OMAT (Offline Malware Analysis Tool) - Technical Overview ​

Introduction ​

OMAT (Offline Malware Analysis Tool) is a browser-based malware analysis tool designed to enhance user privacy and speed by leveraging WebAssembly (WASM) for client-side processing. Unlike traditional online malware analysis tools that rely on server-side processing, OMAT executes all malware analysis tasks within the user's browser, ensuring that sensitive data remains on the client's machine.

-> View example report

-> Contact us

FAQ ​

How does it work?
What types of malware can be analyzed?
Is OMAT free to use?
How can I test OMAT?
What is the purpose of OMAT?

Traditional Online Malware Analysis ​

In traditional malware analysis systems, the workflow typically involves the following steps:

  1. User Uploads File: The user initiates the process by uploading a malware sample to the analysis tool via their browser.
  2. Server-Based Processing: The browser sends the uploaded file to a remote server.
  3. Server Processes Data: The server performs the malware analysis on the file, which might include various techniques such as static and dynamic analysis, behavior monitoring, and signature matching.
  4. Server Sends Results: Once the analysis is complete, the server sends the results back to the user's browser.
  5. User Receives Results: The browser displays the results to the user.

Here is a sequence diagram that illustrates this traditional workflow:

OMAT In-Browser Approach ​

OMAT employs a client-side processing model utilizing WebAssembly, which allows it to perform malware analysis directly within the user's browser. This approach improves privacy and speed as follows:

  1. User Streams File: The user streams the malware sample to their browser without the need to upload it to a remote server.
  2. Browser-Based Processing: The browser utilizes WebAssembly to execute the malware analysis directly on the user's machine. WebAssembly enables high-performance execution of complex computations within the browser environment.
  3. User Receives Results: After processing the file, the browser immediately displays the analysis results to the user. The sequence diagram below illustrates this in-browser processing workflow:

Technical Implementation ​

WebAssembly ​

WebAssembly is a binary instruction format designed as a portable compilation target for high-level languages like C, C++, and Rust. It enables execution at near-native speed by leveraging modern hardware capabilities. In OMAT:

  • Performance: WebAssembly provides near-native performance by allowing the browser to execute compiled code directly, which is crucial for complex malware analysis tasks.
  • Security: By processing malware within the browser, WebAssembly minimizes the risk of exposing sensitive data to external servers. It also provides a sandboxed environment that isolates the execution of potentially malicious code.

Client-Side Analysis ​

OMAT's client-side analysis approach ensures that:

  • Data Privacy: Sensitive data never leaves the user's machine, protecting it from potential breaches and unauthorized access.
  • Reduced Latency: Analysis results are available almost instantly, as there is no need for round-trip communication with a remote server.

Conclusion ​

OMAT represents a significant advancement in malware analysis by leveraging WebAssembly to perform secure and efficient client-side processing. This approach not only enhances privacy by keeping sensitive data on the user's machine but also improves performance by eliminating server-side processing delays.