Jekyll2026-04-06T14:15:52+00:00https://tylabs.com/feed.xmlMaldocs and Threat Intelligence ToolsTyLabs is known for maldocs analysis tools since 2008. Home of QuickSand, Cryptam and PDFExaminer.TyLabsQuickSand Serverless in Gcloud2025-07-17T21:50:00+00:002025-07-17T21:50:00+00:00https://tylabs.com/blog/gcloud-updateQuicksand Now on GCP: Serverless Malware Analysis with Cloud Functions and Storage

We’re excited to announce a major update for Quicksand, our open-source malware analysis tool. Following up on our original blog post, we’ve now ported Quicksand to Google Cloud Platform (GCP), leveraging the power of Cloud Functions and Cloud Storage for a more scalable and efficient threat analysis experience.

The Move to Serverless

By moving Quicksand to a serverless architecture on GCP, we’re able to offer a number of key advantages:

  • Scalability: Cloud Functions automatically scale in response to the number of files you need to analyze. Whether you have one document or thousands, Quicksand on GCP can handle the load.
  • Cost-Effectiveness: With a serverless model, you only pay for the compute time you use. This makes Quicksand an even more affordable option for individuals and organizations of all sizes.
  • Simplified Workflow: The new GCP integration streamlines the process of analyzing malicious documents. Simply upload your files to a Google Cloud Storage bucket, and a Cloud Function will automatically trigger a Quicksand scan.

How It Works

The new GCP implementation of Quicksand is designed to be simple and easy to use. Here’s a high-level overview of the workflow:

  1. Upload to Cloud Storage: Drop your suspected malicious documents into a designated Google Cloud Storage bucket.
  2. Trigger the Cloud Function: A Cloud Function is automatically triggered when a new file is uploaded to the bucket.
  3. Quicksand Analysis: The Cloud Function executes a Quicksand scan on the uploaded file.
  4. View the Results: The analysis results are then stored in another Cloud Storage bucket, where you can easily access and review them.

All of the code for the new GCP integration is open-source and available on our GitHub repository. We encourage you to check it out, try it for yourself, and contribute to the project.

Get Started Today

We’re thrilled to bring the power of Quicksand to the Google Cloud Platform. This new integration makes it easier than ever to analyze malicious documents and gain valuable threat intelligence.

To get started, head over to our GitHub repository and follow the instructions in the README. We’re always looking for feedback, so please don’t hesitate to open an issue or a pull request.

Happy hunting!

]]>TyLabsCryptam + PDFExaminer = QuickSand2021-07-30T19:34:30+00:002021-07-30T19:34:30+00:00https://tylabs.com/blog/maldoc-toolsIn 2020, as a pandemic project I rewrote my older QuickSand tool from C into Python and incorporated the features of PDFExaminer into it, dropping the XOR analysis that’s become less common since the early days of document malware. QuickSand allows you to scan within the streams and embedded content of a document or PDF using Yara. QuickSand can also generate similarity hashes for the elements that make up a document, a kind of structural hash.

You can use the online demo version at scan.tylabs.com running as a serverless AWS Lambda container or download the Python code below or use the quicksand command line tool locally pip3 install quicksand.

Example

QuickSand is based on the combination of two tools that I originally created in 2009. Cryptam and PDFEXaminer that were designed as PHP web-based malware scanning tools to detect malware in phishing documents. At the time, office documents and PDFs had very low detection in commercial AV. Command-line versions are available in their mostly unmaintained form. QuickSand was designed with more of an Analyst focus, automating the extraction of all the streams for further digging while also creating a formal scoring system to present a determination of risk to less technical users.

]]>TyLabs