INDEPENDENT CYBERSECURITY RESEARCH

Threats are noisy.
Evidence isn't.

Windows malware analysis, reverse engineering, and technical threat research. We turn suspicious code into clear, defensible findings.

Explore services View research
STATIC ANALYSIS ✦ REVERSE ENGINEERING ✦ DIGITAL FORENSICS
VARKAI / METHODOLOGY RESEARCH ACTIVE
› 01 Identify the artifact / hash, format, metadata
› 02 Trace execution paths / loader, API, control flow
› 03 Evaluate behavior / evidence, confidence
› 04 Deliver findings / report, IOC, limitations
ANALYSIS MODESTATIC-FIRST
01 /Evidence before attribution.
02 /Technical depth when it matters.
03 /Clear conclusions, honest limits.
WHAT WE DO 01

Analysis at the
right level of depth.

Start with a focused assessment. Go deeper only when the evidence—and your questions—justify it.

SERVICE / 01

Static Triage

A fast, grounded first look at a suspicious Windows executable.

$35 / per sample
  • SHA-256 and file characteristics
  • Suspicious imports, strings, and structure
  • Initial threat assessment
  • Concise PDF summary
Discuss this service
SERVICE / 02 MORE CONTEXT

Extended Static Assessment

A closer examination of a sample's likely capabilities and relevant indicators.

$75 / per sample
  • Everything in static triage
  • Targeted code-path inspection
  • Indicators and evidence mapping
  • Expanded PDF findings
Discuss this service
SERVICE / 03

Targeted Reverse Engineering

Focused technical investigation of a specific question or mechanism.

$125+ / scoped engagement
  • One agreed technical objective
  • Loader, obfuscation, or payload analysis
  • Annotated code-level findings
  • Detailed technical report
Discuss this service

All packages cover authorized defensive analysis. Live sandbox execution, remediation, and open-ended reversing require a separately agreed scope. Prices are introductory estimates and may change before bookings open.

THE PROCESS 02

Method over
guesswork.

Every finding should answer two questions: what does the code support? and what remains uncertain?

01

Scope the investigation

Agree on the sample, analysis goals, limitations, and authorized handling.

02

Inspect and reconstruct

Analyze static artifacts, follow execution paths, and extract embedded components where justified.

03

Report with evidence

Separate observed code behavior, inferred capabilities, and unanswered questions.

INDEPENDENT RESEARCH 03

Inside the analysis.

Research that shows the process behind the conclusion—not just a detection label.

MALWARE RESEARCHCASE STUDY IN PREPARATION

Remus: tracing a multi-stage Windows payload

An ongoing static investigation covering an obfuscated Go loader, recovered PE payload, API resolution, and communication-related code paths.

Research notes undergoing verification before public release 2026
GET IN TOUCH 04

Have a suspicious
binary?

We're preparing our client inquiry channel. A working contact address will appear here when the service opens. For now, please do not upload executables, credentials, or sensitive data through public forms.

INTAKE STATUS
Opening soonFirst: establish secure contact and a sample-handling process.