VirusTotal Launches Endpoint That Explains Code Functionality for Malware Analysts

VirusTotal has unveiled a dedicated API endpoint as part of its Code Insight suite that accepts code snippets—either disassembled or decompiled—and returns a concise summary and a detailed description tailored for malware analysts. The endpoint, api/v3/codeinsights/analyse-binary, accepts a Base64-encoded code block and can ingest a history of prior queries and analyst-edited responses to provide context, delivering two fields: summary and description.

The release, launched over two years after Code Insight first appeared at RSA 2023, aims to automate parts of reverse engineering and integrate AI-driven analysis directly into popular disassembly tools, including a new VT-IDA plugin for IDA Pro that embeds the endpoint into the disassembly interface. In trial mode, analysts can highlight a function, send it to the endpoint, and receive AI-powered feedback, with the system progressively refining its output as the Notebook grows.

Virustotal cautions that AI-generated descriptions may occasionally miss edge-case behaviours, underscoring the continuing importance of analyst review. The update is designed to accelerate initial code triage, with trials reporting up to a 40 percent reduction in time spent on that stage.