A benchmark of benign and malicious binaries compiled and decompiled with Ghidra and RetDec reveals that providing both decompiler views to large language models improves malicious-class F1, primarily by increasing recall. Analysis shows Ghidra and RetDec make distinct errors, indicating their outputs offer complementary evidence for malware classification.
Multi-View Decompilation Improves LLM-Based Malware Classification
from English