Corpus search results

The corpus view is accessed using the F9 shortcut in Full & Pro versions of Malcat. It displays results of pattern and/or Yara searches across a corpus of local directories and files or using online datasets like VTgrep or MalwareBazaar.

Displaying results

Once the corpus search has finished (you can monitor the progress through the statusbar’s gauge control), Malcat will automatically open the corpus view. It is a three columns grid view that displays the result of the pattern search / Yara scan across local and remote corpus sets.

Local corpus hits

Under the Local corpus hits category, you’ll find all the files located inside one of your local corpus directories (cf. Organising your local corpus directories) which are matching the searched pattern or the selected Yara rule.


Corpus view displaying pattern search results

For local corpus hits, the grid columns have the following meaning:

  • the first column (Object) displays the path to the file relative to the corpus root directory.

  • the second column (# Hits) displays how many times the selected pattern was found in the file, or the number of string matches in the file for a Yara rule

  • the third column (Corpus) displays the label of the corpus where the file was found

Double-clicking on a row will open the selected file as a new project in Malcat. All the matching patterns (or matching Yara strings in case of a Yara scan) will be automatically highlighted in the newly open file, so that you easily inspect them and see if it is indeed the file you were looking for. Hitting Ctrl+N or Ctrl+Shift+N let you cycle through all the matches, like when Searching in current file.

Virustotal hits

For some time, Virustotal introduced a great feature named VTGrep. VTGrep allows premium Virustotal users to perform fast pattern searches in Virustotal’s malware corpus. This feature is also integrated inside Malcat’s own corpus view, in addition to the local corpus search.


Currently, you can only search for patterns on Virustotal. Yara scans on VT sadly are too slow, and we had to deactivate the functionnality.

After selecting a string, a function or any arbitrary data range in Malcat and starting a corpus search (cf. Searching in the corpus), you will be able to list all files containing this pattern in Virustotal:


Corpus view displaying VTgrep results

For Virustotal’s hits, the grid columns have the following meaning:

  • the first column (Object) displays the initial name of the file in Virustotal. Note that files may have been uploaded several times using different names on Virustotal.

  • the second column (# Hits) displays the number of antivirus detections on Virustotal for the matching file

  • the third column (Corpus) displays the type of the matching file as reported by Virustotal

Double-clicking on a row will open a new browser tab on the Virustotal’s report for the selected file.

MalwareBazaar hits

MalwareBazaar queries are not implemented yet, stay tuned!