Repository Index

Scan files or process memory for CobaltStrike beacons and parse their configuration

Dynamic unpacker based on PE-sieve

• libpeconv
• pe-sieve
• memory-forensics
• malware-unpacker

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

• binary-analysis
• taint-analysis

Sandboxed Execution Environment

• python
• sandbox
• malware-analysis
• malware-research

Dynamic analysis of Android apps

Automatic and platform-independent unpacker for Windows binaries based on emulation

• reverse-engineering
• unpacker
• pefile
• windows

Script to create templates to use with VirtualBox to make vm detection harder

• virtualbox
• antivm
• sandbox
• malware-analysis

Simple Bash IOC Scanner

PE-bear (builds only)

• pe-analyzer
• pe-format
• pe-editor

A machine learning tool that ranks strings based on their relevance for malware analysis.

• machine-learning
• fireeye-flare
• strings
• malware-analysis

HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.

• malware-analysis
• dynamic-analysis
• security
• linux

Malicious HTTP traffic explorer

A tool for studying JavaScript malware.

• malware
• malwareanalysis
• nodejs
• es6

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Modular file scanning/analysis framework

• python
• analytic-machines
• analysis-framework
• python-script

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Yet another static code analyzer for malicious Android applications

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

AVClass malware labeling tool

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler

Drltrace is a library calls tracer for Windows and Linux applications.

• dbi
• malware-analysis
• malware-detection
• api-trace

Modified edition of cuckoo