Release note 3.2.4

For GLIMPS Malware Expert

The new version of our CAPE dynamic analysis engine delivers significant improvements for more accurate and efficient threat characterization:

• Performance optimization: CAPE now analyzes only the submitted source file, intelligently processing archives and their sub-files in a single pass. This targeted approach improves result accuracy while reducing processing times.
• Fewer false positives: Heuristics have been refined to flag strong indicators of malicious activity only when backed by confirmed signatures, reducing erroneous alerts caused by the Windows sandbox environment.
• Richer observables: Screenshots captured during execution are automatically compiled into a PDF, while Windows system logs and extracted files are collected and made available in dedicated archives — giving analysts full visibility into malware behavior.
• Improved interface: Submission options have been reorganized and documented to make it easier to configure analyses to your specific needs.

GLIMPS Malware Expert and the administration portal now support two-factor authentication via TOTP. This feature secures user account access with a temporary code generated by an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, etc.).

For GLIMPS Malware Expert, Detect et Kiosk

The new GLIMPS Malware FileBlacklist service relies on a database of SHA256 signatures from known malicious files, maintained by the GLIMPS CTI team. This blocklist is regularly updated to strengthen the platform’s detection capabilities against known threats. Any submitted file found in the database will be assigned a score of 1,000 points.

GLIMPS Malware Kiosk is now available in Italian and Korean.

For GLIMPS Malware Detect

The Syndetect API now returns the Submission ID (SID) in analysis results. This identifier allows you to build a direct link to the submission in GLIMPS Malware Expert, streamlining traceability and investigation (available only for files under 100 MB).

For GLIMPS Malware Expert

The Scalpel engine, which extracts technical file information (checksum, entropy, compression data, etc.), now supports CFB (OLE) file types.

For GLIMPS Malware Expert, Detect et Kiosk

• The NSRL database has been updated to version 06.2025.
• The 7z archive extraction engine has been updated and symbolic link (symlink) handling has been improved, strengthening the robustness and security of submitted file extraction.
• GLIMPS Malware Detect, GLIMPS Malware Expert, and GLIMPS Malware Kiosk have received various bug fixes.