New VirusTotal Feature Returns Code Functionality Descriptions for Analysts

Security analysts face growing complexity as malware authors employ advanced obfuscation and anti-disassembly techniques.

On August 28, 2025, VirusTotal unveiled its latest enhancement—the Code Insight endpoint and VT-IDA plugin update—designed to integrate AI-driven code analysis directly into reverse engineering tools.

This innovation promises to dramatically reduce manual effort by automatically summarizing and contextualizing disassembled or decompiled functions, streamlining the malware-analysis lifecycle.

Automating Function Analysis with Code Insight

Since its introduction at RSA 2023, Code Insight has steadily expanded its scope—from scanning new file formats to uncovering hidden risks in PDFs.

The newest endpoint, api/v3/codeinsights/analyse-binary, enables analysts to submit Base64-encoded code snippets (either disassembled or decompiled) and receive two AI-generated outputs:

• Summary: A concise overview of the function’s purpose.
• Description: A detailed explanation of how the function implements its behavior.

By including a history of prior requests and analyst-edited responses in the payload, Code Insight “learns” from each iteration, refining subsequent analyses.

This memory feature allows the AI to factor in human corrections, producing more accurate and context-aware insights as the review progresses.

Integrating the endpoint into any RE tool is straightforward. As a proof of concept, VirusTotal has updated its VT-IDA plugin for IDA Pro. Analysts can now:

1. Select a function in the disassembly or decompile view.
2. Invoke Code Insight and review the AI’s summary and description.
3. Accept the analysis, edit fields as needed and store results in the CodeInsight Notebook.

With each new query, the notebook’s content enriches the AI’s understanding, expediting identification of malicious behavior and saving hours of manual code tracing.

Enhanced Workflow: VT-IDA Plugin Features

The VT-IDA plugin update demonstrates practical benefits:

By comparing the plugin’s capabilities against traditional methods, analysts can clearly see reductions in manual effort and improved accuracy through iterative AI feedback.

The practical impact was illustrated with an anti-disassembly technique example, where Code Insight correctly identified a hidden jump altering the return address.

After human refinement, subsequent analyses detected the exact hidden address and applied this knowledge to uncover similar obfuscation elsewhere in the binary.

Additionally, the plugin highlights non-English strings within code, providing translations and memory locations directly in the IDA environment.

Code Insight in trial mode invites community feedback. While current results are promising, VirusTotal acknowledges potential inaccuracies and welcomes suggestions to refine the AI models.

As reverse engineering workflows increasingly embrace LLM capabilities, this integration marks a significant step toward smarter, faster, and more collaborative malware analysis.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates