analyze_file
Analyze suspicious files for malware using REMnux tools. Detects file type automatically and runs appropriate analysis tools with configurable depth levels for triage or comprehensive investigation.
Instructions
Auto-analyze a file using REMnux tools appropriate for the detected file type. Runs file to detect type, then executes matching tools (e.g., PE → peframe/capa, PDF → pdfid/pdf-parser, Office → olevba/oleid). Use depth to control analysis intensity: 'quick' (triage only), 'standard' (default), 'deep' (includes expensive tools). Note: 'standard' is sufficient for most files; use 'deep' only when standard doesn't reveal enough.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | Filename relative to samples directory, or absolute path in local mode | |
| timeout_per_tool | No | Timeout per tool in seconds (default: 60) | |
| depth | No | Analysis depth. 'quick' (~5-15s): fast triage. 'standard' (~30-90s, default): comprehensive analysis. 'deep' (~2-5min): exhaustive. Use 'deep' only when 'standard' isn't enough. | standard |