what
an analysis bench, not a sandbox.
void8 is a portable static-analysis pipeline that runs on a disposable windows ltsc vm. drop a binary, get a scored verdict with the supporting evidence laid out — signatures, persistence diffs, extracted indicators, yara matches, local reputation, and a contextual second opinion from a local model.
built for the msp and security practitioner making allowlist calls without standing up a full sandbox stack. when virustotal says clean and you still need to decide, this is the bench you sit down at.
run
three steps. no terminal dance.
01download void8.zip# one file
02unzip onto a clean windows ltsc vm# your snapshot, your rules
03double-click install.bat# server up, browser open
analyze. revert to snapshot. repeat. the entire toolchain ships inside the zip — no package manager, no installer chain, no network dependency at install time.
inside
what the bench actually does.
provenancemark-of-the-web inspection surfaces the originating zone, host, and referrer for any file downloaded through a browser, outlook, or smb share.
scoringweighted scoring across vt detections, signatures, entropy, pe characteristics, and yara matches, mapped to clean / suspicious / dangerous. signed-publisher trust softens soft-signal escalations; family yara matches force-escalate regardless.
reputationevery persisted scan becomes a reputation signal. hash, publisher, and product history are aggregated from your own reports directory — no external trust service. prior dangerous verdicts force-escalate automatically.
probably fine™a second trust track for files that are legitimately and permanently suspicious but not dangerous — go binaries, electron installers, packed oss tooling. earns a small score credit and reframes the ai analysis around behavioral consistency. explicit
[accepts-sus] marker or auto-promoted after repeat clean-ish scans. verdict stays suspicious; the claim is consistency, not safety.instascantwo-tier allowlist short-circuits files you've already cleared. an explicit
allowlist.txt with analyst notes, plus an auto-promoted cache that takes a hash after three clean scans with no dangerous history. full rescan is one click away when you want it.hard-blocka local
denylist.txt force-escalates any matching sha-256 to dangerous, bypassing signature trust. drop in your own incident hashes or bulk-import a feed like malwarebazaar.forgetoperator utility to purge every scan and instascan report for a specific hash and strip it from the auto-cache. never hard-deletes — moves to a
.forgotten\\ quarantine, with an audit log and an explicit warning when the hash is on either list.persistenceautoruns baselines on every scan, auto-diffed against the prior baseline to surface exactly what an installer added, removed, or modified.
unpackingrecognized installers (nsis, msi, inno, sfx, cab, msix) are extracted and every child pe gets a stripped signature check inline.
yaradrop-in rule folder with category and severity meta that maps directly to scoring. ships with a 15-rule starter set covering common families, injection, lolbin abuse, packers, and anti-debug.
indicatorsstrings extraction over the first 5mb, regex pulls for urls / ips / domains / registry / suspicious apis, then checked against urlhaus and optionally abuseipdb and otx.
reportsevery scan persists as structured json with the full autoruns csv embedded. browse, reload, export, or capture standalone state snapshots as before/after baselines.
ai assistlocal ollama, verdict-aware prompting, full environment context. clean files get a brief reassurance; suspicious files get specific pestudio tabs to check and dynamic steps to run. no data leaves the box.
built on sigcheck · pestudio · autoruns · procmon · system informer · regshot · yara
next
where it's going.
shipped
yara scanning + two-track reputation
parent + child yara with category/severity scoring, plus a second trust track (probably fine™) for files that are legitimately and permanently suspicious without being dangerous. self-reference protection prevents scoring-loop poisoning; the safety valve for dangerous history remains non-negotiable.
shipped
script & config child analysis
recognized bundled scripts (ps1, bat, vbs, js, hta, reg, lnk, py, sh, nsh, and more) get hashed, yara-scanned, and ioc-extracted alongside pe children. ioc reputation lookups run on the union with source attribution preserved — feed hits surface which child file a flagged url actually came from.
shipped
in-process forget + batch scan ui
one-click forget from any report card runs under the server's own lock, cleans both reputation caches, logs the audit trail — no server restart required. one-click batch scan spins up a powershell window against every exe/msi in downloads to calibrate the trust model against a known-good corpus.
next
semi-automatic dynamic analysis
analyst-guided dynamic workflow with automation where the cost is negligible — one-click procmon launch with pre-configured filters, autoruns diff, inetsim correlation, report append. the analyst signals state transitions (installed, launched, done) so the script doesn't have to listen for them. truly automated dynamic analysis is out of scope — the bench stays in the loop.
next
central reputation feed
external signal source for the known-dangerous flag, currently reserved for future use. lets known-bad hashes force-escalate across environments without requiring every bench to encounter them first.
planned
native msi extraction
lessmsi drop-in alongside 7z, dispatched on format detection. unlocks full child analysis for the msi corpus — currently deferred via the unpack format allowlist because 7z walks msi compound streams ~1000× slower than format-native extractors.
planned
macos and linux builds
platform-native benches for mach-o and elf with the same scoring model and frontend. likely go for single-binary distribution.
planned
kasm workspace image
pre-built kasm image with void8 inside. upload, analyze, discard. zero local footprint.