General
What is the difference between Ask mode and Agent mode?
Ask mode is a fast Q&A interface that responds instantly using the triage data already collected for your sample. It doesn’t run any tools. Agent mode gives the AI full access to the analysis toolkit (Ghidra, YARA, Python, etc.) inside an isolated sandbox. Use Ask for quick questions, Agent for deep analysis. See Analysis Modes for the full breakdown.What file types can I upload?
DECODA supports 26+ file type categories including Windows PE, .NET, ELF, Mach-O, Office documents, PDFs, scripts, Java JARs, Android APKs, PCAP captures, Windows event logs, registry hives, and more. See Supported File Types for the complete list.Is my malware sample executed during analysis?
By default, DECODA performs static analysis - tools like Ghidra decompile the binary, YARA scans for signatures, and Python scripts parse file structures without running the sample. Agent mode can also perform isolated dynamic analysis when needed: Speakeasy emulates PE binaries, strace traces ELF syscalls, and FakeNet-NG captures network intent. All dynamic analysis runs inside a network-disabled Firecracker microVM, so the malware can never reach the real internet or escape the sandbox.Can malware escape the sandbox?
The sandbox runs inside a Firecracker microVM with no network access, no root privileges, and strict command blocking. Each analysis gets a fresh VM that is destroyed afterwards. There is no persistent state between sessions.Analysis
Why didn’t the agent use Ghidra on my sample?
Ghidra scripts are only available on Pro and Max tiers. On the Free tier, the agent uses other tools like strings analysis, YARA, and Python. Additionally, Ghidra is best suited for native code (PE, ELF, Mach-O) - for .NET samples, the agent uses ILSpyCMD instead, and for Java, it uses CFR/JADX.The agent seems stuck or is taking a long time
Agent mode analyses can take up to 13 minutes for complex samples, especially when running Ghidra scripts on large binaries. Each tool has its own timeout (60 seconds for Python, up to 10 minutes for Ghidra), and the agent can auto-continue across multiple steps. If an analysis appears stuck, you can start a new message - the previous tool execution will time out gracefully.Can I use my own YARA rules?
Yes. You can add custom YARA rules to your account. These are applied alongside DECODA’s built-in rulesets during triage and are available to the agent for on-demand scanning. Rule limits depend on your tier: 5 (Free), 50 (Pro), Unlimited (Max).How are samples deduplicated?
Samples are deduplicated by SHA256 hash within your account. If you upload the same file twice, the existing triage data is reused rather than re-running the pipeline.Can DECODA open password-protected sample archives?
Yes. For ZIP, 7z, and RAR archives, DECODA tries the passwords commonly used to share malware samples -infected, malware, virus, password, and 123456 - inside the sandbox. If one works, it selects the primary file from the archive and analyses that. Extraction is bounded by size and file-count limits to guard against zip bombs.
Billing
What happens when I hit my monthly limit?
If you’re on the Pro or Max tier, you can continue with credits. Credits are purchased in packs and deducted one per query when your monthly allocation is exhausted. On the Free tier, you’ll need to wait until the next month or upgrade. See Plans & Billing for details.Do credits expire?
Yes. Top-up credits expire 6 months (182 days) after purchase, on a rolling per-purchase basis. Each credit is one additional Agent mode analysis beyond your monthly allocation.Can I downgrade my plan?
Yes. Downgrade from Settings > Billing. The change takes effect at the end of your current billing period - you keep your current tier’s limits until then.Can I cancel my subscription?
Yes. Cancel from Settings > Billing. Cancellation takes effect at the end of your current billing period, so you keep access to your tier’s features until then. There is no refund for the remainder of the period. If you change your mind before the period ends, a Resume button reactivates the subscription so it continues renewing normally.When are credits refunded?
Credits are automatically refunded when an Agent mode analysis is cancelled or fails before any meaningful work is done. This covers analyses you cancel yourself (user_cancelled), sandbox failures (sandbox_failed), AI provider errors (provider_error), and runs that finish with no usable output (no_output). You don’t need to request the refund - it happens automatically.
What do the subscription statuses mean?
| Status | Meaning |
|---|---|
| active | Your subscription is current and renewing normally. |
| canceled | Cancellation is scheduled; access continues until the end of the current period. |
| past_due | A payment failed. Update your payment method in the billing portal to keep your features. |
| paused | Billing and renewals are temporarily suspended. |