Repository Index

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

• binary-analysis
• taint-analysis

PE-bear (builds only)

• pe-analyzer
• pe-format
• pe-editor

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.

• research
• anti-debug
• malware

Advanced analysis software for APK payloads created by RATs.

• apk
• remoteaccesstrojan
• reverse-engineering
• aapt

Builds json representation of PDF malware sample