Assemblyline

Assemblyline 4 is an open-source malware analysis framework that automatically triages files using integrated analysis tools. These services may be static (analyzing file attributes on disk) or dynamic (executing the file in a sandbox or emulation service).

CAPEv2 is an open-source malware detonation sandbox specializing in dynamic execution, automated unpacking, and C2 extraction. Assemblyline forwards samples to an external CAPEv2 server for VM detonation, ingests behavioral reports (process trees, PCAPs, heuristics), and automatically submits any dropped payloads back into Assemblyline for recursive re-analysis.

Report View provides a consolidated, high-level summary of a submission, aggregating overall risk scores, key heuristics, generated tags, and Indicators of Compromise (IOCs) across all processed files. Detailed View exposes the full interactive file tree structure, allowing analysts to inspect individual service outputs, raw technical logs, extracted child files, and granular execution metadata step-by-step. We suggest setting the detailed view as default within your user settings, as shown in the video above, as this is the most useful for experienced analysts.

The current AssemblyLine and CAPEv2 instance supports Microsoft Windows, however, we may add support for other operating systems in the future.

Submission Profiles are predefined configurations specifying active services and parameters for distinct workflows. Users can pick a profile during upload or set a default in account preferences to run only the services relevant to their task. We suggest using the Dynamic Analysis profiles to ensure files are submitted to CAPEv2 that performs dynamic analysis, unpacking, config extraction, C2 extraction and a number of other important services.

Yes, you can create an API key with applicable permissions, then use the API documented here: https://cybercentrecanada.github.io/assemblyline4_docs/integration/rest/, and https://assemblyline.invokere.com/help/api. We suggest using the al_client Python package to interface with Assemblyline, as it has most API functionality baked in already.

Files can be downloaded via the web user interface or API. By default this will wrap files in the Assemblyline CaRT format, however, this can be changed to a password-protected ZIP archive in the user settings, as shown in the video at the top of this page.

There are hard limits and limitations to specific Assemblyline services. These may result in exceptions occurring within a specific service that's shown in the submission interface that can be reviewed. This typically does not mean, however, that the submission failed in its entirety.

All users are anonymized on the Assemblyline platform and you will receive randomized username that you can share with others, or change your username to something you'd prefer.

Yes, currently in the closed-Alpha all user submissions will be seen by everyone with an account.

Extracted files are sub-components discovered within a submission (such as payloads inside a ZIP container or macros in a Word document) that Assemblyline automatically re-submits for recursive analysis. Supplementary files are informational artifacts generated by services during analysis (such as PCAP logs, process tree graphs, or execution screenshots) intended to be viewed by human analysts.

We provide custom rule sets, configuration extractors and services that can assist with your malware triage process. We are also continuously working on hardening and maintaining the Assemblyline and CAPEv2 instance to ensure modern malware is processed properly. The instance also allows collaboration, where samples can be shared and worked on together, without using third-party services. All tools are maintained in-house and your samples do not leave Invoke RE systems.

Currently we've restricted submissions to 5 simultaneous submissions and 100 submissions per day. If you need more, please ask us.

Please ensure you are using the Auth0 login interface for Assemblyline (click SIGN IN WITH AUTH0). This is a separate authentication system to our training platform, so you will need to set up a new set of credentials. If you are still having issues, please send a support request to info@invokere.com.