Malware analysts often lack access to source code and rely on decompiled pseudo-C to inspect compiled binaries. Recent work has shown that large language models (LLMs) can assist by classifying decompiled code as benign or malicious. However, according to a paper by Turkmen, Bercan, Raina, and Vyas, existing pipelines typically depend on a single decompiler view—an assumption they argue is fragile.
The Problem with Single-Decompiler Approaches
Decompilers are lossy heuristic tools that can produce different artefacts from the same binary. The researchers note that different decompilers expose different artefacts, making single-view classification potentially unreliable. To investigate, they curated a benchmark comprising benign utilities and malicious programs spanning a range of threat behaviors.
The Multi-View Decompilation Method
Each sample in the benchmark was compiled and then decompiled with two popular decompilers: Ghidra and RetDec. This produced matched pseudo-C views for every binary. The researchers then fed these paired views into LLMs from major model families, prompting the models to classify the code as benign or malicious. This multi-decompiler prompting approach requires no additional training and is simple to implement.
Performance Gains and Complementary Evidence
Across a range of LLMs, the study found that providing both decompiler views improves malicious-class F1 score, primarily by increasing recall on malicious samples. Agreement analyses revealed that Ghidra and RetDec make partially different errors, confirming that the decompiler outputs provide complementary evidence. The authors state that "multi-decompiler prompting is a simple, training-free way to improve LLM-based malware triage in practical settings."
Implications for Enterprise Cybersecurity
For enterprise security operations, this finding offers a straightforward method to boost the accuracy of automated malware triage. By integrating multiple decompilers, organizations can improve detection of malicious binaries without overhauling existing LLM pipelines. The technique leverages existing tools (Ghidra and RetDec) and does not require model retraining. While the study focuses on classification, the principles could extend to other binary analysis tasks where decompiler diversity provides more complete information.
The research underscores the value of ensembling heuristic tools in machine learning workflows, particularly in security domains where false negatives carry high risk. As LLMs increasingly aid in malware analysis, multi-view decompilation offers a practical enhancement with minimal overhead.
