Repository Index

Dynamic unpacker based on PE-sieve

• libpeconv
• pe-sieve
• memory-forensics
• malware-unpacker

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

• binary-analysis
• taint-analysis

Automatic and platform-independent unpacker for Windows binaries based on emulation

• reverse-engineering
• unpacker
• pefile
• windows

A machine learning tool that ranks strings based on their relevance for malware analysis.

• machine-learning
• fireeye-flare
• strings
• malware-analysis

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.