Find the quarantined entry.
3. Click Restore copy.
4. Confirm with Restore copy, or click Cancel.

The copy returns to the analysis workspace after its hash is checked. Its vault entry shows that it was restored. Restoration does not execute the file or write it back to its original device path.

Quarantining and restoring are available only while the current session exists. A page reload or cleared session cannot be undone by clicking Restore.

Export a report

1. Click Export report in the top bar.
2. Save the downloaded JSON file using your browser's download controls.
3. Keep it with your notes before ending the session.

The report contains the session's analysis results, incident evidence, import and vault details, and recent action history. It does not contain downloadable copies of the files you inspected, and it is not a backup that can recreate the workspace.

Export does not clear the app. You can continue working and export an updated report later. Reports can contain filenames, hostnames, paths, and command text from your input; choose where you save or share them accordingly.

Use full screen

Click the full-screen icon in the top bar, labeled Enter full screen, to give the workspace more room. Click it again when labeled Exit full screen, or press Esc, to leave full screen.

If your browser does not allow full screen, keep using the normal view. On smaller screens, use the app navigation to move among Overview, File analysis, Response vault, and How to use.

Clear the session

1. Export a report first if you want to keep the results.
2. Click Clear session.
3. Read Clear this session?
4. Choose Clear session to remove all current files, events, incidents, and vault copies, or Cancel to keep them.

Clearing is immediate after confirmation and cannot be undone. It removes the browser's temporary workspace; it does not change original files on your device. A reload or closed tab also ends the session.

Messages and common next steps

No refresh action is needed inside the app: the views update after each completed operation. Use How to use whenever you want to return to these steps.