---
title: "Malware Analysis AI: Models for Triage and Detection"
canonical: https://pentestllm.ai/malware-analysis
generated: 2026-11-11T18:03:27.716Z
source: https://pentestllm.ai/malware-analysis
base_url: https://api.pentestllm.ai/v1
---

![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp)

## What the models do for an analyst

- Static triage: Read strings, imports and section data you extracted and say what kind of sample this is likely to be and what to look at next.
- Code explanation: Explain a decompiled or disassembled function in plain language and suggest names for it and its variables.
- Sandbox reports: Condense a long behavioural report into what the sample did, in order, with the lines that support each claim.
- Indicators: Pull hashes, domains, paths, mutexes and registry keys out of your notes into a clean list.
- Detection rules: Draft YARA and Sigma rules from the behaviour and strings you identified, with a note on false positive risk.
- ATT&CK mapping: Map observed behaviour to MITRE ATT&CK techniques for the report.

## Why analysts need a model that engages

Malware analysis is defensive work that requires staring at offensive code. A general assistant frequently declines the moment it sees a decompiled routine that touches credentials or encryption, even though the analyst’s goal is to detect and remove it. That makes stock models unreliable in the one place an analyst needs patience.

The security builds here are tuned or abliterated to answer security questions other models decline, so they will read the function and tell you what it does. That is reduced refusals, not zero, and the limits in the next section still apply.

## Analysis and detection only

This page is about understanding samples you are authorized to handle and writing detections for them. The [acceptable use policy](https://pentestllm.ai/acceptable-use) does not allow building, adapting or spreading malicious code for use on systems you are not authorized to test. Requests on the analysis side of that line are what the service is for.

Handle samples the way your lab rules say: isolated analysis machines, no live samples in prompts beyond the text you extracted, and care with any victim data that turns up in a sample’s configuration.

## Long inputs and structured output

Decompiler output and sandbox reports are long. The largest context window listed today is 1M tokens, and the model id `auto/security` sends a prompt over 16,000 tokens to at least the balanced tier, where recall over long inputs is better. For pipelines, builds that support `response_format` return indicators as JSON that matches your schema, ready for a threat intelligence platform.

The code sandbox on the API side ($0.05 per container-hour, 1-minute minimum) runs Python for jobs like decoding a configuration blob with a routine you have already understood. It is an isolated container, and it is not a detonation environment: do not send live samples to it.

## Where it sits in a workflow

Most teams call the API from a script that sits beside their disassembler or their sandbox: export text, send it, get a summary back into the case notes. The endpoint is OpenAI-compatible at `https://api.pentestllm.ai/v1` and also takes Anthropic-format requests. The [API overview](https://pentestllm.ai/cybersecurity-llm-api) lists the routes, and the [pricing page](https://pentestllm.ai/pricing) has per-token prices for each build.

## 9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered.

| Build | Input | Output | Context |
| --- | --- | --- | --- |
| [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 |
| [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 |
| [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 |
| [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published |
| [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published |
| [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 |
| [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 |
| [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 |
| [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 |

[Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs)

## Questions

- It can explain decompiled code, summarize behavioural reports, extract indicators and draft detection rules from material you give it. It does not replace a sandbox or a disassembler, and an analyst has to verify its reading.
- That is not what the service is for. The acceptable use policy does not allow building or spreading malicious code for use on systems you are not authorized to test. The use case here is analysis and detection.
- Yes. Give it the strings and behaviours you identified and it drafts a rule with its reasoning. Test the rule against clean and malicious sets before deploying it, because a draft can be too broad or too narrow.
- It reads text, so the limit is the context window of the build. The largest listed today is 1M tokens; each model page shows its own window.
- Per token, from a prepaid balance with a $10 minimum top-up. On 2026-11-11 input prices for security builds start at $0.40 per million tokens.

## Read next

- [Cybersecurity AI Models for security teams, defensive and offensive, on one prepaid key.](https://pentestllm.ai/cybersecurity-ai)
- [Vulnerability research Models for code review, CVE and patch analysis, and advisory writing.](https://pentestllm.ai/vulnerability-research)
- [Cybersecurity LLM API The API itself: endpoints, the auto/security router, server tools and per-token prices.](https://pentestllm.ai/cybersecurity-llm-api)
- [Red team Models for authorized adversary emulation: planning, tooling review, detection notes and reporting.](https://pentestllm.ai/red-team)

## One key, from $10

PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed.

[Get a key](https://app.pentestllm.ai/console)

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

- Input, 8,000 tokens at $0.40 per million: $0.0032
- Output, 1,000 tokens at $2.40 per million: $0.0024
- One turn: $0.0056
- 1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75